Detecting an AI agent attack isn’t simply finding multiple small needles scattered in a large haystack; it is recognizing whether and for what purpose the needles are connected.
Traditional security controls evaluate single actions to classify whether an intent is bad or benign. This approach fails on AI agent activity when the bad intent only emerges over a series of benign actions. It only becomes apparent if and when the overall sequence of actions is viewed or actioned.
Fraud detection is an example. A bank analyzes each purchase on its own. That’s largely how traditional security operates. Fraud detection, however, needs to see patterns of apparently benign single purchases across multiple purchases, possibly in multiple locations with unlikely timing (potentially employing agent capability). “Agent security needs the same combination of pattern detection and evidence, applied to the steps an agent takes rather than to purchases,” writes Cisco in announcing the open sourcing of its Project Quarry.
Cisco describes Quarry as a neurosymbolic rule language, combining machine learning judgment with rule-based checks. “It covers single-turn and multi-turn large language model (LLM) conversations, agents, tool use, Model Context Protocol (MCP) interactions, and multimodal inputs.”
Each defined rule draws on neural evidence from ML classifiers and LLM judges, and symbolic rules that check exact conditions, sequences, string matches, and tool relationships. It is designed to provide a shared policy layer rather than be a replacement for every detector or every enforcement control.
Quarry can be used to provide runtime guardrails on agents, post-hoc rule set security analytics, and incident response. It integrates with Cisco’s existing Integrated AI Security & Safety Framework. It expands the framework from describing AI risk toward detecting it in agent activity, and is positioned as the policy and evaluation layer for the framework. The framework defines AI risks while Quarry provides detection of the risks in agent activity – the framework categories also offer a roadmap for the further development of new rules.
Quarry’s detection purpose is to identify suspicious patterns that span individual permitted actions. Such patterns may only become suspicious over a period of time. In 2025, Claude Code was used by bad actors in two campaigns: one against around 30 organizations, and a second against Mexican government institutions. The former attack was split into small routine-looking tasks that told the existing defense it was part of new defense testing. It looked like an authorized pentest from its parts, but the true intent (theft of data) only became apparent when the requests came together in the right sequence.
It is the ability of AI to separate an attack into multiple individually benign steps that defeats traditional defenses and requires this new form of neurosymbolic threat detection. But it is not a ‘write once and move on’ requirement. Attackers are constantly developing new approaches to their attacks. So, whenever a new attack technique is recognized, defenders must respond immediately by writing a new Quarry rule that can be used by all organizations everywhere.
But writing new rules by hand does not scale against the attackers’ use of AI to develop new malicious agents. “We want agents, as well as security and AI engineers, to be able to write Quarry rules,” declares Cisco. A Quarry Plugin allows a coding agent to compose, compile, and refine rules from a plain-English description of an organization’s risk, and then test those rules against real conversations. A rule that passes in a coding agent should behave the same way at runtime.
By open sourcing the project, the traditional cybersecurity asymmetry of attack and defense (multiple attackers against individual defenders) is equalized (multiple global attackers now face multiple global defenders). Allowing the use of AI for development also balances the speed advantage that bad actors have enjoyed in AI-assisted attacks.
“The open-source project,” says Cisco, “gives practitioners a working foundation for detection engineering.” The Quarry starter pack includes:
- a readable DSL for conversations, tool use, and event relationships;
- an evaluation runtime with configurable safety and resource limits, which compiles each rule when it loads;
- a command-line scanner for individual traces, directories, and datasets;
- a Python SDK for application integration;
- optional configured model operations for semantic signals;
- the Quarry plugin for Claude Code, Codex and other MCP-compatible agents;
- rule metadata, examples, documentation, and message-format guidance; and
- a workflow for validating rules against positive and benign datasets.
Project Quarry is intended to become a common, open standard for expressing and sharing detections for AI-agent attacks, much as Snort, YARA, and Sigma became standards in other areas of cybersecurity. “Hugging Face reconstructed roughly 17,600 agent actions after the fact,” says Cisco. “Our aim with Project Quarry is to help defenders recognize sequences like that one while they are still in progress, and to preserve the evidence behind each finding for the people who have to act on it.”
Related: First Agentic AI Data Breach Reported to Spanish Regulator
Related: Agentic AI Used to Conduct Ransomware Attack via Langflow
Related: UK Government Rolls Out Agentic AI Defense Plan Alongside Industry Pledge
Related: Rig Security Emerges From Stealth With $12M to Tackle Agentic AI Identity Risks
