gather real-time telemetry and take real-time action in deployed agent harnesses. It also says Uber combines its own view of agent activity with output from Anthropic’s Enterprise Frontier Safeguards classifier.
The mechanism is a layered feedback path: Real-time telemetry and intervention in the agent harness, combined with safeguard-classifier signals, give the operator more context for detecting and responding to behavior outside expected bounds. Martin says Uber expects Enterprise Frontier Safeguards to feed into ADR, alongside an LLM gateway that controls AI use within Uber. Why now: As models take on more complex, autonomous work, Uber’s CISO argues that the potential harm rises and that companies need an insider-threat capability for models as they do for employees. The first implication is Teams deploying agents should treat runtime telemetry and intervention as part of the security architecture, not rely on prompts alone.
The evidence boundary matters: The source is an Anthropic-published customer interview describing Uber’s tools, architecture, and intended integration; it does not provide measured security outcomes or an independent evaluation. The first watch condition is Whether Uber feeds safeguard signals into ADR and reports how that integration changes detection or response in practice. This record starts a distinct analytical branch because no prior New Runtime record on this specific Uber program was supplied; it captures a named customer’s tooling and planned signal integration, rather than assuming an existing record or outcome.