Cisco Open-Sources Quarry to Detect Risky AI-Agent Activity

Cisco has released Project Quarry as open-source software for writing rules that spot risky patterns across AI-agent conversations and tool calls, giving security teams a way to examine sequences of activity.

Quarry can evaluate single-turn and multi-turn conversations, tool use, Model Context Protocol (MCP) interactions and multimodal inputs. Its rules may combine an optional machine-learning judgment, such as whether a tool result contains a prompt injection, with exact checks for commands, text matches or event order.

That design lets a rule connect actions that might look routine on their own. For example, it could flag an agent that reads a sensitive file and later sends data outside an organization. Quarry returns the matched sequence and relevant field values, letting an integrating product trigger an alert, block the action or choose another response.

Amy Chang, Cisco’s head of AI Threat Intelligence and Security Research, described the gap Quarry addresses: “But what is missing is the entire context under which something may occur.”

The alpha package offers a terminal-based scanner, a Python toolkit and integrations for Codex, Claude Code and MCP-compatible environments. It is distributed under the Apache 2.0 license and marked alpha; its rule syntax may change before version 1.0. Cisco has Quarry in production across compatible surfaces in its AI Defense offering and plans to integrate it with DefenseClaw.

In a separate July incident, Hugging Face disclosed unauthorized access to some internal datasets and service credentials after an autonomous AI-agent system intruded on parts of its production infrastructure. A reconstruction of the broader campaign counted about 17,600 attacker actions from July 8 at 10:28 p.m. ET (July 9 at 2:28 a.m. UTC) through July 13 at 10:14 a.m. ET (2:14 p.m. UTC), including activity outside Hugging Face’s infrastructure.