{"type":"post","id":"uber-s-ciso-on-building-an-insider-threat-6196c2","slug":"uber-s-ciso-on-building-an-insider-threat-6196c2","title":"Uber's CISO on building an insider threat program for AI","description":"Uber’s account points to a practical thesis: **The durable security boundary for an agent is the runtime that constrains what it can read, remember, execute, and authorize, not the prompt that asks it to behave.** The article says Uber open-sourced AI Detection and Response (ADR), designed to","retrieval_nugget":"Uber’s account points to a practical thesis: **The durable security boundary for an agent is the runtime that constrains what it can read, remember, execute, and authorize, not the prompt that asks it to behave.** The article says Uber open-sourced AI Detection and Response (ADR), designed to","published_at":"2026-10-13","updated_at":"2026-10-13","record_date":"2026-10-13","date_kind":"published_at","topics":[],"source_urls":["https://claude.com/resources/articles/uber-s-ciso-on-building-an-insider-threat-program-for-ai"],"schema_version":"newruntime-agent-readable-v0.2","stable_id":"post:uber-s-ciso-on-building-an-insider-threat-6196c2","status":"published","visuals":[],"editorial_provenance":{"schema_version":"newruntime-editorial-copy-v1","content_status":"source_grounded_final","final_copy_sha256":"sha256:9ddf3e4a64c9c31ed595e71d5ef4ddc8b71be44874080cb41c75f69a69eb7f01","reviewed_at":"2026-10-13T19:00:47.516Z","source_evidence_count":1,"verified_claim_count":3,"site_analysis_schema_version":"newruntime-site-analysis-v1","site_object_kind":"field_note","observed_fact_count":3,"implication_count":2,"watch_condition_count":1,"related_record_count":0},"analysis":{"schema_version":"newruntime-site-analysis-v1","object_kind":"field_note","thesis":"The durable security boundary for an agent is the runtime that constrains what it can read, remember, execute, and authorize, not the prompt that asks it to behave.","observed_facts":[{"text":"Uber recently open-sourced AI Detection and Response (ADR), designed to gather real-time telemetry and take real-time action in agent harnesses.","source_urls":["https://claude.com/resources/articles/uber-s-ciso-on-building-an-insider-threat-program-for-ai"]},{"text":"Philip Martin says Uber combines its own monitoring view with output from Anthropic’s Enterprise Frontier Safeguards classifier.","source_urls":["https://claude.com/resources/articles/uber-s-ciso-on-building-an-insider-threat-program-for-ai"]},{"text":"Martin says Uber expects Enterprise Frontier Safeguards to feed into ADR.","source_urls":["https://claude.com/resources/articles/uber-s-ciso-on-building-an-insider-threat-program-for-ai"]}],"mechanism":"Real-time telemetry and intervention in the agent harness, combined with safeguard-classifier signals, give the operator more context for detecting and responding to behavior outside expected bounds.","why_now":"As models take on more complex, autonomous work, Uber’s CISO argues that the potential harm rises and that companies need an insider-threat capability for models as they do for employees.","implications":["Teams deploying agents should treat runtime telemetry and intervention as part of the security architecture, not rely on prompts alone.","Combining operator telemetry with safeguard signals may support faster decisions, but the source does not establish measured effectiveness."],"evidence_boundary":"The source is an Anthropic-published customer interview describing Uber’s tools, architecture, and intended integration; it does not provide measured security outcomes or an independent evaluation.","watch_conditions":["Whether Uber feeds safeguard signals into ADR and reports how that integration changes detection or response in practice."],"related_records":[],"new_branch_reason":"No prior New Runtime record on this specific Uber program was supplied; this captures its tooling and planned signal integration without assuming an existing record or outcome."},"editor":{"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]},"routes":{"html":"https://newruntime.com/posts/uber-s-ciso-on-building-an-insider-threat-6196c2/","markdown":"https://newruntime.com/posts/uber-s-ciso-on-building-an-insider-threat-6196c2.md","json":"https://newruntime.com/posts/uber-s-ciso-on-building-an-insider-threat-6196c2.json"},"next_reads":[{"type":"collection","path":"/posts/","url":"https://newruntime.com/posts/","title":"Field Notes","reason":"Open the latest editorial analysis.","media_type":"text/html","json_url":"https://newruntime.com/posts.json"},{"type":"collection","path":"/source-ledger.json","url":"https://newruntime.com/source-ledger.json","title":"Source Ledger","reason":"Inspect the public source evidence graph.","media_type":"application/json"}]}