Uber's ADR System Shows How to Detect Malicious AI Coding Agents at Scale

Uber has published details of a production system called ADR, Agentic AI Detection and Response, built to monitor the AI coding agents its engineers now run against internal code and infrastructure. The work, accepted to the MLSys 2026 Industry Track, matters because most organizations rolling out Cursor, Claude Code, or Cline with MCP tool access have no equivalent visibility. They can log which files an agent touched or which commands it ran, but they generally cannot tell whether those actions followed a legitimate instruction or a hijacked one. ADR is built specifically to close that gap, and Uber’s numbers suggest it works at a scale few other public deployments can claim: over 7,200 hosts and more than 10,000 agent sessions a day, running for ten months.

Why MCP Agents Create a New Blind Spot

Coding agents connected through MCP servers can read source code, query databases, open tickets, and execute shell commands, often with broad standing permissions because restricting them too tightly breaks their usefulness. That combination, high permission and natural-language steering, is exactly what indirect prompt injection exploits. An attacker does not need to compromise the agent’s host. They only need to get malicious text in front of it: a hidden instruction in a Jira ticket, a comment in a pull request, or a crafted response from a connected MCP server.

Uber’s team cites an emulation of the previously disclosed Agent Flayer pattern as a concrete example. A malicious email generated a Jira ticket containing a hidden instruction. When Cursor, connected to Jira through MCP, later processed that ticket as part of a normal workflow, the injected text led it to read local configuration files and transmit credentials over HTTP. Nothing about the shell commands or network call looked unusual in isolation. What gave it away was the sequence: injected instruction, followed by credential access, followed by outbound transfer, all tied to a single reasoning chain.

Architecture: Sensor, Explorer, Detector

ADR is organized around three components. The Sensor is a lightweight endpoint agent that runs on an hourly schedule, averaging about 0.182 seconds per run, and parses the local SQLite databases and JSONL caches that Cursor, Cline, and Claude Code already maintain. It reconstructs full sessions by linking user prompts, the agent’s reasoning, the MCP tool calls it issued with their arguments and results, and environmental context such as which MCP servers were connected and which packages were installed.

The Detector is where that reconstructed session gets judged, using a two-tier process described below. The Explorer runs offline, independent of live traffic. It is an evolutionary red-teaming loop that generates attack variants inside sandboxes, scores how well they evade existing detections, and feeds successful variants back into a threat repository the Detector consults later. This closes a loop that most detection systems lack: new attack patterns discovered in simulation directly update what the live system looks for, tagged as [EAS] entries alongside analyst-curated [CURATED] ones.

Two-Tier Detection: Fast Triage, Then Reasoning

Running a frontier model over every single tool call would be accurate but far too slow and expensive for 10,000 daily sessions. ADR instead splits detection into two tiers. The first tier is a lightweight LLM screen, GPT-4o in Uber’s evaluation, that checks every event for obvious red flags: prompt-injection phrasing, requests touching credentials or permission changes, role escalations, or combinations of individually benign steps that look risky together. This tier is deliberately biased toward recall rather than precision. It only short-circuits cases it is confident are benign, and pushes everything else upward. In practice it resolved 40.7% of tasks on its own, at roughly $0.017 and 2.3 seconds per task.

Escalated events reach the second tier, a reasoning agent built on Claude Sonnet 4, which investigates rather than just classifies. It can query three MCP-exposed context providers on demand: one for inspecting source code, one for consulting a threat intelligence framework, and one for checking organizational policy and flagging violations. That adaptive querying is what lets the reasoning tier catch multi-step attacks, like the Jira ticket example above, where no single action is suspicious but the full chain is.

Production Results

On ADR-Bench, an internal benchmark covering 17 attack techniques across initial access, permission abuse, control bypass, and data manipulation categories, Uber reports ADR achieving zero false positives with 67% detection, and an F1 score two to four times higher than comparison baselines including ALRPHFS, GuardAgent, and LlamaFirewall. On AgentDojo, an external benchmark, ADR detected all attacks with only 3 false alarms across 93 tasks.

In live production over ten months, ADR surfaced hundreds of high-severity credential exposures spanning 26 distinct categories where secrets had been shared outside Uber’s network, a class of incident that would otherwise rely on employees self-reporting or periodic audits catching it after the fact. A separate but related pre-prompt hook, using regex and entropy checks to block secrets before they left an agent session, achieved 97.2% precision, correctly flagging 206 of 212 unique credentials with only 6 false positives. In an internal red-team exercise, an attacker added a custom shell tool and used a deceptive prompt to coax an agent into running a curl | python3 pipeline disguised as routine sandbox testing. ADR flagged the sequence by correlating the agent’s own reasoning log, which referenced the deceptive framing, against the actual MCP telemetry of what the tool call did.

What This Means for Teams Running Agentic Coding Tools

The headline lesson is not that organizations need to rebuild Uber’s exact stack. It is that logging agent actions without logging agent reasoning leaves a detection gap that conventional EDR and SIEM tooling was never designed to fill. Correlating the “why” with the “what” is what turned an ordinary-looking curl command into a caught attack in Uber’s internal test, and it is the same correlation that would be needed to catch the Jira-based injection pattern before data leaves the network rather than after.

Teams adopting MCP-connected coding agents should treat session-level telemetry, capturing prompts, reasoning traces, and tool calls as a linked unit, as a baseline requirement rather than a nice-to-have. A tiered detection approach, cheap automated triage escalating to deeper investigation only when warranted, is also a practical way to make this affordable at scale rather than running expensive models against every event. Finally, detection should be paired with prevention where it is cheap to do so: Uber’s own credential-blocking hook shows that simple entropy and pattern checks can stop a meaningful share of leaks before any detection system needs to react to them at all. ADR’s code and benchmark are available publicly, which gives teams a concrete starting point rather than having to build threat models for agentic coding tools from scratch.