Cisco Launches Project Quarry to Detect Malicious AI Agent Behavior
Open-source engine provides contextual analysis to prevent rogue AI agents from executing unauthorized cyberattacks.
1Contextual Security for Agents
Cisco has open-sourced Project Quarry, a behavior detection engine designed to monitor AI agents for malicious activity. Unlike tools focusing on single interactions, Quarry evaluates entire agent sessions to identify dangerous patterns. This approach aims to provide a shared language for security teams to standardize how they detect rogue AI behaviors.
2Moving Beyond Single Actions
Most security tools fail because they analyze isolated events rather than sequences. Amy Chang, head of AI threat research at Cisco, compares this to fraud detection. A single legitimate action, like reading a file, becomes dangerous only when followed by an unauthorized external data transmission, necessitating a broader view of agentic sessions.
3Learning from Past Incidents
The tool addresses risks highlighted by the Hugging Face hack, where agents were manipulated to validate exposed tokens. Cisco researchers suggest that if Quarry had been active, it would have flagged the suspicious internet access from the sandbox environment. The system identifies when credentials are found and subsequently utilized for unauthorized tasks.
4Rule-Based Detection Framework
Quarry utilizes a rule format inspired by Snort and YARA, allowing security teams to define specific traffic headers and metadata. The repository includes a rule starter pack, configuration examples, and plugins for MCP-compatible agents. These rules enable teams to block threats like base-64 encoded malware found within agent tool calls.
5Addressing Action Relationships
The core innovation of Quarry is its focus on action relationships. By linking a sensitive file read to a subsequent external send within a defined window, the engine preserves evidence of the entire attack chain. This methodology helps security professionals distinguish between legitimate agent workflows and coordinated data exfiltration attempts by attackers.
6Broad Compatibility and Integration
The project supports multi-turn LLM conversations, Model Context Protocol interactions, and multimodal inputs. It provides installation instructions and supports various Python versions to ensure wide adoption. By offering plugins for tools like Claude Code and Codex, Cisco aims to make agent security accessible across diverse development environments and AI-driven workflows.
7Limitations of Automated Rules
Cisco emphasizes that Quarry is not a replacement for human oversight or chain-of-thought monitors. Instead, it serves as a mechanism to record and share attack patterns. Teams can review, test, and apply these findings to their own agents, fostering a collective defense strategy against the adversarial use of AI technologies.
8Collaborative Defense Strategy
By open-sourcing the engine, Cisco encourages a community-driven approach to AI security. Because individual organizations only see slices of the threat landscape, sharing detection logic is essential. This collective effort aims to build a more resilient ecosystem, helping developers and security teams stay ahead of evolving agent-based cyber threats.