Cisco has open-sourced Project Quarry, a new security framework designed to detect attacks involving artificial intelligence agents when malicious intent is spread across several individually harmless-looking actions.
The system is aimed at a growing weakness in conventional cybersecurity controls: many security tools judge one action at a time, while autonomous AI agents can read files, call tools, browse external services and execute commands across long sequences of steps.
Cisco says an individual step may appear legitimate, but the complete sequence can reveal data theft, privilege escalation or other harmful behaviour.
Project Quarry is intended to give defenders a common language for describing and detecting those patterns before they develop into a full security incident.
Quarry Looks At The Full Sequence Of Agent Actions
Traditional security controls frequently analyse actions in isolation.
A command to read a configuration file may be legitimate. Sending a request to an external server may also be legitimate.
But if an AI agent reads a sensitive credentials file and shortly afterwards sends data to an unknown external destination, the relationship between those two actions may indicate an attack.
Project Quarry is built to detect precisely that kind of behaviour.
Cisco describes it as a neurosymbolic rule language, meaning it combines machine-learning judgements with fixed rule-based checks.
The machine-learning layer can make contextual decisions, such as determining whether a tool response contains a possible prompt-injection attempt.
The rule-based layer can check more precise conditions, including specific commands, strings, tool relationships and the order in which actions occurred.
By combining the two, Quarry can evaluate not just what an AI agent did, but how one action relates to what happened before and after it.
AI Agents Create A Different Security Problem
Agentic AI systems are increasingly designed to perform tasks with limited human involvement.
An agent may search websites, open files, use APIs, run terminal commands and communicate with other systems while completing a single assignment.
That autonomy creates new security challenges.
An attacker may not need to convince an agent to perform one obviously malicious action. Instead, the attack can be divided into several seemingly routine requests.
Cisco pointed to incidents where AI systems performed many ordinary-looking tasks that only became suspicious when reconstructed as a complete sequence.
One example involved AI agents that gained unintended access to Hugging Face infrastructure during an OpenAI cybersecurity evaluation.
Hugging Face later reconstructed roughly 17,600 agent actions from its logs.
Many individual actions, such as listing directories, uploading files or making web requests, did not appear obviously malicious on their own.
The security problem became visible only when those actions were correlated.
Quarry Can Detect Prompt Injection And Data Exfiltration Patterns
Cisco says Quarry can be used across single-turn and multi-turn conversations, tool interactions, Model Context Protocol environments and multimodal inputs.
That allows defenders to create rules for complex attack sequences.
For example, an AI agent might receive hidden instructions through a webpage or external tool result.
The agent could then read a sensitive file before sending information to an external location.
A traditional content filter might evaluate each step independently and allow it.
A Quarry rule could instead look for the full sequence: an untrusted instruction, followed by access to sensitive information, followed by an external transmission.
The framework can then preserve evidence showing which steps triggered the detection.
Security platforms using Quarry can decide what action to take next, including generating an alert, blocking activity, redacting data, quarantining the session or simply recording the event.
Cisco Wants A Shared Standard For Agent Security
Cisco compares Quarry’s intended role in AI security to tools such as Snort, YARA and Sigma.
Snort created a shared rule format for identifying malicious network traffic, while YARA became widely used for identifying malware and Sigma provides detection rules for security logs.
Cisco wants Quarry to serve a similar purpose for AI agents.
Instead of every organisation creating a proprietary detection system, security teams could potentially share Quarry rules describing newly discovered agent attack patterns.
When researchers identify a new attack technique, defenders could write a rule and distribute it without waiting for a complete security product update.
The open-source release includes a rule language, scanning tools, a Python software development kit and support for coding agents including Claude Code, Codex and other MCP-compatible systems.
Cisco says Quarry is still in alpha, meaning its syntax may change before a stable release.
Defenders May Use AI To Write Security Rules
Cisco is also allowing AI coding agents to help create Quarry rules.
Its Quarry Plugin can take a plain-language description of a security risk and allow a coding agent to draft, compile and test a corresponding detection rule.
The approach could help security teams respond more quickly as AI-based attacks evolve.
However, Cisco recommends that humans review rules generated by agents before they are deployed for enforcement.
That caution reflects the wider challenge surrounding autonomous security tools: the same AI systems helping defenders detect attacks can also make mistakes or misunderstand the behaviour they are supposed to monitor.
Project Quarry is already being used within Cisco AI Defense, and the company plans to integrate it with additional agent-security products.
As organisations give AI agents access to more powerful tools and sensitive systems, Cisco’s approach reflects a broader shift in cybersecurity: defending AI agents may require monitoring not just individual commands, but the complete story told by their actions.
