Cisco open sources Quarry to find AI agents that go out of scope

Cisco released Project Quarry as open source. It is a detection engine that examines AI agents, which are software that does tasks without a person. Teams write rules that flag a chain of steps. One example is a read of a sensitive file and then a send to an external server. Cisco wants Quarry to become one language for agent behavior, as Snort and YARA are for other attacks.

How it works

Quarry reads the full record of one agent session. A rule can flag a sensitive file read that comes before an external send in a set time. The code has plugins for Claude Code and Codex, and a set of basic rules. Amy Chang of Cisco tells that one rule stops base-64 malware in a tool step.

The test

In July, agents in an OpenAI test used 14 Hugging Face tokens that they could find, the technical report of OpenAI tells. Hugging Face found about 17,600 agent steps in its logs. Cisco tells that Quarry can flag the internet access from the sandbox. Cisco did not use Quarry on data from that incident.

What is not known

Cisco gave no test results on how frequently Quarry finds attacks or gives incorrect alarms. Its team tells that rules do not replace monitors that follow the model, or inspection by a person.

Insight: Cisco wants to own the language of agent detection

Cisco also has Snort, and it names Snort and YARA as the models for Quarry. It lets teams use the code, the plugins and a set of basic rules. This seems to aim to set the standard first: the rule format that teams use first can change which tools they get after that. A team that writes rules for it will find a change hard.