Project Quarry

Project Quarry ("Quarry") is a detection language and engine for AI-agent behavior that Cisco (the Cisco AI Defense team) open-sourced on October 28, 2026. Security teams can describe a multi-step agent attack once, check every agent session against it, and see the evidence behind each finding. Cisco wants it to be for agents what Snort is for network traffic and YARA is for malware.

Announcement: A Shared Language for Agent Defense: Introducing Project Quarry · Code: github.com/cisco-ai-defense/project-quarry (Apache-2.0) · Coverage: The Register

Key points

1. The problem: agent attacks often unfold across many ordinary, permitted steps, such as reading a file, calling a tool or making a web request. Each step looks harmless on its own, and only the sequence reveals the attack. Cisco points to the July incident in which agents in an OpenAI cyber evaluation got into Hugging Face's production infrastructure.
2. Neurosymbolic rules: a single rule can combine neural signals (ML classifiers, LLM judges, OCR or vision models, e.g. "does this tool result contain a prompt injection?") with symbolic checks (exact strings, unsafe commands, the order of tool calls).
3. Trace-level evaluation: it covers single- and multi-turn LLM conversations, agents, tool use, MCP interactions and multimodal inputs. Event structure (tool name, arguments, result, metadata) is kept, so a rule can reason over a whole session or a single event.
4. Evidence included: when a rule matches, Quarry returns the steps that caused it, the field each one matched in and a short excerpt, with common secret formats masked. The receiving product can then alert, block, redact, quarantine or log.
5. Familiar syntax: a rule has a header (what to inspect), match content and metadata, much like Snort or YARA rules. Rules are compiled when they load, so a broken rule fails before it scans anything.
6. Starter pack: a readable DSL, an evaluation runtime with safety and resource limits, a CLI scanner (quarry scan), a Python SDK, the Quarry plugin for Claude Code, Codex and other MCP-compatible agents (so agents can draft rules), example rules, and a validation workflow.
7. In Cisco products: already in production in Cisco AI Defense, with plans for DefenseClaw and Policy Studio.

Getting started

1. Start with traces you already keep: Quarry reads OpenAI-format chat JSON. Point quarry scan at a directory of stored agent traces.
2. Tune before you enforce: review matches and their evidence, then add exemptions for behavior you allow (for example, your own upload endpoints). Version each rule with one example conversation that should match and one that shouldn't, and gate changes in CI.
3. Move to runtime: call Quarry from the application path before and after each model call and tool run, and map findings to alert, block, redact, quarantine or log.

Typical uses

• Runtime guardrails for coding and browsing agents
• Post-hoc security analytics over stored traces
• Incident response: run a newly learned attack pattern against old traces
• Letting a coding agent draft rules from a plain-English risk description with the Quarry plugin, with a human approving them before enforcement