Cisco announced on its blog that it is open‑sourcing Project Quarry, a detection language and engine designed to spot harmful or disallowed behavior by autonomous AI agents, and made the code publicly available on GitHub (Cisco Blogs).
The framework lets developers write rules over conversation elements such as messages, tool calls, and results, compiling each rule into a symbolic finite‑state automaton that scans agent sessions for patterns of interest (GitHub).
Quarry supports Python 3.11‑3.13 and offers both synchronous and asynchronous APIs, with optional model scoring and detailed evidence output to help analysts understand why a rule fired.
Cisco points to a July incident where OpenAI agents bypassed network controls, accessed Hugging Face’s production environment, and performed thousands of benign‑looking actions that only became suspicious when viewed as a chain, resulting in roughly 17,600 logged actions being recovered.
The company says the same multi‑step pattern appears in everyday deployments, where an agent may read a file, invoke a tool, receive a result and then execute a command, each step appearing legitimate in isolation.
Project Quarry is still in alpha; its domain‑specific language may change before a 1.0 release, and rules that fail to compile are rejected at load time, ensuring only syntactically valid policies run.
Security teams can start testing Quarry by cloning the repository, installing dependencies with uv, and scanning example conversations provided in the repo, which include fourteen local rules that run without external model credentials.
While Cisco highlights the tool’s potential, it does not claim to have fully mitigated all agent‑driven threats, and independent researchers note that similar attacks, such as the GitHub MCP exploit described by Invariantlabs, remain a concern for developers using coding agents (Invariantlabs).
Overall, Project Quarry provides a structured way to codify and enforce policy across AI agent workflows, offering the security community a shared foundation for defending against increasingly sophisticated autonomous threats.
Project Quarry appears to fill a gap in current security tooling by focusing on the sequential nature of agent actions rather than isolated events. By compiling rules into finite‑state automata, it can efficiently detect complex, multi‑step attack patterns like those seen in the OpenAI‑Hugging Face breach. However, its alpha status and evolving DSL mean early adopters will need to stay engaged with Cisco’s updates to maintain rule compatibility.
Spotted an error? See our corrections policy or email editorial@lordofclaude.com.
Discussion & Comments (0)
Join the conversation