AI agents are everywhere at @Uber. It’s great to see, but the thing that keeps me up at night is how we are going to secure them. This is something that I have been thinking about for a while. Today, our agents run 50,000+ sessions per day across thousands of endpoints. And this isn't just engineering anymore. Employees across the company use agents that read code, run commands, call internal tools, analyze data, and act on real systems. That scale forced us to confront an important question: How do you secure agents when your security tools can't even see them? Traditional Endpoint Detection & Response (EDR) sees the file write, but not the prompt that triggered it. It sees the network call, but not the agent's reasoning. The intent, the thing that separates malicious from benign, is invisible. So we built Agentic Detection and Response (ADR): • Capture the full causal chain: prompt → reasoning → tool call → outcome, across Cursor, Claude Code, Codex, and every agent our employees use. • Triage cheaply: a fast, high-recall first pass handles the flood of benign sessions. • Reason deeply: only suspicious events get expensive LLM analysis, enriched with source code, threat intel, and policy context. • Red-team continuously: an offline explorer evolves hard attack variants before attackers find them. After 10+ months in production, the results speak for themselves: • Hundreds of credential exposures detected across 26 categories. • Shift-left prevention blocking secrets at 97.2% precision, before they ever leave the laptop. • Zero false positives on our enterprise benchmark, with 2-4x the F1 score of state-of-the-art baselines. • Every attack detected on AgentDojo, the public prompt injection benchmark. Just as valuable as the detections are the lessons from running this in production: • The workflow is the unit of security, not the individual tool call. Attacks hide in causally-linked chains that look benign step by step. • Credential leakage is a far more common operational issue than prompt injection. • Approval fatigue is real: when users approve 50+ actions per session, human oversight becomes a rubber stamp. You can't secure agents you can't observe. And nobody can solve this alone. That is why we recently joined the Open Secure AI Alliance (OSA), and why today we're taking the next step: open-sourcing ADR. The release includes the ADR Sensor, the detection framework, and ADR-Bench, the first enterprise agentic AI security benchmark: 302 tasks derived from real production telemetry and full coverage of all 17 attack techniques across 5 tactics, so the community can rigorously evaluate their own defenses. Code: Paper: The future of AI security won't be built behind closed doors. Excited to see what the community builds on it, and what we all learn together! @UberEng