Uber released ADR, the system it runs in production to monitor what Cursor, Claude Code, and Codex are doing inside its codebase, free under Apache 2.0, while a comparable paid platform on AWS Marketplace starts at $10,000 a year per surface.
Every company that has handed Cursor, Claude Code, or Codex to its engineering team eventually asks a security lead the same question: what are these agents actually doing inside the codebase, and who is watching. Getting an answer is a line item now. AWS Marketplace lists SentinelOne's Prompt Security platform, the product built for exactly this, at $10,000 per 12-month contract for the tier that watches AI code assistants, and another $10,000 for the tier that watches the rest of the workforce's AI use. Those are the listed starting points before a private offer gets negotiated, and you can add a third $10,000 tier if you also want your homegrown AI apps covered. Uber just open-sourced the system it built to do that same job for itself, for free.
The repo is called ADR, short for Agentic AI Detection and Response, and it is not a weekend project. Uber runs it in production, and the paper behind it was accepted to MLSys 2026. It is Apache 2.0 licensed and has already picked up 952 stars. ADR does four things. It watches what coding agents are doing, capturing intent, tool use, and execution traces across seven-plus AI coding tools on macOS, Linux, and Windows. It stress-tests your defenses with a benchmark suite called ADR-Bench, which runs 300-plus tasks across 133 MCP servers and covers all 17 known agent attack techniques. It flags risky behavior with a two-tier detector, a fast triage pass that escalates suspicious sessions to deeper reasoning. And, according to the README, it is meant to stop unsafe actions before they happen. That last piece, the actual "response" half of "Detection and Response," is not part of this release. More on that below.
For a security or IT lead who has already rolled out AI coding tools across engineering, this closes a real gap. Handing developers Cursor or Claude Code without any visibility into what those agents are doing with repo access, secrets, and MCP-connected tools is the same problem as handing out laptops with no endpoint monitoring. Closing that gap used to mean a five- or six-figure annual contract with a vendor like Prompt Security, or one of the competitors listed right next to it on that same AWS Marketplace page (OX Security, Straiker, and Check Point's Workforce AI Security all pitch some version of the same watch-the-agents story). Now the observability and detection layer is a git clone and a uv sync away, running against your own Anthropic or OpenAI API key instead of a vendor's.
Here is the honest part. Uber held back the piece that would matter most to a CISO deciding whether this replaces a paid product outright: prevention. The README says it plainly, the component that stops unsafe agent actions before they cause harm "is not included in the current open-source release." What ships is the eyes, not the hands. ADR can catch an agent attempting something risky and raise the alert faster than a human reviewing logs would, but it will not itself intervene. Uber also kept its offline "Explorer" engine, the part that hardens the detector through pre-deployment red teaming, in-house. So this is a genuinely useful, genuinely free telemetry and detection system, not a full swap-in for a paid product that also blocks. Running it is not zero-cost either. Someone still has to stand up the Python infrastructure, feed it API keys for the dual-agent detector, and put engineering time against reproducing the benchmark setup if the goal is Uber's full picture rather than the basic sensor. Free as in license, not free as in headcount.
That gap between what got open-sourced and what got kept is the more interesting story than the tool itself. Uber is happy to give away the part of AI agent security that makes every paid vendor's pitch look a little less exclusive, watching what the agents do. The part that would actually make the product a substitute for the vendors it undercuts, stopping them, stays Uber's own.