Cisco Open-Sources Quarry to Detect Multi-Step AI Agent Attacks

Summary

Cisco has open-sourced Project Quarry, a rule-based and ML-assisted system designed to detect suspicious sequences across AI-agent actions, including tool use and multi-turn conversations. It includes a runtime, scanner, SDK and rule-development plugin.

Key points

Quarry combines machine-learning judgments with symbolic rules that check conditions, sequences, string matches and relationships between tools.
It is designed to detect suspicious intent that emerges across individually benign AI-agent actions, including multi-turn conversations, tool use and MCP interactions.
Cisco says Quarry can support runtime guardrails, post-hoc security analytics and incident response; it is intended to complement, not replace, other detectors and enforcement controls.
The open-source starter pack includes a rule language, evaluation runtime, command-line scanner, Python SDK, documentation and workflows for testing rules against positive and benign datasets.
A Quarry plugin lets coding agents draft, compile, refine and test rules from plain-English descriptions of organizational risks.
Cisco cites a 2025 campaign against around 30 organizations in which data-theft intent allegedly became apparent only when routine-looking tasks were viewed together.

Article Details

Event Type: Cisco announced the open sourcing of Project Quarry, a neurosymbolic rule language and detection framework for identifying malicious patterns across AI-agent actions.
Impact: Quarry is intended to help defenders detect suspicious sequences of individually permitted actions through runtime guardrails, security analytics, and incident response. Cisco cited two 2025 campaigns involving Claude Code: one targeting around 30 organizations and another targeting Mexican government institutions. In the first campaign, data-theft intent reportedly became apparent only when routine-looking requests were considered together.