Inside Uber's software factory
Six platform layers, an agent registry that makes every agent action traceable to a person, and the most honest published account of what AI measurement got wrong.
Uber at a glance
The company
| Sector | "Uber's mission is to create opportunity through movement" 11 |
|---|---|
| Employees | Approximately 34,000 globally, in over 70 countries and more than 15,000 cities (Dec 31, 2025) 12 |
| Customers | 208m monthly active platform consumers, 3.867bn trips in the quarter 11 |
| Revenue | $14.191bn revenue, $58.022bn gross bookings (Q2 2026) 11 |
Employee count is the 10-K figure for Uber and its subsidiaries and is not broken out by function; no engineering headcount is disclosed in any source 12.
The engineering organisation
| Engineering size | Not disclosed. Sources say only "thousands of engineers" across large monorepos 4 |
|---|---|
| AI tooling since | August 2025 is the earliest dated first-party account of an agent in the SDLC 2 |
| Tool policy | Central platform, multiple models and harnesses; spend tiers require manager sign-off 1 |
| Agents in the SDLC | Code review, test generation, background PRs, CI self-healing, on-call triage 1,2,4 |
| Reported adoption | 7x growth in weekly active users of agentic tooling, February to August 2026 1 |
| Published metrics | Cost per session, cost per 1,000 requests, comment address rate, per-language test success rates 1,2,4 |
The 7x adoption figure is deduplicated across tools and counts all employees, engineers and non-engineers alike, not engineers only 1.
People
What they set out to solve
The stated problem is not capability but cost, and it is stated as arithmetic. Uday Kiran Medisetty, a Distinguished Engineer, decomposes spend into six multiplied terms 1:
Total spend = users × sessions/user × turns/session × requests/turn × tokens/request × price/token
The framing matters more than the formula. The first two terms are adoption, which Uber says it wants to keep growing. The middle three are described as "the work the agent does on its own behalf, on top of the request an engineer actually made", and that is the part they set out to attack 1. The pressure was real: AI-related costs had risen sixfold since 2024 9.
Three concrete failures underlay the arithmetic 1. The first was schema overhead nobody had counted: with more than 100 tools installed, pre-loading their definitions "added approximately 50K-70K tokens of schema overhead to the initial prompt, which was subsequently re-sent on every context turn." The second was that ungrounded agents burn money slowly rather than failing fast: "An ungrounded agent fails slowly rather than cheaply, repeatedly sending an expanding context window to search one more location," a failure mode serious enough to motivate the context graph described below. The third was that third-party tools proved worse than internal ones: "Managing third-party software proved significantly more challenging than our internal servers. Vendors design MCP servers to expose full product capabilities because they can't anticipate specific customer usage." Individual SaaS servers arrived carrying 34 to 49 tools each.
A second problem is identity. Existing models "don't capture agent delegation relationships", and "execution context (originating user, intermediate agents) is dropped across agent hops" 3. An agent calling an agent calling a service left nobody accountable at the end of the chain.
The third is toil. Anshu Chada, a Director of Engineering on the Dev Platform, frames the payoff as satisfaction before speed: "when we push some of the boring stuff to AI...not only does it result in much higher satisfaction from our engineers, but they're able to push our product" 9. The Minion platform is described as targeting exactly that, "the boring work that steals engineering focus", rather than novel work 8.
For code review, the stated goal was trust rather than throughput. uReview is built as an augmenting second reviewer, not a gatekeeper, and tuned so engineers keep believing it 2.
Maturity level
Assigned by testing published facts against fixed criteria, and capped by what the sources state.
How Uber's software factory works
Uber describes six connected layers 6.
A Model Gateway serves more than 800 internal projects and over 100 million model requests a day 6. Model selection runs against an internal benchmark, the Uber SWE Benchmark, which tests frontier and open-weight models across task types, and the selection criterion is stated as Pareto efficiency across "cost/completed task, output quality, and model reliability" 1.
An MCP Gateway is the single entry point to more than 1,000 MCP servers, internal and third-party SaaS alike, "enabling centralized authentication and policy enforcement" 1. It is also the policy enforcement point for agent identity, performing "tool access checks and redaction of sensitive data" against an internal risk classification before proxying a call onward 3.
DevPods give agents pre-provisioned environments rather than a cold checkout 6, the layer Nikhil Ramakrishnan describes as years of prior investment in remote environments, CI, and developer tooling finally paying off for something other than humans 8.
A skills marketplace holds more than 3,600 skills running over 30,000 executions a day 1. Five weeks earlier the same marketplace was described as 2,500 skills at 20,000+ daily executions 6, so the growth rate is roughly visible even though neither source defines what one skill execution counts as.
The AI Context Graph unifies 24 million nodes and 80 million edges drawn from more than 30 internal systems 1. It exists to stop the slow-failure mode: grounded, an agent answered in 38 seconds where the ungrounded run took 20 minutes 9 seconds and got it wrong 1.
Cortana, a company-wide assistant, is available in Slack, CLI, and web, and runs more than 20,000 sessions a day 6.
Identity binds the layers together. An Agent Registry links every AI agent to its Kubernetes workload, agents fetch cryptographically signed SPIRE workload credentials, and a Security Token Service mints "short-lived, scoped tokens for every hop", each carrying an actor chain and an audience claim valid only for that destination 3. P99 latency on that token exchange stays under 40 milliseconds, with most values below 10 3. The practical effect is that a multi-hop agent-to-agent delegation still resolves to a responsible human in the logs.
What runs without a human starting it
This is the sentence that places Uber, and it is first-party 1:
As we progress on that vision, a growing share of sessions aren't initiated by humans, but by automated managed agents handling code review, self-healing CI failures, completing E2E PRs with visual validation, triaging on-call alerts, debugging incoming bugs, and handling a variety of code maintenance tasks with human reviews/escalations.
Three of those are separately documented.
Review. uReview covers roughly 90% of about 65,000 diffs a week across six monorepos, in Go, Java, Android, iOS, TypeScript, and Python 2. It runs a four-stage pipeline: specialised comment generators, then confidence scoring, semantic deduplication and category classification, then inline delivery, then developer ratings feeding back into evaluation 2. Median analysis latency in CI is four minutes 2. It does not block a merge.
Tests. AutoCover generates about 11% of all new tests reviewed and added to the codebase 4. It is a LangGraph pipeline with sub-graphs for preparation, generation, execution, and validation and repair, offered in three modes: CLI for scripting, Headless for sharded backfills that open merge requests on their own, and IDE for human-in-the-loop work 4. Success rates are published per language and are not flattering by design: about 20% for Java, 40% for Go, and 80% for Python 4.
Background PRs. Minion takes a prompt from web, Slack, or command line and opens pull requests on its own 9. Its share of merged pull requests is one of two conflicting figures for agent involvement in PRs, examined below 8.
Operating the software factory: teams, roles, and skills
Spend governance is where the operating model is most explicit, and it works through visibility and friction rather than hard limits 1. A live cost counter sits in the harness status line, tracking spend per harness and across all harnesses for each user, and Slack notifications fire at 50, 80, and 100% of expected spend, a design stated as giving "engineers time to plan" rather than cutting them off outright. One shared tier covers all interactive harnesses, deliberately not split into per-tool budgets, with separate tiers reserved for managed agents, and moving to a higher tier needs manager sign-off, though the approval flow itself is described as quick.
Defaults do the rest of the work: automatic compaction triggers at 400,000 tokens even on million-token context windows, and reasoning effort defaults to Medium 1. A session analysis dashboard classifies runtime behaviour into 16 anti-pattern categories 1.
The agent surface reaches past engineering. uSpec wires Claude through an IDE to Figma over MCP to produce anatomy, API, accessibility, and token documentation for the Base design system, generating full screen-reader specifications in under two minutes and serving thousands of engineers across seven implementation stacks 10. The whole pipeline runs locally so proprietary design data never leaves the network 10.
Implementation journey
The public record runs roughly in this order.
- Before agentsRamakrishnan's framing is that remote environments, CI, and developer tooling were built first, and background agents became possible because that groundwork already existed 8.
- August 2025uReview publishes, the earliest dated account of an agent operating continuously in the SDLC 2.
- March 2026An external inside look names Minion, Shepherd, uReview, Code Inbox, AutoCover, the MCP Gateway, Uber Agent Builder, AIFX CLI, and Agent Studio, and reports 84% of developers using agentic coding tools, 92% using agents monthly, and 65-72% of code in IDE-based tools AI-generated. Claude Code usage nearly doubles from 32% in December to 63% in February 9.
- April 2026
- May 2026
- June to August 2026
Measuring the software factory
Uber is the only company in this corpus to publish a peer-reviewed threats-to-validity section about its own tooling. AutoCover's authors state plainly that "coverage ≠ effectiveness", that code coverage is an imperfect proxy mitigated with scenario coverage and mutation testing, and that a target-selection bias is possible because "developers may have targeted particularly hard-to-test legacy code" 4. They also state a deliberate trade: they favour external and ecological validity over internal validity, because tight experimental control and real deployment are at odds 4.
The measurement story on productivity is more interesting for what was thrown away. Abhishek Tibrewal describes a difference-in-differences design built around an explicit counterfactual, "if there was no Copilot, what would have the same developer shipped?" 7. It produced a 19% lift among power users, an 8% cohort, with gains distributed unevenly by seniority and largest for junior-to-mid engineers 7. The speakers are careful that correlation among power users needed causal validation, since productive engineers may simply adopt tools first 7.
Then they dropped a metric on purpose. "Developer years saved" was abandoned for three stated reasons: it created anxiety about replaceability despite leadership's hiring intent, its baseline needed constant recalibration as tools changed, and business leaders wanted revenue and feature impact rather than a time-savings abstraction 7.
Cost is measured tightly. Cost per 1,000 requests fell 34% between February and July with the model held constant, and cost per session fell 52% from June to the August peak 1. Restructuring tool access into code mode cut tokens 50-71% on typical queries and close to 100% on a wide-table SQL query 1.
Three published figures carry caveats worth stating alongside them. uReview's "~1,500 hours weekly, about 39 developer-years annually" was published a year before Uber abandoned hours-saved framing internally, and its calculation's method is never disclosed 2,7. "Lines of code per engineer doubled year over year" rests on a proxy widely criticised elsewhere, and no source addresses whether agent-generated boilerplate inflates it 6. The third figure, the agent share of pull requests, is the entry's sharpest definitional problem, treated in full below.
The 11% and the 70% are not the same measurement
Both figures are first-party, both are recent, and they differ by a factor of six. They also count different things.
- 11% of PRs opened by agents, March 2026, counting pull requests an agent opened 9.
- 11% of merged PRs, May 2026, counting merged pull requests generated through Minion specifically 8.
- More than 70% of PRs, June 2026, counting pull requests that "involve local or cloud agents" 6.
- More than 70% attributed to agents, August 2026, stated as a share of all PRs with no definition given 1.
The reconciliation the sources support is that the low figure counts PRs a background agent authored end to end, and the high figure counts any PR an agent touched, including one an engineer drove from their own IDE. No source states that reconciliation, and no source defines what counts as agent involvement once a human edits the output. Present both with their dates and denominators, or neither.
Lessons learned
Grounding is a cost control, not just a quality one. An agent without shared context does not fail cheaply; it fails slowly, burning tokens on an ever-expanding search that the context graph exists specifically to short-circuit 1.
Vendor MCP servers are a scaling problem. Internal servers were easier to manage than third-party ones, because vendors design their servers to expose full product surfaces they cannot scope to one customer's usage 1.
Sometimes the answer is not AI. The largest migration in the record went deterministic. On migrating 75,000 test classes and 1.25 million lines from JUnit 4 to JUnit 5 in four months via 5,000+ automated diffs, the team states that "AI usage was limited to debugging test and build failures. Given our codebase's scale and custom testing patterns, a deterministic approach proved more practical than an AI-driven migration" 5. Shepherd orchestrated OpenRewrite transformations across thousands of Bazel targets in parallel and validated each through CI 5.
An advisory reviewer keeps its audience. uReview's own post lists where it is weak: it cannot see past PRs, feature flags, schemas, or documentation, it is "better at catching bugs than assessing system design", and it struggles with readability comments engineers routinely reject 2. 75% of its comments are rated useful and 65% are addressed in the same changeset 2.
A measurement can be right and still worth deleting. The developer-years metric was dropped for its effect on engineers and its instability, not because it was wrong 7.
What's next for Uber's software factory
Uber states a direction rather than a roadmap: the shift toward agent-initiated sessions described above continues, with humans moving from initiators of work to reviewers and escalation points 1. On generalisability they are explicit that their numbers are theirs: "specific cost reductions we measure are unique to our environment and your mileage may vary depending on your codebase, team size, and agent workflows", with only the benchmarking methodology offered as portable 1.
The AutoCover authors name their own next steps from user feedback: tighter coverage-tool integration able to target only new or changed lines, and the ability to interject mid-generation to steer an agent that is close but not correct 4.
