Summary
- Project Quarry evaluates sequences of agent actions rather than isolated prompts alone.
- Its rules can combine symbolic checks with machine-learning judgements.
- The engine is open source, while enforcement depends on connected systems.
Cisco has open-sourced Project Quarry, a detection language designed to identify harmful behaviour across sequences of AI-agent actions. The project allows a security policy to examine more than one instruction or tool call, recognising patterns that emerge when several apparently legitimate steps combine to create an unsafe outcome.
AI agents routinely read files, retrieve webpages, call software tools and use the results to decide what to do next. A single action may be authorised in isolation while the surrounding sequence changes its meaning. Cisco gives examples including an untrusted tool response followed by a command, or the reading of a sensitive file followed by a request to an external destination. Project Quarry is built to evaluate those relationships rather than judging each event without context.
The language combines two forms of detection. Symbolic checks express conditions that can be tested precisely, such as the presence of a particular field, sequence or unsafe action. Machine-learning classifiers and language-model evaluations can assess situations that require interpretation, including possible prompt injection in untrusted material. Rules then combine those signals into decisions that can be inspected and tested rather than leaving all detection logic inside an opaque model response.
Quarry maintains the structure of tool calls, arguments, results and available metadata. When a rule matches, the engine can return the steps and fields that caused the match, with common secret formats masked. That evidence is important when an alert concerns an agent performing a series of authorised activities: investigators need to understand whether the sequence genuinely crossed a policy boundary or whether a legitimate workflow merely resembles a risky pattern.
Cisco compares the proposed approach with established detection languages used elsewhere in security. Snort rules describe suspicious network traffic, YARA helps analysts recognise files and malware patterns, and Sigma provides portable rules for log events. Quarry aims to provide a comparable shared vocabulary for agent behaviour. Its open-source status allows the rule format and engine to be inspected, adapted and integrated by developers outside Cisco.
The project is designed to work with conversational agents, tool use, Model Context Protocol interactions and multimodal inputs. It can evaluate an event as an agent runs, inspect stored traces after an incident or apply a newly defined pattern to historical records. These options address different operational questions: whether to interrupt a live task, whether an earlier session was unsafe, and whether a previously unnoticed sequence occurred elsewhere.
Because Quarry identifies suspicious sequences rather than directly controlling every tool, the application integrating it remains responsible for the response. A matching rule might trigger an alert, block a step or require human approval, depending on the surrounding enforcement controls. Cisco presents the language as a detection and policy layer, with access restrictions and tool permissions remaining separate safeguards.
Quarry’s portability could prove useful where organisations run agents built on several frameworks, but consistent detection requires a common representation of their actions. The engine can inspect stored traces and apply rules to new sessions, yet there is no implication that every enterprise agent automatically emits complete, interoperable evidence. The project therefore introduces both a detection language and an expectation about telemetry: relevant prompts, tool requests, returned content and sequence order must be captured before the rule system can evaluate relationships between them.
Detection will depend on the continuity of the captured trace. If an agent framework omits tool results, loses metadata between actions or suppresses activity during a hand-off, the engine may lack evidence needed to match a multi-stage rule. Classifier-based judgements also require testing for inconsistent or excessive alerts. Cisco has provided an open foundation for experimentation, while operational performance across different agent platforms has yet to be demonstrated.
