Definition
Plain language
Uber's production AI security system that monitors what AI coding assistants are actually doing on developer laptops.
As stated in the literature
Agentic Detection and Response — a tiered LLM-based security system mirroring SOC structure, with endpoint sensors parsing local agent session logs, fast LLM triage, and a deeper investigator agent that pulls source code and threat intel via MCP.
Also called: ADR-Bench
Why it matters: As coding agents act on real machines, classic security tools can't see what they're doing — ADR is one of the first published systems built specifically to watch them.
For example, if a developer's Copilot session starts running unusual shell commands, ADR's endpoint sensor flags it and an investigator agent pulls the related source code to assess intent.
Heard on the show
“… The full title of the paper is "ADR: An Agentic Detection System for Enterprise Agentic AI Security," and the reason we are sitting with …”Episode 057 — How Uber Caught 206 Leaked Credentials With an LLM-Powered Security Stack