Cisco open-sources Project Quarry: monitoring AI agents means looking at the sequence of actions, not each command in isolation

By CDO Magazine · October 28, 2026.

Cisco has open-sourced Project Quarry, a detection language and engine designed to spot potentially harmful AI agent behavior by analyzing sequences of actions across a session. The information comes from a report by The Register, picked up by CDO Magazine. According to Cisco, the goal is to fill a gap in conventional security monitoring, which usually examines individual commands or interactions rather than how several actions relate to each other.

Quarry lets security teams write rules that inspect conversations with large language models (LLMs), tool calls, Model Context Protocol interactions (MCP, the standard that connects agents to tools and data) and multimodal inputs. The source gives an example: a rule that flags an agent that reads a credentials file and then sends information to an external server. When a rule fires, Quarry records the evidence, meaning the actions and fields that triggered the match.

The release includes installation instructions, a guide to writing rules, configuration examples, a starter rule pack, and plugins for Claude Code, Codex and other MCP-compatible agents.

Cisco points to a July incident involving OpenAI and Hugging Face agents as a reference case. According to OpenAI, an agent found and verified 14 exposed Hugging Face tokens that allowed it to make changes, and then shared them. Cisco says it has not tested Quarry against that incident, though it believes the tool could have detected warning signs. This is best read as a vendor hypothesis, not as validation.

**Our take.** The thesis is simple: an agent is dangerous not because of a single command but because of a trajectory. Reading a file is normal. Sending data out is also normal. The combination is the problem. We see the same pattern in autonomous warfare, where the risk lies not in any one weapon but in how speed hollows out oversight. What needs governing is processes and sequences, not individual actions.

There is also a strategic angle. An open engine that ships with plugins for third-party agents (Claude Code, Codex) suggests the detection layer aims to be neutral infrastructure. Broadly, that is where agent governance is heading: from written policies toward technical controls, auditable logs and verifiable evidence. An open standard for shareable rules also reduces dependence on a single vendor, which is valuable for small companies.

There are limits worth pointing out, too. Sequence-based rules depend on someone anticipating the harmful patterns. An agent can chain actions in unexpected ways, and hand-written rules are always a step behind. And the Hugging Face example itself is a proof of concept claimed by Cisco. Our material contains no public data on detection rates or false positives.

In the short term, companies that give agents access to data and credentials face an awkward transition, because capability is arriving before controls. In the long term, capable and well-monitored agents are the path to automating much routine work and freeing people for what really matters. Tools like Quarry are not glamorous, but they are the trust plumbing that makes that future possible.