Uber's CTO Just Admitted Your "Human in the Loop" Is a Rubber Stamp
Justin
· 6 min read
Praveen Neppalli Naga runs engineering at a company where AI agents execute 50,000+ sessions every single day. On Friday he posted the sentence CTOs are trained never to post in public: securing those agents "keeps me up at night."
Not because Uber is behind. Because Uber is ahead, and from up front you can see the cliff.
Here's the line that should stop every compliance lead mid-scroll: "When users approve 50+ actions per session, human oversight becomes a rubber stamp."
Read that again. That's the CTO of Uber saying, with production data behind him, that the control your entire AI governance program leans on... doesn't hold at scale.
The control everyone's auditor loves
Open any AI governance framework and find the same load-bearing wall.
The EU AI Act's Article 14 requires that high-risk AI systems can be effectively overseen by natural persons. It even names the failure mode: Article 14(4)(b) demands that overseers stay aware of "automation bias," the tendency to over-rely on the machine's output. The regulators saw the rubber stamp coming. ISO/IEC 42001 expects documented human involvement in AI decisions, and half the vendor security questionnaires in your inbox ask some version of "does a human review agent actions before execution?"
And you check the box. Because technically, yes: a human sits there clicking Approve. Fifty times a session. Uber just published what everyone running agents at scale privately knows: past a certain volume, that human isn't reviewing anything. They're a metronome with a mouse.
Your auditor calls it a control. Uber's data calls it theater.
What Uber actually saw
Some context on why this admission carries weight. Agents at Uber aren't a pilot program in a sandbox. Employees across the company, not just engineering, use agents that read code, run commands, call internal tools, and act on real systems... through Claude Code, Cursor, Codex, and everything in between.
That scale forced a question most companies haven't hit yet: how do you secure agents your security tools can't see?
Because they can't. Traditional Endpoint Detection & Response sees the file write, but not the prompt that triggered it. It sees the network call, but not the agent's reasoning. The intent, the thing separating malicious from benign, is invisible to every EDR product on the market.
So Uber built its own layer: Agentic Detection and Response, or ADR. It captures the full causal chain, prompt to reasoning to tool call to outcome. Ten months in production. 7,200+ hosts.
And on Friday, after joining the Open Secure AI Alliance, Uber open-sourced it. The sensor, the detection framework, and ADR-Bench: a benchmark of 302 tasks built from real production telemetry, covering 17 attack techniques. Apache 2.0. Free on GitHub.
The three lessons that should rewrite your risk register
The code is nice. The production lessons are the treasure. Three of them, each one landing on a different line of your compliance program.
1. The workflow is the unit of security, not the tool call. Attacks hide in causally-linked chains where every individual step looks benign. Your logging strategy probably captures tool calls. Uber says that's the wrong altitude. If you can't reconstruct the chain, you can't detect the attack, and you can't produce audit evidence of what your agent actually did.
2. Credential leakage beats prompt injection. It's not close. Everyone's threat model is obsessed with prompt injection. Meanwhile Uber's system caught hundreds of credential exposures across 26 categories: keys and secrets casually wandering outside the enterprise network inside agent sessions. The exotic attack gets the conference talks. The boring leak gets your data.
3. Approval fatigue breaks human oversight. The rubber stamp problem. If your Article 14 story, your ISO 42001 control, or your SOC 2 narrative depends on "a human approves each action," you now have public, peer-reviewed evidence (the ADR paper was presented at MLSys 2026) that this control degrades exactly when you need it most.
Where this hits your framework
Uber's finding | The control it breaks | What to do instead |
|---|---|---|
50+ approvals per session turn into a rubber stamp | EU AI Act Art. 14 human oversight; ISO 42001 human-involvement controls | Risk-tier approvals: auto-allow low-risk actions, force friction only on high-risk ones. Fewer, real approvals beat many fake ones |
Credential leakage in production, 26 categories | Secrets management and data-leakage controls (SOC 2, ISO 27001 crossover) | Scan agent sessions for secrets, not just repos. Treat agent telemetry as a DLP surface |
Attacks hide in benign-looking chains | Logging and audit-evidence requirements | Log the causal chain (prompt, reasoning, action, outcome), not isolated events |
EDR can't see agent intent | "We have endpoint security" as an answer on questionnaires | Add an agent-observability layer. ADR is now a free starting point |
The startup version and the enterprise version
If you're a startup: you don't need Uber's stack. You need to stop writing "human reviews all agent actions" in security questionnaires if your engineers approve 50 things before coffee. Say what's true: which actions auto-run, which get gated, and what gets logged. A narrow, honest control survives an audit. A broad, fictional one doesn't. We built the honest version of that program in our Claude compliance checklist.
If you're an enterprise: ADR-Bench matters more than ADR itself. It's the first benchmark built from real enterprise agent telemetry, which means you can finally test whatever agent-security vendor is pitching you against something that isn't marketing. In Uber's own evaluation, ADR caught 67% of attacks with zero false alarms while three well-known baselines produced up to 40 false positives. Forty false positives means forty pointless incident-response fire drills. Ask your vendor for their ADR-Bench numbers and watch their face.
We track the tools playing in this space, from guardrails to agent observability, in our directory. Expect this category to get crowded fast now that the benchmark exists.
The question nobody has answered yet
Uber solved observability. It didn't solve the regulatory paradox it exposed.
If human oversight becomes a rubber stamp at scale, and regulators require human oversight, then every company running agents at scale is either slowing agents down to keep oversight real... or keeping a fiction alive to stay compliant. Uber picked a third door: make the machine watch the machine, and save humans for the moments that matter.
Whether regulators accept that answer is the fight to watch. The Open Secure AI Alliance just became the room where it happens, and Uber walked in carrying receipts.
Your move this week: pull one day of your agent logs and count approvals per session. If the number makes you wince, you already know which side of this story you're on.
Sources: Praveen Neppalli Naga (LinkedIn/X, August 1, 2026); uber/ADR on GitHub; "ADR: An Agentic Detection System for Enterprise Agentic AI Security," arXiv:2605.17380, MLSys 2026.