ADR: AN AGENTIC DETECTION SYSTEMFORENTERPRISE AGENTIC AI SECURITY#

Chenning Li, Pan Hu, Justin Xu, Baris Ozbas, Olivia Liu, Caroline Van, Manxue Li, Wei Zhou, Mohammad Alizadeh, Pengyu Zhang, KK Sriramadhesikan, Ming Zhang (deployed at Uber, per the paper; affiliations not listed in the program)

• Why: AI agents speaking MCP are entering enterprises with almost no dedicated security tooling — EDR sees file writes, not prompts, reasoning, or the causal chain from intent to execution. This is one of the first production-proven detection-and-response systems for agentic AI, sitting squarely at the intersection of network security and the emerging agentic-identity problem.
• What: A three-part system: an ADR Sensor for high-fidelity agentic telemetry (prompts, reasoning, causal chains), an Explorer for pre-deployment red teaming and hard-example generation, and a two-tier Detector that combines fast triage with context-aware reasoning to keep LLM inference costs down. Deployed at Uber for 10+ months across 7,200+ hosts and 10,000+ agent sessions daily; surfaced hundreds of credential exposures (97.2% precision). Includes ADR-Bench (302 tasks, 17 techniques, 133 MCP servers), where it detects 67% of attacks with zero false positives, beating three SOTA baselines by 2–4× F1 (from abstract only).
• How: EDR-style instrumentation applied to agent sessions, plus a cost-aware two-tier detection pipeline and a systematic red-team loop for generating hard examples.
• Where applicable: Enterprise MCP deployments. The production numbers are Uber-specific, but the architecture, the benchmark, and the credential-exposure findings generalize — and the telemetry gap it names (agents invisible to host-based tooling) is universal.