---
type: "post"
id: "uber-s-ciso-on-building-an-insider-threat-6196c2"
slug: "uber-s-ciso-on-building-an-insider-threat-6196c2"
title: "Uber's CISO on building an insider threat program for AI"
description: "Uber’s account points to a practical thesis: **The durable security boundary for an agent is the runtime that constrains what it can read, remember, execute, and authorize, not the prompt that asks it to behave.** The article says Uber open-sourced AI Detection and Response (ADR), designed to"
retrieval_nugget: "Uber’s account points to a practical thesis: **The durable security boundary for an agent is the runtime that constrains what it can read, remember, execute, and authorize, not the prompt that asks it to behave.** The article says Uber open-sourced AI Detection and Response (ADR), designed to"
published_at: "2026-10-13"
updated_at: "2026-10-13"
record_date: "2026-10-13"
date_kind: "published_at"
topics: []
source_urls: ["https://claude.com/resources/articles/uber-s-ciso-on-building-an-insider-threat-program-for-ai"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:uber-s-ciso-on-building-an-insider-threat-6196c2"
status: "published"
visuals: []
editorial_provenance: {"schema_version":"newruntime-editorial-copy-v1","content_status":"source_grounded_final","final_copy_sha256":"sha256:9ddf3e4a64c9c31ed595e71d5ef4ddc8b71be44874080cb41c75f69a69eb7f01","reviewed_at":"2026-10-13T19:00:47.516Z","source_evidence_count":1,"verified_claim_count":3,"site_analysis_schema_version":"newruntime-site-analysis-v1","site_object_kind":"field_note","observed_fact_count":3,"implication_count":2,"watch_condition_count":1,"related_record_count":0}
analysis: {"schema_version":"newruntime-site-analysis-v1","object_kind":"field_note","thesis":"The durable security boundary for an agent is the runtime that constrains what it can read, remember, execute, and authorize, not the prompt that asks it to behave.","observed_facts":[{"text":"Uber recently open-sourced AI Detection and Response (ADR), designed to gather real-time telemetry and take real-time action in agent harnesses.","source_urls":["https://claude.com/resources/articles/uber-s-ciso-on-building-an-insider-threat-program-for-ai"]},{"text":"Philip Martin says Uber combines its own monitoring view with output from Anthropic’s Enterprise Frontier Safeguards classifier.","source_urls":["https://claude.com/resources/articles/uber-s-ciso-on-building-an-insider-threat-program-for-ai"]},{"text":"Martin says Uber expects Enterprise Frontier Safeguards to feed into ADR.","source_urls":["https://claude.com/resources/articles/uber-s-ciso-on-building-an-insider-threat-program-for-ai"]}],"mechanism":"Real-time telemetry and intervention in the agent harness, combined with safeguard-classifier signals, give the operator more context for detecting and responding to behavior outside expected bounds.","why_now":"As models take on more complex, autonomous work, Uber’s CISO argues that the potential harm rises and that companies need an insider-threat capability for models as they do for employees.","implications":["Teams deploying agents should treat runtime telemetry and intervention as part of the security architecture, not rely on prompts alone.","Combining operator telemetry with safeguard signals may support faster decisions, but the source does not establish measured effectiveness."],"evidence_boundary":"The source is an Anthropic-published customer interview describing Uber’s tools, architecture, and intended integration; it does not provide measured security outcomes or an independent evaluation.","watch_conditions":["Whether Uber feeds safeguard signals into ADR and reports how that integration changes detection or response in practice."],"related_records":[],"new_branch_reason":"No prior New Runtime record on this specific Uber program was supplied; this captures its tooling and planned signal integration without assuming an existing record or outcome."}
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/uber-s-ciso-on-building-an-insider-threat-6196c2/","markdown":"https://newruntime.com/posts/uber-s-ciso-on-building-an-insider-threat-6196c2.md","json":"https://newruntime.com/posts/uber-s-ciso-on-building-an-insider-threat-6196c2.json"}
---

# Uber's CISO on building an insider threat program for AI

## Retrieval answer

Uber’s account points to a practical thesis: **The durable security boundary for an agent is the runtime that constrains what it can read, remember, execute, and authorize, not the prompt that asks it to behave.** The article says Uber open-sourced AI Detection and Response (ADR), designed to

Uber’s account points to a practical thesis: **The durable security boundary for an agent is the runtime that constrains what it can read, remember, execute, and authorize, not the prompt that asks it to behave.** The article says Uber open-sourced AI Detection and Response (ADR), designed to gather real-time telemetry and take real-time action in deployed agent harnesses. It also says Uber combines its own view of agent activity with output from Anthropic’s Enterprise Frontier Safeguards classifier.

The mechanism is a layered feedback path: **Real-time telemetry and intervention in the agent harness, combined with safeguard-classifier signals, give the operator more context for detecting and responding to behavior outside expected bounds.** Martin says Uber expects Enterprise Frontier Safeguards to feed into ADR, alongside an LLM gateway that controls AI use within Uber. **Why now: As models take on more complex, autonomous work, Uber’s CISO argues that the potential harm rises and that companies need an insider-threat capability for models as they do for employees.** The first implication is **Teams deploying agents should treat runtime telemetry and intervention as part of the security architecture, not rely on prompts alone.**

The evidence boundary matters: **The source is an Anthropic-published customer interview describing Uber’s tools, architecture, and intended integration; it does not provide measured security outcomes or an independent evaluation.** The first watch condition is **Whether Uber feeds safeguard signals into ADR and reports how that integration changes detection or response in practice.** This record starts a distinct analytical branch because no prior New Runtime record on this specific Uber program was supplied; it captures a named customer’s tooling and planned signal integration, rather than assuming an existing record or outcome.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)