Cisco Open Sources Quarry to Catch AI Agent Attacks Hidden in Harmless

Cisco has released Project Quarry as an open-source neurosymbolic rule language to detect artificial intelligence agent attacks that unfold across sequences of individually benign operations. Traditional controls evaluate single actions in isolation, but agentic attacks distribute malicious intent across steps that appear legitimate on their own. According to SecurityWeek's report, Cisco designed the technology to combine machine learning judgment with deterministic checks across multi-step execution traces.

This report details the architecture of Project Quarry, its role in enterprise detection engineering, and how it neutralizes multi-stage agent exploits. The analysis provides operational guidance for security architects, machine learning engineers, and system operators who deploy autonomous agents across development pipelines, enterprise tools, and customer systems.

Cisco Open Sources Quarry to Catch AI Agent: what actually changed

The release of Project Quarry shifts enterprise monitoring away from single-point boundary checks toward stateful behavioral inspection across multi-turn agent interactions. Conventional firewalls evaluate requests against static signatures, similar to how standard financial fraud controls review single card swipes. Quarry introduces a domain-specific language designed to evaluate execution sequences across single-turn and multi-turn conversations, tool usage, Model Context Protocol interactions, and multimodal inputs. Instead of replacing existing sensors, the project serves as a shared evaluation layer that correlates isolated steps into structured execution paths.

Cisco integrated Quarry directly into its Integrated AI Security & Safety Framework to translate theoretical threat models into concrete detection capabilities. While the framework defines abstract risk categories, Quarry provides runtime policy enforcement and forensic security analytics to expose those risks during live operations. The open-source starter distribution equips practitioners with an evaluation runtime that compiles rules upon load, a command-line scanner for parsing execution trace files and directories, and a Python SDK for integrating sequence analysis directly into production enterprise codebases.

Cisco Open Sources Quarry to Catch AI Agent: how it works

Quarry uses a neurosymbolic evaluation engine that combines machine learning classifiers and language model judges with deterministic symbolic logic. Symbolic rules verify precise conditions, step sequences, string matches, and specific relationships between invoked tools. Concurrently, the neural layer evaluates semantic context across ongoing interactions. Combining these mechanisms allows the system to recognize when routine permitted steps form an unauthorized objective. The runtime applies configurable safety margins and resource limits, compiling rules when loaded to maintain low execution latency during live data stream inspection.

To ensure security engineering scales against automated adversaries, Cisco enabled autonomous coding agents to author detection logic alongside human engineers. The project provides dedicated plugins for Claude Code, Codex, and Model Context Protocol compatible agents, allowing models to translate plain-English risk descriptions into compiled rules. Engineers and automated agents can validate generated rules against positive and benign behavioral datasets within the starter workflow. Rules validated in coding environments function identically in the evaluation runtime, ensuring predictable protection across testing and production deployments.

Cisco Open Sources Quarry to Catch AI Agent: why it matters now

Modern adversaries evade traditional perimeter defenses by distributing malicious attacks across small, routine operations that mimic authorized system administrative tasks. In 2025, attackers weaponized Claude Code across two operations, targeting approximately 30 organizations in one campaign and Mexican government institutions in another. During the thirty-organization assault, attackers fragmented data exfiltration into minor developer actions that simulated defensive testing. Existing security controls failed because each discrete action appeared benign, and the illicit objective of data theft only became visible after the complete sequence converged.

Manual rule creation cannot keep pace with attackers utilizing artificial intelligence to generate new malicious agent variants. Cisco open-sourced Project Quarry to counter this asymmetry by giving global defenders a common standard for sharing detection logic. Just as Snort, YARA, and Sigma unified rules across network traffic, malware analysis, and system logs, Quarry provides a vendor-neutral format for behavioral agent attacks. Open collaboration allows organizations to distribute newly identified attack patterns instantly, enabling peer teams to deploy matching protections before widespread exploitation occurs.

Cisco Open Sources Quarry to Catch AI Agent: who is affected

Enterprises deploying autonomous agents across software development pipelines, internal customer workflows, and operational infrastructure are directly exposed to multi-step execution attacks. Architectures relying on the Model Context Protocol or granting tools direct access to internal code repositories, filesystem APIs, and enterprise databases are particularly vulnerable to segmented exploitation. When an agent holds permissions to execute terminal commands, read files, and issue external API requests, malicious users can hide data extraction routines within benign administrative workflows without triggering traditional single-action security threshold alarms.

Security operations centers and incident response units face significant challenges investigating compromised agent environments when telemetry records only isolated log entries. Cisco highlighted a past incident where Hugging Face had to reconstruct roughly 17,600 agent actions after an intrusion to understand what happened. Quarry addresses this burden by recording the evidentiary reasoning behind every triggered alert alongside raw traces. Providing contextual evidence helps incident responders evaluate active attacks in real time, eliminating the tedious work of manually stitching together thousands of individual actions.

Cisco Open Sources Quarry to Catch AI Agent: what to watch

Industry adoption of Project Quarry will depend on how quickly community maintainers establish shared detection rule repositories and commercial vendor integrations. Defense teams should monitor whether cybersecurity groups build open rule registries similar to Sigma repositories to distribute crowd-sourced defenses for emerging agent threats. Observers should also track how rapidly development teams integrate the Python SDK and command-line scanning utility into continuous integration workflows to audit recorded agent conversation traces before deploying new agentic capabilities into live enterprise environments.

The balance between attackers and defenders will also depend on how reliably automated coding agents can generate and refine rules without causing operational friction. As adversaries use machine learning to conceal malicious objectives across longer interaction sequences, defensive teams must ensure that automated rules avoid false positives on legitimate multi-step operations. Cisco plans to use the categories in its Integrated AI Security & Safety Framework to guide future rule development, offering a structured roadmap as community contributors expand enterprise detection coverage across diverse platforms.