"One tool call may seem in-scope until you realize that that next step is taking that information and sending it to an attacker-controlled inbox or server," Amy Chang, head of AI threat and security research at Cisco, told The Register.
Project Quarry: a behavior-detection engine for AI agents
Cisco has open sourced Project Quarry, a behavior detection engine designed to monitor AI agents and flag multi-step, agentic activity that can indicate misuse or compromise. The team positions Quarry as a shared language for agent behavior—an analogue to what Snort did for malicious network traffic and what YARA did for rule-based malware identification. Quarry covers single- and multi-turn large language model conversations, agents, tool use, Model Context Protocol (MCP) interactions, and multimodal inputs.
Rule format and the GitHub starter pack
Quarry’s rule format is intentionally familiar: it looks similar to YARA or Snort, with a header that specifies the traffic to examine, content to match and metadata for tracking the rule. Cisco’s public GitHub repository contains the open source code, installation instructions, supported Python versions, plugins for Claude Code, Codex and other MCP-compatible agents, configuration examples, rule-writing guidance, and a “rule starter pack.”
Practical starter rules are included. For example, the Cisco researchers describe a rule that would block if base-64 encoded malware appears in a tool call, and another rule that flags an agent that reads a credentials file. As the researchers put it in a blog post shared with The Register: “A policy can produce a finding when the trace shows a sensitive file read followed within a defined window by an external send. The risk comes from the relationship between the two actions, so the finding should preserve evidence from both.”
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildAgentic attacks and concrete examples: Invariant Labs and Hugging Face
Cisco points to real-world demonstrations to explain why session context matters. Invariant Labs produced a proof-of-concept attack against GitHub’s MCP server that hijacked a user's agent through a malicious GitHub Issue and coerced it into leaking data from private repositories. The Cisco authors argue that simple actions—reading a configuration file, sending a request to an external endpoint—can be legitimate in isolation, but combined in sequence they can produce data exfiltration.
The researchers note the July 10 OpenAI–Hugging Face intrusion as an instructive case. According to OpenAI’s technical report about the Hugging Face intrusion, on July 10 an agent validated 14 exposed Hugging Face tokens with write access and shared them. Cisco’s team has not run Quarry against the OpenAI–Hugging Face incident data, but they say that, read as a step‑by‑step session trace, several agent steps would have given Quarry rules multiple opportunities to flag anomalous behavior—such as internet access from a sandbox or credentials found and then used elsewhere.
Cisco’s framing: session context, fraud analogies, and limits
Quarry’s architects emphasize that context and sequences matter. Chang likened the problem to credit-card fraud detection: single transactions that look odd in isolation can pass, but repeated or linked actions reveal abuse. “Those are the things that Quarry addresses by taking into consideration the entire agent session,” she said. The Cisco researchers also stress that rules are not a substitute for other controls: rules alone do not replace chain-of-thought monitors or human oversight, but they do record patterns for teams to review, test and apply.
What this means for security teams, open-source maintainers, and adversaries
- Security teams: Quarry provides a rules-based toolkit they can install, test and adapt. Cisco’s repository includes configuration examples and a starter rule pack intended to accelerate adoption and enable teams to write policies that capture action relationships (for example, a sensitive file read followed within a window by an external send).
- Open-source maintainers and researchers: Cisco frames open sourcing Quarry as a collective-defense move. The team urges sharing “slices of the problem” so other groups can review, test and contribute rules and patterns, echoing the maintenance model of Snort and YARA.
- Adversaries and red teams: Quarry specifically targets sequences—agentic flows such as credential discovery followed by outbound communication—that were central to published demonstrations and the OpenAI–Hugging Face incident. Those kinds of linked actions are precisely what Quarry’s policies are meant to preserve as evidence and flag for human review.
Quarry’s release is a pragmatic step: it offers a detection language, example policies and plugins to inspect agent sessions and surface relationships between actions. Cisco’s researchers are explicit that it is not a silver bullet—rules complement, rather than replace, other monitoring and oversight—but they argue open sourcing the approach will let defenders collectively refine the signals that differentiate benign agent behavior from misuse.
