Large-scale agentic AI deployments expose new enterprise attack surfaces — static EDR signals miss agent reasoning, and LLM-based checks are costly to run at scale. ADR takes a systems-first approach: capture rich agent telemetry, stress-test agents with a dedicated benchmark, then apply a two-stage detection pipeline that triages at high recall and reasons contextually only on flagged sessions. In production at Uber, ADR processed thousands of agent sessions daily and localized hundreds of credential exposures with high precision, showing that an engineering-minded detection stack can scale where naive rule lists or always-on LLM inference cannot.
What Sets It Apart
- Observability-first design: collects intent, tool use, and execution traces across multiple agent clients and OSes to reconstruct multi-step prompt-injection and exfiltration chains — so detection uses richer context than file I/O or network heuristics.
- Two-tier detection pipeline: a fast, high-recall triage stage reduces volume for a more expensive context-aware reasoning stage — so you get production-grade precision without prohibitive inference cost.
- Benchmarked and production-validated: ADR-Bench (hundreds of tasks, 133 MCP servers) and internal deployments report strong trade-offs (high precision with competitive recall), and on public prompt-injection benchmarks ADR achieves near-complete detection with minimal false alarms.
- Modular, repo-scoped components: the open-source release includes the ADR Sensor, ADR-Bench fixtures, and the ADR Detector so teams can adopt observability and evaluation without shipping ADR’s offline red-teaming engine or prevention components.
Who It's For and Trade-offs
Great fit if you run or evaluate agentic AI at scale in an enterprise environment and need pragmatic detection that balances cost and precision. Security engineers, platform teams, and SREs who must trace multi-step agent reasoning or reproduce attacks for remediation will find ADR’s telemetry and benchmark assets especially useful.
Look elsewhere if your needs are limited to endpoint file/network forensics only, or if you require an integrated prevention/blocking plane (ADR’s prevention component is not included in the open-source release). Also, ADR is engineered for integrating with MCP-style model-tooling flows; it’s less relevant for single-user consumer chat apps with no agent tooling or telemetry surface.
