Cisco has open-sourced Project Quarry, a tool for expressing detection rules that examine connected AI agent actions for suspicious patterns, according to SecurityWeek. The project targets a problem for organizations deploying agents: a sequence of individually permitted requests can reveal an attack that checks on each request would miss.
Cisco describes Quarry as a “neurosymbolic” rule language, combining machine-learning assessments with explicit checks for conditions, sequences, string matches and relationships between tools. Its stated scope includes single-turn and multi-turn large language model conversations, agent activity, tool use, Model Context Protocol (MCP) interactions and multimodal inputs.
The distinction matters when an agent breaks a larger operation into routine-looking tasks. SecurityWeek cites a 2025 campaign involving Claude Code against around 30 organizations, in which requests presented as authorized security testing formed a sequence aimed at stealing data. That example illustrates the detection problem; the report does not establish that Quarry detected the campaign.
Quarry rules can draw on classifiers and LLM-based judges for assessments that depend on meaning, while applying exact checks to other parts of the activity. Cisco positions the project as a shared policy layer, with uses including runtime guardrails, analysis of recorded activity and incident response. It is intended to complement existing detectors and enforcement controls.
The project also connects to Cisco’s Integrated AI Security & Safety Framework. In Cisco’s description, the framework defines risk categories, while Quarry supplies a policy and evaluation layer for detecting those risks in agent activity. Those categories can also guide the development of additional rules.
For practitioners, the release includes a rule language, an evaluation runtime with configurable safety and resource limits, a command-line scanner for individual traces and datasets, and a Python SDK for application integration. It also includes examples, rule metadata, documentation and a workflow for checking rules against both malicious and benign datasets.
Cisco says a Quarry plugin lets Claude Code, Codex and other MCP-compatible agents compose, compile and refine rules from plain-English descriptions of an organization’s risks, then test them against real conversations. The company’s stated intention is for rules tested through a coding agent to behave the same way at runtime.
Cisco wants Quarry to become a common format for sharing AI agent attack detections, drawing a comparison with Snort, YARA and Sigma. Its practical promise is to help defenders recognize harmful sequences while they are underway and retain the evidence behind a finding. The supplied account describes that goal and the available components, but provides no detection-accuracy measurements or independent validation of their effectiveness.
