Uber’s security chief calls for insider-threat monitoring of AI agents

Uber’s chief information security officer, Philip Martin, says companies need to watch AI agents for insider threats, much as they monitor employees. In an interview published by Anthropic on October 13, 2026, he described Uber’s approach: detect activity outside an agent’s assigned bounds, intervene in real time, and keep sensitive data under company control.

The work began with a more manual process. Uber’s security team used Claude for threat modeling—examining how a service could be attacked—before Claude Code existed, assembling the necessary context by hand. With Claude Fable, Martin’s team now has Claude gather that context from code, design documents and ticket history.

Martin sees the ability to absorb more context over longer periods as a major change in security work. A model can examine what a service does, what it connects to and why it was built that way. His concern grows as models take on more complex, autonomous work: they may be directed beyond their expected constraints.

From security reviews to live intervention

Uber’s response includes AI Detection and Response, or ADR, which Martin said the company recently open-sourced. It collects real-time activity data and can act within the software environments that run Uber’s agents. The aim is to recognize when an agent strays outside its bounds and respond while the activity is happening.

Martin described combining Uber’s own monitoring with output from Anthropic’s classifier, a system that flags potentially problematic activity. Those signals can enter Uber’s wider security detection environment. A separate gateway for large language models sets a perimeter and controls how AI is used inside the company.

Enterprise Frontier Safeguards is another part of that design. Uber worked with Anthropic on the safeguards, but Martin framed their direct connection to ADR as a next step: he expects the safeguards to feed into ADR as a data source. That integration is not described as completed.

It gives us control of our data and control of the risk mitigation and the actions we decide to take after a safeguard is triggered.

Philip Martin, Uber chief information security officer, in Anthropic’s interview

Monitoring without handing over the logs

Anthropic announced Enterprise Frontier Safeguards on September 1. Its design addresses a tension behind Martin’s argument: detecting misuse across sessions requires retaining activity data, while customers need to protect confidential information. Anthropic says the safeguards allow that data to stay in customer-controlled cloud infrastructure, under the customer’s encryption keys and access policies.

Automated systems analyze a rolling window of traffic for serious misuse, including signs of stolen credentials. Flags go to the customer, whose staff can review them; Anthropic employee review is not required. Martin said Uber’s data is not accessible to Anthropic without Uber’s permission, allowing Uber to protect customer information and trade secrets.

The next controls Martin wants

Martin identified two priorities for defenders. Both focus on observing what agents actually do, then using those observations to improve the controls around them:

• Intervene closer to the action. Martin wants systems that can warn a person as they enter a prompt, or before a model calls a tool or connects somewhere it should not.
• Learn from emerging behavior. Uber examines patterns, sometimes with help from language models, and builds new safeguards into its real-time platform. Martin expects that cycle to continue because constraints themselves can produce new behaviors.

His longer-term vision goes beyond a single agent reviewing a service. He imagines each service having an agent that understands it deeply, with agents exchanging information about threats and data flows. He presented that as a possible future, not an operating system Uber has already deployed.