Cisco Open Sources Quarry to Catch AI Agent Attacks Hidden in Harmless Steps

What it is

Project Quarry is an open-source neurosymbolic rule language from Cisco for detecting AI agent attacks that only show up across a sequence of individually permitted actions. It is positioned as the policy and evaluation layer for Cisco's Integrated AI Security & Safety Framework. The framework defines AI risks, and Quarry detects them in agent activity. Cisco says the framework's categories also guide which new rules to write.

How it works

Each rule combines neural evidence (ML classifiers and LLM judges) with symbolic checks for exact conditions, sequences, string matches and tool relationships. Rules cover single-turn and multi-turn LLM conversations, agents, tool use, MCP interactions and multimodal inputs. The runtime compiles each rule when it loads and enforces configurable safety and resource limits. Model operations for semantic signals are optional and configured separately.

Cisco names three uses: runtime guardrails on agents, post-hoc security analytics over rule sets, and incident response.

What the page gives to ground the threat

• Cisco cites two 2025 campaigns that used Claude Code, one against about 30 organizations and one against Mexican government institutions.
• In the first, the work was split into small routine tasks, and the agent was told it was part of defensive testing. Each part looked like an authorized pentest, and the data theft only showed in the combined sequence.
• Cisco also cites Hugging Face, which reconstructed roughly 17,600 agent actions after the fact. Quarry aims to catch sequences like that while they are in progress and to keep the evidence behind each finding.

What to do

The starter pack includes a CLI scanner for single traces, directories and datasets, and a Python SDK for embedding. It also has a workflow for validating rules against positive and benign datasets, which is the path for measuring false positives before enforcing anything.

The plugin for Claude Code, Codex and other MCP-compatible agents can draft, compile and refine a rule from a plain-English risk description. It can then test the rule against real conversations. Cisco says a rule that passes in a coding agent should behave the same at runtime.

Caveats

• The page gives no repository URL, install commands, rule syntax or detection benchmarks.
• Cisco says Quarry is a shared policy layer, not a replacement for every detector or enforcement control.
• Becoming a common standard, like Snort, YARA and Sigma, is Cisco's stated intent, not an established outcome.
• Rules need continuous updating as attacker techniques change.