Cisco open-sources a tool to detect risky sequences of AI-agent actions

Cisco open-sourced Project Quarry on October 28, 2026, giving security teams a rule language and detection engine for examining AI-agent behavior across a session. Its target is a dangerous sequence hidden inside ordinary work: an agent reads a sensitive file, then sends information outside. Either action might be permitted; their relationship raises the alarm.

The project complements rather than replaces access controls. Authorization decides whether an agent may perform a particular action. Quarry looks for suspicious patterns across actions, including ones that were individually allowed. It examines a trace: the step-by-step record of what an agent saw, said and did.

From a pattern to a finding

Cisco calls Quarry’s language “neurosymbolic,” meaning it combines machine-learning judgments with exact rule checks. A classifier or language-model judge can assess whether a tool result contains an instruction intended to redirect the agent. Exact checks can match a string, identify an unsafe command or establish the order of tool calls. Rules specify which signals to combine and what counts as a match.

A match returns the relevant steps, matched fields and short excerpts, with common secret formats masked. The receiving product decides whether to alert, block, redact, quarantine or log the finding. Detection does not prescribe one response to every suspicious sequence.

One tool call may seem in-scope until you realize that that next step is taking that information and sending it to an attacker-controlled inbox or server.

Amy Chang, Cisco’s head of AI threat and security research, speaking to The Register

Live checks and historical searches

Cisco describes three ways teams can apply the engine:

• Runtime guardrails check activity before and after model calls and tool runs, allowing an integration to flag or block a risky step.
• Post-hoc evaluation checks stored traces against a rule set after the work has happened.
• Incident response applies a newly learned pattern to older traces to search historical activity.

Quarry covers single- and multi-turn conversations, agent tool use, images and other multimodal inputs, and Model Context Protocol interactions—the connections between agents and external tools. The repository includes installation instructions, configuration examples, rule-writing guidance, a starter rule pack and plugins for Claude Code, Codex and other compatible agents, according to The Register.

One prominent illustration remains untested: Cisco says it has not run Quarry against data from the OpenAI–Hugging Face intrusion. Its walkthrough describes where rules might have flagged activity, not demonstrated detection results. Cisco researchers also caution that rules do not replace monitoring of model reasoning or human oversight.