Cisco has open-sourced Project Quarry, a security tool designed to detect AI-agent attacks that only become suspicious when individually ordinary actions are viewed together. Its practical promise is to give defenders a way to describe and test those patterns, rather than relying only on controls that assess one action at a time.
Cisco Watch analysis
What happened
SecurityWeek reports that Cisco describes Quarry as a neurosymbolic rule language, combining machine-learning judgements with rule-based checks. It covers LLM conversations, agents, tool use, MCP interactions and multimodal inputs. Rules can check exact conditions, sequences, text matches and relationships between tools.
The open-source starter pack includes a readable language for describing conversations and tool use, a rule-evaluation runtime, a command-line scanner, a Python SDK and a plugin for coding agents including Claude Code and Codex. Cisco says rules can be tested against positive and benign datasets, and that a rule composed with an agent should behave the same way when run in production.
Why it matters
A sequence of legitimate-looking steps can conceal a harmful purpose. That makes agent security a problem of connecting evidence across actions, not just labelling each tool call as safe or unsafe in isolation. Quarry gives security teams a shared way to express those patterns and, potentially, share detections.
Cisco also describes a plugin that lets coding agents draft, compile and refine Quarry rules from plain-English descriptions of an organisation’s risks, then test them against real conversations. That could make writing and updating detections less manual, although a proposed rule still needs sound testing before anyone trusts it with a live system.
Our read
This is a substantial open-source contribution to a problem agent builders cannot solve by adding another warning banner. The useful idea is the combination of sequence-aware detection and rules that can be inspected and tested. The harder test is whether practitioners can build reliable rules quickly enough to keep pace with new attack patterns. “Open source” helps with access; it does not make detection quality automatic.
What to watch
- Whether security teams adopt Quarry rules across different agent frameworks and tools.
- How well rules distinguish genuinely suspicious sequences from legitimate multi-step work.
- Whether the plugin’s generated rules hold up against realistic, independently tested datasets.
Discussion spark: Should agent security rely on shared, human-readable rules such as Quarry, or on each platform’s own detection system?
Sources and evidence
- Source update (29 October 2026, 14:18 UTC)
not affiliated with or endorsed by Cisco