# What is AI Detection and Response (AiDR)?

> The category of tools that watch AI agents at work, notice when one goes wrong and act on it; how it maps to EDR, the public reference work, and who builds it.

AI Detection and Response is the name for tools that watch AI agents while they work, notice when one has been hijacked or is doing something it should not, and act on it. The name borrows from endpoint detection and response (EDR) on purpose. You will also see it written AIDR, or ADR, as in Uber's "Agentic AI Detection and Response".

## Why it is a category of its own

A coding agent reads text written by strangers, holds a developer's credentials, and runs commands without waiting for anyone. Endpoint tools see the processes it starts, but not why: the prompt, the page it read, the tool call it chose. Model-level guardrails see the text, but not what was done with it. AiDR sits at the agent's tool calls, where intent and action meet.

## The same three parts as EDR

```mermaid
flowchart TD
    S["Sensor<br/>sees each tool call"] --> D["Detection<br/>rules, scores, review"]
    D --> R["Response<br/>block, hold, contain"]
    S --> E[("Record<br/>of what happened")]
    R --> E
```

- **Sensor.** Where the tool sits decides what it can see and whether it can stop anything. The options in use today are hooks inside the agent's runtime, a gateway in front of MCP servers or model APIs, a sensor on the endpoint, a reader of the agent's transcripts after the fact, and a scanner that checks what the agent loads before it runs.
- **Detection.** Rules written in advance, scores from a model (for example, how likely a tool result is to be a prompt injection), and review of whole sessions for the gap between what was asked and what was done.
- **Response.** Refuse a call, hold it for a person, tighten the session, or contain the machine. A tool that only reads transcripts afterward can alert but not block.

## Public reference work

Uber published [ADR](https://github.com/uber/ADR), an open-source agentic detection and response system, under the Apache 2.0 licence, with a paper at MLSys 2026. It reads each agent's local transcripts after the fact rather than sitting in the path. Its benchmark, ADR-Bench, is a public corpus of recorded Claude Code sessions labelled malicious or benign, so any detector, Golem's included, can be scored against the same sessions. It is a reasonable place to start when you evaluate one.

## Who builds it

Described from each company's own public pages as of October 2026; check them for current detail.

| Company | Approach |
|---|---|
| Pillar Security | Enforcement in the agent's own pre-tool hook for Claude Code, Codex CLI and Cursor, with posture scans |
| Gödel Labs | Runtime policy through hooks written into each agent's configuration |
| Neo Security | An endpoint sensor that inventories and controls agentic software |
| AIR Security | Vets the skills, MCP servers, plugins and hooks agents load, mostly before install |
| Onyx Security | AI and MCP gateways, as a control plane across SaaS, cloud, endpoints and code |
| Uber ADR | Open source; reads transcripts after the fact |

Larger security companies offer products under the same name or close to it, among them CrowdStrike (Falcon AIDR), Palo Alto Networks (Prisma AIRS) and HiddenLayer. Their scope is usually wider than coding agents.

## Questions to ask any of them

- Where does the sensor sit, and can it stop a call before it runs, or only report it?
- What happens when the tool is down: does the agent stop, or carry on unchecked?
- Who writes the record, and could the agent, its machine or the vendor change it afterward?
- Which agents and which operating systems, at what depth each?
- Does a model ever make the block decision?

## Where Golem fits

Golem (golem.team) is AI Detection and Response for coding agents, in public preview. Its answers to the questions above:

- **Sensor:** in the path, through each agent's hooks and through Golem's MCP gateway, on macOS, Linux and Windows. Below the hooks, a kernel jail around every Claude Code shell command and a VM sandbox for untrusted work, both on macOS only. See [Coverage](/coverage).
- **Down:** hooks fail open, so engineers are not stopped. A held MCP call nobody answers is blocked by default. See [When Golem is down or slow](/limits#when-golem-is-down-or-slow).
- **Record:** signed and chained on each machine by the Golem agent, not by the agent being watched, and checkable offline with a published script. See [The signed record](/record).
- **Model:** never makes the block decision. Blocks are compiled rules on the machine; models score, review sessions afterward, and decide only the holds a rule hands to Golem's reviewer agent. See [Models never make the block decision](/limits#models-never-make-the-block-decision).

What it does not do is on one page: [Limits](/limits).

## Read next

- [Golem documentation](/): how the pieces fit
- [How do I tell if a coding agent was prompt-injected?](/guides/prompt-injection)
- [How do I prove what an AI agent did?](/guides/prove-what-an-agent-did)