Cisco Project Quarry: Open Rules to Catch Rogue AI Agents

Security teams have Snort for network traffic, YARA for malware and Sigma for logs. Now Cisco wants AI agents to have a shared detection language too. On October 28, 2026, Cisco open-sourced Project Quarry, a rule language and evaluation engine built to spot harmful or disallowed agent behavior by reading an agent's entire session, not just one message at a time.

• What it is: an open-source detection language and engine for AI agent conversations, tool calls, Model Context Protocol (MCP) interactions and multimodal inputs
• How it works: rules combine exact symbolic checks with optional machine learning or LLM-judge signals, and every finding keeps the evidence behind it
• Getting started: the GitHub repo includes an Apache 2.0 codebase, plugins for Claude Code, Codex and other MCP-compatible agents, and a rule starter pack
• Status: alpha, supporting Python 3.11 through 3.13, with syntax that may change before v1.0.0

Why AI Agent Security Needs Session-Level Detection

The core insight is that agent attacks often look harmless one step at a time. Reading a configuration file is normal. Sending a web request is normal. Reading a credentials file and then sending its contents to an unfamiliar server is a problem, but only the combination reveals it.

Cisco's researchers compare this to credit card fraud detection: a bank approves individual purchases, while its fraud team watches for suspicious patterns across them, such as a tiny test charge followed by a big electronics order. Amy Chang, Cisco's head of AI threat and security research, told The Register that what most tools miss is the entire context of the agent session. Quarry is designed to supply that context.

How Do Quarry Detection Rules Work?

Quarry rules look familiar to anyone who has written YARA or Snort signatures. Each rule names the data to inspect, the signals to use, how to combine them and what counts as a match. According to the project README, the engine validates rules when they load and compiles each one into a finite-state automaton that runs over the conversation.

Two kinds of evidence can feed a single rule:

• Symbolic checks handle precise conditions such as a string match, a regular expression, an unsafe command or the order of two tool calls
• Neural signals come from classifiers or LLM judges for judgment calls, like whether a tool result contains a prompt injection

A policy can then flag, for example, a sensitive file read followed within a set window by an external send, and preserve evidence from both steps so a human analyst can see exactly why the alert fired.

What Quarry Means for Security Teams

The biggest win is shareability. Rules written in an open format can be versioned, tested, reviewed and exchanged between organizations, the same way the community already shares network and malware signatures. Cisco says it hopes Quarry becomes a common foundation across the security community rather than one more proprietary format.

It also fits naturally alongside access controls like Microsoft's dynamic permissions for AI agents: permissions decide what an agent may do, while Quarry watches what it actually did. Cisco's AI research group has been busy, following its Talos Cairn AI malware tracking work. Find more defensive tools in our AI security coverage.

Sources: Cisco Blogs: Introducing Project Quarry — October 28, 2026; The Register — October 28, 2026; Project Quarry on GitHub — accessed October 28, 2026.