As our CFO @_balaji_km mentioned at earnings today, we’re seeing some very interesting trends on AI costs. I think it’s another signal that we’re coming to the end of the so-called ‘tokenmaxxing’ era. Here’s what’s been happening behind the scenes. Since the beginning of the year we’ve more than quadrupled the number of people using frontier AI tools. That’s thousands of engineers using them every single day. During that same period, our cost per token has declined. You might expect costs to rise as adoption accelerates. We've seen the opposite. Not because we've restricted access, but because we've treated efficiency as an engineering problem rather than a budget problem. A few examples: • Caching and reuse: We use optimizations to improve our prompt cache hit rate that reduce our input token spend. • Better defaults and tooling: We tuned default model settings, context sizes and developer workflows so teams get the same results with fewer tokens and lower-cost inference. • Visibility drives efficiency: We gave engineers real-time visibility into their AI usage and costs per hour. • Experimenting with open-weight models: we continuously evaluate new models and deploy the best option for each use case. This is the future of applied AI at enterprise scale. The next phase, whatever we call it, will not be characterized by who spends the most tokens, but about how people use them as efficiently as possible. Credit to all the engineers at @Uber who are helping to build this future. 🚀

AI agents are everywhere at @Uber. It’s great to see, but the thing that keeps me up at night is how we are going to secure them. This is something that I have been thinking about for a while. Today, our agents run 50,000+ sessions per day across thousands of endpoints. And this isn't just engineering anymore. Employees across the company use agents that read code, run commands, call internal tools, analyze data, and act on real systems. That scale forced us to confront an important question: How do you secure agents when your security tools can't even see them? Traditional Endpoint Detection & Response (EDR) sees the file write, but not the prompt that triggered it. It sees the network call, but not the agent's reasoning. The intent, the thing that separates malicious from benign, is invisible. So we built Agentic Detection and Response (ADR): • Capture the full causal chain: prompt → reasoning → tool call → outcome, across Cursor, Claude Code, Codex, and every agent our employees use. • Triage cheaply: a fast, high-recall first pass handles the flood of benign sessions. • Reason deeply: only suspicious events get expensive LLM analysis, enriched with source code, threat intel, and policy context. • Red-team continuously: an offline explorer evolves hard attack variants before attackers find them. After 10+ months in production, the results speak for themselves: • Hundreds of credential exposures detected across 26 categories. • Shift-left prevention blocking secrets at 97.2% precision, before they ever leave the laptop. • Zero false positives on our enterprise benchmark, with 2-4x the F1 score of state-of-the-art baselines. • Every attack detected on AgentDojo, the public prompt injection benchmark. Just as valuable as the detections are the lessons from running this in production: • The workflow is the unit of security, not the individual tool call. Attacks hide in causally-linked chains that look benign step by step. • Credential leakage is a far more common operational issue than prompt injection. • Approval fatigue is real: when users approve 50+ actions per session, human oversight becomes a rubber stamp. You can't secure agents you can't observe. And nobody can solve this alone. That is why we recently joined the Open Secure AI Alliance (OSA), and why today we're taking the next step: open-sourcing ADR. The release includes the ADR Sensor, the detection framework, and ADR-Bench, the first enterprise agentic AI security benchmark: 302 tasks derived from real production telemetry and full coverage of all 17 attack techniques across 5 tactics, so the community can rigorously evaluate their own defenses. Code: github.com/uber/ADR Paper: arxiv.org/pdf/2605.17380v1 The future of AI security won't be built behind closed doors. Excited to see what the community builds on it, and what we all learn together! @UberEng

At @Uber, we support a strong American AI ecosystem across both frontier and open-weight models. We see them as complementary: the opportunity is to use the right model for each task, balancing capability, customization, cost, and control.

Agentic AI adoption is on fire at @Uber, and it's changing the way we build, not just in engineering, but across the entire company. Today, 99% of our engineers use AI tools. More than 70% of pull requests are attributed to local or cloud agents. And our engineers have built 2,500+ agent skills across the software development lifecycle. Those numbers are exciting, but they led us to a much bigger question: How do we bring agentic AI beyond engineering? Finance. Legal. Operations. Marketing. Customer Support. HR. Procurement. These functions run on complex workflows that are often manual, highly nuanced, and spread across dozens of systems. You can't automate them effectively by looking at process diagrams or documentation. You have to understand how the work actually gets done. So we created something called Agentic Pods. The idea is simple. We handpicked ~30 of our most AI-proficient engineers (people with deep knowledge of Uber's systems) and paired each of them with a domain expert from a business function. Then we gave every pod just two weeks. • Days 1 – 2: Shadow the expert. Observe every step. Document workflows. Ask questions. Build intuition. • Day 3: Prioritize opportunities based on scale, repetition, business impact, and data availability. • Days 4 – 5: Build a working agent alongside the person doing the job. • Days 6 – 9: Validate with several others performing the same work. Does it generalize? Does it actually make their job better? • Day 10: Ship. In just the past two months, we've run 16 Agentic Pods across 16 different business functions. • Capital allocation across 150 cities: 15 hours → 30 minutes. • Financial pacing reports: 2 days → 10 minutes. • Marketing web quality assurance: 2 weeks → 50 minutes. • Support workflow creation: 9,000 manual workflows → self-service automation. The productivity gains are impressive, but what surprised us most wasn't the speed. • It was how quickly engineers embedded in unfamiliar domains uncovered opportunities that had been hiding in plain sight. • The biggest wins rarely come from automating one task. They come from rethinking an entire workflow. Once you redesign the workflow around AI, you often eliminate handoffs, remove unnecessary approvals, replace legacy tooling, reduce vendor spend, and dramatically accelerate decision-making. • The workflow becomes the unit of automation - not the individual task. • The most impactful agent skills cut across teams, orgs, functions, tools, and systems. The biggest lesson? The best AI opportunities are rarely visible from the outside. You discover them by sitting next to the people doing the work, understanding every friction point, and building with them, not for them. We're now forming a dedicated team to scale this further and go deeper. They'll deeply understand the work, redesign it from the ground up, and use AI to fundamentally change how the business operates. It's exciting times!

Agentic software engineering adoption is on fire at @Uber. 1,800 code changes per week are now written entirely by Uber's internal background coding agent, and 95% of our engineers now use AI every month across all the tools we track. This is a real reset moment for engineering; it's one of the most exciting times to lead. This shift requires builders to be curious and hands-on. I’m incredibly lucky to be surrounded by a team that’s doing exactly that. The best part is that the strongest adoption isn’t being pushed top down from leadership announcements; it’s coming from engineers who are quietly experimenting, quietly shipping, and quietly pushing things forward. I love spending time with those engineers because there’s no substitute for being close to the work. Over the last few months, we leaned in hard, and the results have been phenomenal. The bigger shift: going agentic. 84% of AI users are now working with agent-style workflows, not just tab completion. Claude Code usage nearly doubled in 2 months (32% → 63%), while IDE-based tools have largely plateaued. Engineers are moving from accepting suggestions to delegating tasks. Even within traditional IDEs, ~70% of committed code is now AI-generated. Background agents are writing code autonomously. Our internal background coding agent went from <1% of all code changes to 8% in just a few months. There is zero human authoring. Engineers review and approve, but the code is written entirely by AI agents. The role of the engineer is shifting - from writing every line to architecting systems and reviewing AI-generated code. More to come from the @UberEng team in the coming days.