Uber's security team described "Agentic Detection and Response" (ADR)

Uber’s security team runs a system called Agentic Detection and Response that logs every step when an employee uses a coding agent like Cursor, Claude Code, or Codex. It captures the prompt, the reasoning chain, the tool calls, and the final outcome. The company reports 50,000 agent sessions a day across thousands of endpoints, according to a post from Uber’s head of product security.

This is a single data point, and we can’t verify engagement or corroboration yet. But the scale is striking. Most companies are still figuring out whether to allow coding agents at all. Uber is already treating them as infrastructure that needs the same observability and governance as any other production system.

The practical question is what you do with that telemetry. If an agent hallucinates a credential, calls an API it shouldn’t, or generates code that violates policy, you need to see it before it ships or leaks. ADR gives Uber that visibility. It also means they can audit what agents actually do versus what employees think they do, which matters for compliance, IP protection, and incident response.

For companies running agents at any scale, the lesson is straightforward. You can’t govern what you can’t see. If your team is using Cursor or Claude to write code, you need a way to log the full chain, not just the final diff. That’s the kind of observability we build into an AI command centre, so you can track agent behaviour across tools without stitching together five different logs.

Uber’s approach won’t be the only model, but it’s a concrete example of what enterprise agent governance looks like when you’re past the pilot phase. If you’re planning to scale coding agents beyond a handful of users, start thinking about telemetry now. Retrofitting it later is harder than building it in from the start.