Cisco has announced the open-source release of Project Quarry, a tool designed to spot attacks carried out by AI agents. Its principle relies less on detecting isolated actions than on analyzing how a series of actions, seemingly innocuous, can reveal a malicious intent.
Traditional security systems typically assess each action separately to determine if it is dangerous or benign. This approach reaches its limits with AI agents, i.e., programs capable of chaining multiple actions autonomously, when the malicious intent only emerges over the course of a sequence. Cisco gives the example of bank fraud: a bank analyzes each purchase in isolation, whereas fraud detection must spot patterns spread across multiple purchases, sometimes in different locations and at improbable times. ‘Agent security needs the same combination of pattern detection and evidence, applied to the steps taken by an agent rather than purchases,’ the company writes.
Rules that combine learning and logic
Cisco describes Quarry as a ‘neurosymbolic’ rule language, meaning it combines the judgment of machine learning models with rule-based checks. It covers conversations with large language models (LLMs), whether single-turn or multi-turn, as well as agents, tool usage, exchanges via the Model Context Protocol (MCP), a standard that connects models to external tools, and multimodal inputs.
Each rule relies on two types of elements. On one hand, evidence from machine learning classifiers and LLM ‘judges’; on the other hand, symbolic rules that check specific conditions, sequences, string matches, or relationships between tools. Quarry is designed as a common policy layer, not as a replacement for all existing detectors or control mechanisms.
The tool can be used to implement real-time safeguards on agents, to conduct post-hoc security analyses based on rule sets, as well as for incident response. It integrates into Cisco’s existing framework, the Integrated AI Security & Safety Framework, extending it from describing AI-related risks to detecting them in agent activity.
An already observed threat
Cisco recalls that in 2025, Claude Code was used by malicious actors in two campaigns: one targeting around 30 organizations, the other targeting Mexican government institutions. In the first case, the attack had been broken down into routine tasks, which led the defense system to believe it was a security test. Viewed piecemeal, it resembled an authorized penetration test; its true objective, data theft, only became apparent when the requests were pieced together in the correct order.
Cisco emphasizes that attackers constantly modify their methods. Each new technique identified should therefore lead to a new Quarry rule, usable by all organizations. To meet this requirement, the company has provided a plugin allowing a programming agent to draft, compile, and refine rules from a plain-language description of an organization’s risk, and then test them on real conversations.
The starter package notably includes a readable language for conversations, tool usage, and event relationships, a command-line scanner, a Python SDK, as well as the plugin for Claude Code, Codex, and other MCP-compatible agents. Cisco also cites an example: ‘Hugging Face reconstructed approximately 17,600 agent actions after the fact.’ The stated goal is to enable defenders to ‘recognize these sequences while they are still in progress.’
