Cisco Open-Sources Project Quarry, a Rule Language for Catching AI Agent Attacks That Only Show Up Across a Sequence of Individually Permitted Steps

AUSTIN - Cisco has open-sourced Project Quarry, a detection rule language for AI agent activity that is meant to do for agent traces what Snort does for network traffic, YARA for malware and Sigma for logs: describe a multi-step attack once, check every session against it and show the evidence behind each match.

In a post published on Oct. 28 by researchers including Amy Chang, Cisco's head of AI threat intelligence and security research, the company argued that attacks against agents unfold across many ordinary, permitted steps that most defenses were not built to connect. "Agent security needs the same combination of pattern detection and evidence, applied to the steps an agent takes rather than to purchases," the post said, comparing the problem to card fraud detection.

The case Cisco built it around

Cisco opened with the July incident in which, it wrote, AI agents running in an OpenAI cybersecurity evaluation got around controls meant to keep them off the internet, found exposed credentials and spent roughly two and a half days inside Hugging Face's production infrastructure. Hugging Face later recovered about 17,600 of the agents' actions from its logs. Most were unremarkable alone: list a directory, upload a file, make a web request, run a command. The intrusion became visible only in how those actions accumulated.

Reading the published timelines, Cisco marked points where a rule would have had something to act on: an agent writing a note into OpenAI's internal package registry on May 12, web requests from a sandbox that had no internet access on May 26 and July 8, 14 exposed Hugging Face credentials with write access validated and shared on July 10, and a one-line decode-and-run payload on July 11. Cisco stressed that it has not run Quarry against incident data.

How the rules work

Cisco calls Quarry a neurosymbolic language. Each rule can combine neural signals from machine learning classifiers and LLM judges, for questions such as whether a tool result contains a prompt injection, with symbolic checks for things that can be stated exactly, such as an unsafe command, a string match or the order of two tool calls. Cisco said it covers single-turn and multi-turn LLM conversations, agents, tool use, Model Context Protocol interactions and multimodal inputs.

Some detections need only one event. The rule above inspects a bash tool call for a base64 decode piped to a shell. Cisco said encoding matters in practice: when Hugging Face first scanned its raw logs for secrets it found very few, but decoding them the way the attacker had encoded them recovered roughly four times as many. Quarry has a base64 string modifier that matches the encoded form of a pattern.

Other detections depend on order. Cisco's example flags an agent that reads a file such as .env, id_rsa or .aws/credentials and then makes an HTTP request within four steps. Because the rule keys on the steps rather than the request body, encoding the payload does not stop it from matching. Cisco's comparison Snort rule, which flags the string AWS_SECRET_ACCESS_KEY in an outbound HTTP body, matches only if the secret crosses the wire in readable form. Cisco called both illustrative examples and acknowledged that the two rules differ in what they can observe.

When a rule matches, Quarry returns the steps that caused the match, the field each one matched in and a short excerpt, with common secret formats masked. The receiving product decides whether to alert, block, redact, quarantine or log. Cisco listed three uses: runtime guardrails before and after each model call and tool run, post-hoc evaluation of stored traces for security analytics, and incident response, running a newly learned pattern against old traces.

What ships, and what does not

The open-source release includes the rule language, an evaluation runtime that compiles each rule when it loads, a command-line scanner for traces, directories and datasets, and a plugin that lets Claude Code, Codex and other MCP-compatible agents draft and test rules from a plain-English description of a risk. Cisco said it still recommends "that a human review and approve each rule before it moves to enforcement," because a rule written by an agent can inherit gaps in that agent's understanding. The code is at github.com/cisco-ai-defense/project-quarry.

Cisco said Quarry is already in production in its AI Defense product and that it plans to connect it to DefenseClaw, its open-source governance layer for agent runtimes, and send findings to Splunk. It labeled those integration plans forward-looking. Quarry does not replace authorization controls that allow or deny individual actions; it is meant to catch patterns that span several permitted ones.

What the SOC should take from it

For SOC teams with agents in production, the immediate question is whether the trace exists. Quarry reads OpenAI-format chat JSON, so Cisco's suggested starting point is to run the scanner against traces a team already stores, tune exemptions for sanctioned behavior such as its own upload endpoints, and version each rule with one conversation that should match and one that should not, gated in CI, before moving to runtime. Cisco's closing advice to buyers applies regardless of tool: ask vendors what their agents record, whether you can get the full trace and whether a finding arrives with its evidence.