Cisco has launched Project Quarry, an open-source detection tool that identifies potentially dangerous AI agent behavior by analyzing sequences of actions across sessions, tools, and environments.

Quarry uses a neurosymbolic approach that blends rule-based checks, machine learning classifiers, and large language model analysis to assess contextual risks and detect prompt injection or suspicious patterns.

The project is an open-source neurosymbolic rule language and evaluation engine designed to detect multi-step agent attacks by tracing complete agent activity and interactions.

Rules describe relationships between actions and preserve evidence from multiple steps to support investigations.

Quarry is meant to complement human review and existing monitors, offering a shared rule language that teams can publish, adapt, and audit.

The Shield capability provides temporary user-space protections to mitigate vulnerabilities while permanent fixes are developed.

Adoption guidance suggests installing Quarry and starting with a rule for the most critical boundary, plus a starter rule pack.

Looking ahead, Quarry envisions adoption across personal agents and emphasizes shared rules, versioning, and community contributions to adapt to evolving attack techniques.

The motivation stems from incidents where agents chain benign actions, like reading pages or accessing tools, to exfiltrate data, which single actions may miss.

Context highlights real-world agentic AI incidents and industry responses that underscore the need for sequence-aware detection and standardized rules.

Quarry rules resemble YARA/Snort formats, with examples that flag patterns like base-64 encoded malware in tool calls or credential reads followed by external access.

Security teams can write rules that analyze conversations with LLMs, tool calls, Model Context Protocol interactions, and multimodal inputs, including examples such as reading a credentials file followed by data exfiltration.