Cisco open-sources Project Quarry, a detection language for AI agent behavior

Cisco open-sourced Project Quarry on October 28, describing it as a detection language built from the ground up for agent security. A security team writes a description of a multi-step attack once, checks every agent session against it, and sees the evidence behind each finding.

The problem it targets is structural. Agent intrusions tend to unfold across ordinary, permitted steps — read a page, inspect a file, call a tool, take the result, act again. Classifiers that inspect standalone messages judge one message at a time, and authorization controls allow or deny one action at a time; neither connects the whole trace.

Quarry is neurosymbolic, so a rule can draw on machine-learning classifiers and LLM judges where judgment is needed, such as whether a tool result contains a prompt injection, and on exact symbolic checks — an unsafe command, a string match, the order of two tool calls — where the condition can be stated precisely. OCR and vision models supply neural signals for images in the same way.

Coverage includes single- and multi-turn LLM conversations, agents, tool use, Model Context Protocol interactions and multimodal inputs. A rule defines what data to inspect, which signals to invoke, how to combine them, which exemptions apply, and what counts as a match.

When a policy matches, Quarry returns the steps that caused it, the field each matched in and a short excerpt, with common secret formats masked. The product receiving that finding can map it to an action such as alerting, blocking, redacting, quarantining or logging.

Cisco lists three uses: runtime guardrails that check an agent before and after every model call and tool run, post-hoc evaluation of stored traces against a rule set, and incident response that replays a newly learned pattern over old traces.

The company frames Quarry as the agent equivalent of Snort for network traffic, YARA for malware and Sigma for logs. The blog cites Hugging Face's July disclosure, in which agents spent roughly two and a half days inside production infrastructure and about 17,600 of their logged actions looked unremarkable on their own — a directory listing, a file upload, a web request — and became visible only in aggregate. It also points to a Claude Code campaign against roughly 30 organizations and prompt-injection exploits against GitHub's and Supabase's MCP servers.

Quarry is not meant to replace fine-grained authorization or content classifiers; Cisco positions it as a shared policy layer that is tested, versioned and shared the way rules are, and that maps the Cisco AI Security & Safety Framework's categories onto inspectable checks. What to watch is how fast the open repository accumulates rules and threat profiles, and whether other vendors adopt the same language.