ADR：面向企业 Agentic AI 的检测与响应系统
英文标题：🔥 uber/ADR
Uber 开源了 ADR（Agentic AI Detection and Response）的核心组件，用于为企业 AI Agent 提供可观测性、安全评测与威胁检测能力。该系统已在 Uber 生产环境部署，并配套发表了被 MLSys 2026 接收的论文。ADR-Bench 提供超过 300 项任务、133 个 MCP 服务器，以及对全部 17 种 Agent 攻击技术的覆盖。对开发者而言，该项目提供了 Agent 遥测采集、双 Agent 检测器、基准测试与可复现实验流程，但动作拦截能力 ADR Prevention 和离线红队引擎 ADR Explorer 尚未开源。
47.1 KB
中文
ADR：Agentic AI 检测与响应
ADR（Agentic AI Detection and Response）是一套面向 AI Agent 的企业安全系统。它帮助组织保护面向员工的 Agent，例如 Cursor、Claude Code 和 Codex，也保护面向客户的 Agent，例如 AI 客服 Agent。
ADR 已在 Uber 的生产环境中部署，配套论文已被 MLSys 2026 接收：论文 PDF · 幻灯片 PDF
ADR 如何保护企业 AI Agent
ADR 通过四项互补能力保护企业 AI Agent：观测 Agent 活动、评估防御措施、检测威胁，以及阻止不安全操作。
- ADR Observability：了解 AI Agent 正在做什么，以及为什么这么做。 在生产环境中，ADR 可在 macOS、Linux 和 Windows 上采集来自 7 种以上 AI 编程工具的 Agent 意图、工具使用情况和执行轨迹，也可采集内部自动化 Agent 和面向客户的客服 Agent 的相关信息。
- ADR Benchmark：在贴近真实企业环境的条件下测试 Agent 安全性。 ADR-Bench 包含超过 300 项任务、133 个 MCP 服务器，并覆盖全部 17 种 Agent 攻击技术。
- ADR Detection：高效检测存在风险的 Agent 行为。 其双层架构将高召回率分流与针对可疑会话的深度 Agentic 推理相结合。
- ADR Prevention：在不安全操作造成损害之前将其阻止。 该组件未包含在当前开源版本中。敬请关注。
本仓库包含论文中描述的开源 ADR Sensor、ADR-Bench 和 ADR Detector。通过部署前红队测试强化 ADR Detection 的离线 ADR Explorer 引擎不包含在此仓库中。
| 路径 | ADR 组件 | 说明 |
|---|---|---|
| Sensor/ | ADR Observability | 从 Claude Code、Cursor、Codex 等工具采集并标准化 Agent 遥测数据 |
| Detection/ | ADR Benchmark + Detection | 双 Agent 检测器、133 个 MCP 服务器、303 项基准任务、基线模型和图表脚本 |
| docs/REPRODUCIBILITY.md | 评估 | 复现基准检测结果和论文图表的分步工作流 |
快速开始：ADR Detection
git clone https://github.com/uber/ADR
cd ADR/Detection
uv sync
export ANTHROPIC_API_KEY="..." OPENAI_API_KEY="..."
默认检测器为 adr（ADR 双 Agent）。如需进行无需密钥的冒烟测试，请使用 --detector llamafirewall（参见 Detection/README.md）。
完整评估工作流请参见 docs/REPRODUCIBILITY.md（解压打包基准集 → 运行检测器 → 绘制图表）。
组件文档：
@inproceedings{li2026adr,
title={ADR: An Agentic Detection System for Enterprise Agentic AI Security},
author={Li, Chenning and Hu, Pan and Xu, Justin and Ozbas, Baris and Liu, Olivia and Van, Caroline and Li, Manxue and Zhou, Wei and Alizadeh, Mohammad and Zhang, Pengyu and Sriramadhesikan, KK and Zhang, Ming},
booktitle={Proceedings of the Ninth Conference on Machine Learning and Systems},
year={2026}
}
或者使用 CITATION.cff。
Apache License 2.0。参见 LICENSE。Detection/benchmark/agentdojo/ 是以供应商方式引入的第三方代码，适用其自身的 LICENSE（MIT）。
Detection/ 包含合成基准测试样例（伪造凭证、模拟环境、提示注入场景），仅用于防御性安全研究。详情参见：docs/OPEN_SOURCE_REVIEW.md。
English / 原文
ADR: Agentic AI Detection and Response
ADR (Agentic AI Detection and Response) is an enterprise security system for AI agents. It helps organizations secure employee-facing agents such as Cursor, Claude Code, and Codex, as well as customer-facing agents such as AI support agents.
ADR is deployed in production at Uber , and the accompanying paper was accepted to MLSys 2026 : Paper PDF · Slides PDF
How ADR secures enterprise AI agents
ADR secures enterprise AI agents through four complementary capabilities: observing agent activity, evaluating defenses, detecting threats, and preventing unsafe actions.
- ADR Observability: Understand what AI agents are doing and why. In production, ADR captures agent intent, tool use, and execution traces across 7+ AI coding tools on macOS, Linux, and Windows, as well as internal automation and customer-facing support agents.
- ADR Benchmark: Test agent security under realistic enterprise conditions. ADR-Bench includes 300+ tasks, 133 MCP servers, and coverage of all 17 agent attack techniques.
- ADR Detection: Detect risky agent behavior efficiently. Its two-tier architecture combines high-recall triage with deeper agentic reasoning for suspicious sessions.
- ADR Prevention: Stop unsafe actions before they cause harm. This component is not included in the current open-source release. Stay tuned.
This repository contains the open-source ADR Sensor , ADR-Bench , and ADR Detector described in the paper. The offline ADR Explorer engine, which hardens ADR Detection through pre-deployment red teaming, is not included here.
| Path | ADR component | Description |
|---|---|---|
| Sensor/ | ADR Observability | Collect and normalize agent telemetry from Claude Code, Cursor, Codex, and others |
| Detection/ | ADR Benchmark + Detection | Dual-agent detector, 133 MCP servers, 303 benchmark tasks, baselines, figure scripts |
| docs/REPRODUCIBILITY.md | Evaluation | Step-by-step workflow to reproduce benchmark detection and paper figures |
Quick start: ADR Detection
git clone https://github.com/uber/ADR
cd ADR/Detection
uv sync
export ANTHROPIC_API_KEY="..." OPENAI_API_KEY="..."
Default detector is adr (ADR dual-agent). For keyless smoke tests, use --detector llamafirewall (see Detection/README.md).
See docs/REPRODUCIBILITY.md for the full evaluation workflow (inflate packed benchmark → run detectors → plot figures).
Component documentation:
@inproceedings{li2026adr,
title={ADR: An Agentic Detection System for Enterprise Agentic AI Security},
author={Li, Chenning and Hu, Pan and Xu, Justin and Ozbas, Baris and Liu, Olivia and Van, Caroline and Li, Manxue and Zhou, Wei and Alizadeh, Mohammad and Zhang, Pengyu and Sriramadhesikan, KK and Zhang, Ming},
booktitle={Proceedings of the Ninth Conference on Machine Learning and Systems},
year={2026}
}
Or use CITATION.cff.
Apache License 2.0. See LICENSE. Detection/benchmark/agentdojo/ is vendored third-party code under its own LICENSE (MIT).
Detection/ includes synthetic benchmark fixtures (fake credentials, emulated environments, prompt-injection scenarios) for defensive security research only. Details: docs/OPEN_SOURCE_REVIEW.md.