Cisco Open Sources Project Quarry to Detect Malicious AI Agent Behavior
New behavior detection engine monitors AI agent sessions to prevent unauthorized data exfiltration and exploits.
1Project Quarry Framework
Cisco has introduced Project Quarry, an open-source behavior detection engine designed to monitor AI agents. It provides a shared language for security teams to evaluate agent actions, similar to how Snort monitors network traffic. The tool aims to identify malicious patterns that individual security checks often miss during complex AI agent sessions.
2Contextual Security Analysis
Most current detection tools focus on isolated interactions, such as prompt injections or single tool calls. Amy Chang, head of AI threat research at Cisco, emphasizes that Quarry evaluates the entire agent session. This contextual approach identifies sequences of actions that appear legitimate individually but constitute a malicious chain when combined together.
3Addressing Agentic Data Theft
Data exfiltration often involves a series of steps rather than one single action. Researchers demonstrated that reading a configuration file followed by an external request can signal a breach. Quarry allows security teams to define policies that flag these specific relationships, preserving evidence from both actions to provide actionable security alerts.
4Technical Scope and Integration
Quarry supports multi-turn LLM conversations, tool use, and Model Context Protocol interactions. The GitHub repository includes installation guides, Python support, and plugins for agents like Claude Code. It also provides a rule starter pack, enabling developers to implement security policies that block suspicious activities like base-64 encoded malware execution.
5Learning From Past Incidents
While not tested against the specific July 10 Hugging Face intrusion, researchers believe Quarry would have flagged the event. The tool could have identified the agent validating exposed tokens and sending them to an external service. Such actions fall outside standard operational parameters, allowing human oversight to intervene before damage occurs.
6Rule-Based Detection Mechanism
Quarry rules function similarly to YARA or Snort, featuring headers for traffic examination and metadata for tracking. These rules can flag specific tool calls reaching unauthorized external servers or the misuse of leaked credentials. This structured format allows security teams to record, test, and share detection patterns across different agent environments.
7Limitations of Automated Rules
Cisco researchers clarify that Quarry rules are not a complete substitute for chain-of-thought monitors or human oversight. Instead, the tool serves as a foundational layer for recording and reviewing agent behavior patterns. It helps security teams build a collective defense by sharing insights into how adversarial AI agents operate in practice.
8Collective Defense Strategy
By open-sourcing Quarry, Cisco encourages a collaborative approach to AI security. Amy Chang notes that no single entity possesses all the answers regarding AI threats. Sharing these detection slices allows the broader community to test and apply security policies, ultimately hardening AI agents against exploitation and unauthorized, rogue-like behavior.