Uber Secure AI guards agents with intent limits

Uber's post frames agentic AI as a shift in the attack surface: instead of executing predefined logic, agents reason over content from users, webpages, documents, tools, and other agents, and can turn that reasoning into real-world actions. That moves part of the security problem from identity and API controls into what Uber calls the semantic layer, creating risks such as prompt injection, tool and memory poisoning, goal hijacking, behavioral drift, and hallucination-driven actions. Uber says traditional authorization can determine who is allowed to act, but cannot determine whether an action is consistent with what the user requested and the agent's defined purpose and session context.

The framework is built on an AI Registry that records an agent's identity, ownership, persona, permitted intents, constraints, dependencies, and risk tier, with an automated platform called Argus analyzing source code, prompts, and tool-invocation paths to derive structured intents. Uber says it evaluated commercial AI security and guardrail platforms and traditional policy engines, but none fully addressed the threat model it was targeting. The company also describes practical tradeoffs: stronger enforcement can increase false blocks, runtime evaluation adds latency and inference costs, and onboarding complexity can push teams to bypass controls.

Uber positions the work as an engineering problem as much as a security one, with controls embedded at common infrastructure points so agents inherit protections as they are created and deployed. It says the next phase will expand defenses against indirect prompt injection and further automate agent discovery and red teaming, and that the post is the first in a series on individual controls.