Cisco has launched a new open-source project called Project Quarry, aimed at detecting AI agent attacks that only reveal their malicious intent through tracking a sequence of actions that appear innocent and authorized on the surface. Unlike traditional security controls that evaluate each action in isolation, this project addresses vulnerabilities resulting from composite attacks that break down malicious activities into small, routine tasks.
Quarry is defined as a neuro-symbolic rule language that integrates machine learning judgments with strict rule checks. It covers single-turn or multi-turn conversations across large language models, agents, tool usage, Model Context Protocol (MCP) interactions, and multimodal inputs. Each rule relies on neural evidence derived from machine learning classifiers and large language model judges, alongside symbolic rules that verify precise conditions, sequences, text matches, and tool relationships.
What changes in practice?
The project provides a common policy and evaluation layer that can be used to enforce runtime protection for agents, perform retrospective security analysis of rule sets, and respond to incidents. The project is designed to integrate with Cisco's integrated AI security and safety framework, serving as the actual detection tool for risks identified by the framework. Developers aim to make Quarry an open and common standard for expressing and sharing AI agent attacks, similar to other standards such as Snort, YARA, and Sigma.
Countering advanced threats
This move responds to recorded incidents that showed the use of writing and coding assistant tools to execute attacks divided into small routine tasks to bypass traditional defenses, where the true goal—data theft—only appeared when requests were combined in the correct sequence. To overcome the challenge of slow manual rule writing compared to the speed at which attackers use AI, the project provides a plugin for coding agents to write, compile, optimize, and test Quarry rules using a simple English description of organizational risks.
The project's starter kit includes a domain-specific language readable for conversations and tool usage, an evaluation runtime with safe limits and configurable resources, a command-line scanner, a Python SDK, optional model operations for semantic signals, a dedicated plugin for MCP-compatible coding agents, and a workflow for validating rules against positive and benign datasets.