AIDR Field Guide | RuntimeSec

What is AI Detection & Response?

AIDR is to AI agents what EDR is to laptops: continuous visibility into what they do, the power to stop a harmful action, and the evidence to investigate afterwards.

A coding agent is a new kind of actor on a developer machine. It reads files, runs shell commands, calls tools on MCP servers and fetches pages from the web, all with the developer’s own credentials and at machine speed.

Existing controls weren’t built for that. Endpoint security sees a shell command, but not the conversation that led to it. Code review sees the diff, but not the .env file the agent read along the way. And because an agent takes direction from text, a harmless-looking web page can turn into an instruction.

AI Detection & Response closes the gap by watching agents where their decisions turn into actions: the tool call. It has three jobs.

Detect

Review each session for risky behavior and name the technique behind it.

Respond

Stop a forbidden tool call before it runs, and alert the people who need to know.

Investigate

Give analysts the transcript, the evidence and a place to record the verdict.

How agents get attacked

AIDR classifies every finding with the ADR threat framework: 5 tactics and 17 techniques, from Uber’s open-source Agentic AI Detection and Response project. The technique ID is on every alert.

Initial compromise 6 techniques

Getting a foothold: making the agent act for the attacker.

ADR.T0001: Insecure supply chain for agentic componentsA compromised dependency, plugin or model file that the agent relies on.
ADR.T0002: Indirect prompt injectionInstructions hidden in data the agent reads: a web page, an issue, a file.
ADR.T0003: Agentic control-flow hijackingChaining tool calls that are harmless one by one into a harmful workflow.
ADR.T0004: Abuse of the agent’s code interpreterGetting the agent to run malicious code through its own execution tool.
ADR.T0005: Insecure output handlingOutput that harms a downstream system that trusts it, such as injected script.
ADR.T0006: Tool rug pullA tool that passed review, then quietly changed what it does in an update.

Permission abuse 2 techniques

Using more access than the task needs.

ADR.T0007: Exploitation of excessive tool permissionsA tool with broader access than it needs, turned against the systems behind it.
ADR.T0008: Agent identity spoofingStolen or forged agent credentials, used to inherit the agent’s permissions.

Security control bypass 3 techniques

Slipping past the checks that should catch it.

ADR.T0009: Tool shadowingA malicious MCP server defining a tool with the same name as a trusted one.
ADR.T0010: Tool hallucination manipulationConvincing the agent that a tool which doesn’t exist is real.
ADR.T0011: Malicious agent collusionAgents that look harmless alone, coordinating to get around controls.

Reasoning and data manipulation 4 techniques

Corrupting what the agent believes, or what it connects to.

ADR.T0012: Unvetted MCP server connectionAn agent connecting to an MCP server nobody reviewed.
ADR.T0013: Semantic data poisoningSubtly corrupted sources that skew the agent’s decisions over time.
ADR.T0014: Long-term goal hijackingSlowly steering an agent’s memory or goals across many interactions.
ADR.T0015: Temporal data attackManipulating the timing or order of tool results rather than their content.

Operational impact 2 techniques

Disrupting systems and budgets.

ADR.T0016: Agent-facilitated resource exhaustionUsing the agent to flood internal systems with work.
ADR.T0017: Model-layer denial of servicePrompts built to make the model burn a disproportionate amount of compute.

What AIDR catches on every session

Built-in rules are deterministic, cost nothing to run and finish in under 5 ms, so they check every session. Your own policy rules run alongside them.

Destructive commands

Commands that delete, overwrite or open up far more than a task should.

rm -rf /
DROP TABLE
git push --force
kubectl delete
chmod -R 777
>> /etc/sudoers

Secret access

Reads of files that hold credentials.

.env
~/.ssh/id_rsa
.aws/credentials
secrets.yaml

Piped installers

Remote scripts fed straight into a shell, unread.

curl … | sh
wget … | bash

Exfiltration

Uploads, and traffic to places that exist to receive data.

pastebin.com
webhook.site
requestbin
ngrok.io
curl --data

Prompt injection

Text that tries to overrule the agent’s instructions.

ignore previous instructions
bypass the guardrails
system prompt:

Unregistered MCP servers

Tool calls to an MCP server that isn’t in your registry, mapped to ADR.T0012.

mcp__unknown-server__*

Glossary

The words you’ll meet in the AIDR console, and what each one means.

Endpoint: A developer machine running aidr-agent.
Session: One conversation between a developer and an agent, as a transcript.
Tool call: One action inside a session: a command, a file read or edit, an MCP tool.
Policy rule: A matcher on tool, arguments, path and project, with an effect such as deny or alert.
Live decision: A tool call your policy denied or flagged for logging, recorded as it happened. Routine allows aren’t stored.
Detection: One tier’s verdict on a session: rules, triage or reasoning.
Alert: A finding for an analyst, with severity, priority and evidence.
Case: Related alerts grouped together, with notes and a closing verdict.
Severity and priority: Critical to info, derived from confidence, tactic and asset; priority P0–P3 sets the response target.
Verdict: An analyst’s label: true positive, false positive, benign or inconclusive.
Drift: A change to an agent’s setup on a machine, such as a new MCP server or hook.
Enrollment token: The one-time token that binds a machine to your tenant.

Get started

Enroll one machine, add one deny rule, and watch the next matching call get refused.

Install

Two commands per machine, then every tool call asks your policy first.

Read the install

Console

Rules, live decisions, alerts and cases for your tenant.

Sign in

Demo

Bring the actions that worry you; we’ll show the policy that stops them.

Book a demo

The AIDR field guide. Agent security in plain words.