Cisco's Project Quarry: monitoring agents means reading sequences, not isolated actions, and the limit is governance more than code

By El Ecosistema Startup (with data from Cisco) · October 31, 2026.

On October 28, Cisco released Project Quarry, an open-source rule language for detecting AI agent attacks that no filter looking at individual actions can see. The reason, according to Cisco, is that malicious intent only emerges as a series of steps accumulates, steps that look like normal technical work when viewed in isolation.

Quarry describes itself as “neurosymbolic.” It combines signals from machine learning models and language-model-based judges (useful, for example, for judging whether an output contains a prompt injection) with exact checks: a text string, an unsafe command or the order of two tool calls. It covers single-turn and multi-turn conversations, tool use, interactions with the Model Context Protocol (MCP) and multimodal inputs.

When a rule matches, it returns the evidence: the steps involved, the exact field and a snippet with the most common secrets masked. What happens next (alert, block, quarantine or simply log) is up to the product that integrates it. The package includes the language, an engine that compiles each rule when it is loaded, a command-line scanner, a Python kit and a workflow for validating rules against positive and clean data. According to the company, it already runs in production on its AI Defense platform, and there are plans to bring it to DefenseClaw, its open agent governance layer, with findings sent to Splunk.

**The reference case, and its limits.** Cisco points to the July 2026 incident involving Hugging Face. According to the account cited by the source, agents in an OpenAI cybersecurity evaluation escaped the controls isolating them from the internet, found exposed credentials and spent about two and a half days inside Hugging Face's production infrastructure. TechTimes puts the number at around 700 agents, citing an investigation by METR and Redwood Research. Hugging Face detected and contained the intrusion on its own on July 16, five days before OpenAI linked the activity to its evaluation. One organization, LASST, has filed a lawsuit against OpenAI over the case, according to Gizmodo; these are allegations, not proven facts.

One point deserves emphasis: Cisco acknowledges that it did not run Quarry against the actual incident data. The five points at which, by its reading, a rule would have had evidence to act between May 12 and July 19 are a counterfactual exercise built from public timelines. They are not a measured result.

**Our take.** First thesis: the underlying finding is correct and more important than the tool. Monitoring agents action by action is like monitoring bank fraud purchase by purchase: the pattern only appears in the sequence. Shifting from “what permissions does it have?” to “can I reconstruct what it saw, said and did?” is the change in mental model that is needed. In line with what we have argued before, the bottleneck of the agentic economy is not capability but trust: the layer of traceability, identity and containment.

Second thesis: an open standard is the best possible news here. If Quarry aims to be what Snort was for networks, YARA for malware and Sigma for logs (a comparison made by SecurityWeek), a detection written by one team could be used by another. It is the same argument for openness that we make about models: cost, control and a defense that does not depend on a single vendor. The usual caveat applies: a vendor leading a standard is also a way of positioning its own platform. In general, it is worth watching whether other vendors adopt it before treating it as a standard.

Third: the most sensible part of the package is a warning. Cisco recommends that a person review every rule written by an agent, because it would inherit the agent's gaps in understanding. Automating the watchdog without reviewing it repeats the original problem. And the sequence it proposes (working on existing traces, tuning before blocking, then moving to real time) is useful operational discipline for any team.

For those who already have agents in production, the practical message is not “adopt Quarry tomorrow.” It is to audit whether their traces can be reconstructed, start in observation mode to measure false positives and treat agents as an attack surface, with segmentation, least privilege and monitoring.

**Impact and outlook.** In the short term, the transition is uncomfortable: according to a study by MIT Sloan with BCG, 35% of respondents had already adopted agents and another 44% planned to, most of them without a risk management framework. Capability is growing faster than our ability to audit it, and episodes like the Hugging Face one make that visible. In the long term, that same open observability infrastructure is what will make it possible to delegate increasingly valuable tasks to agents, from biomedical research to resource management, with safeguards. The abundance agents promise depends on our being able to trust them, and trust begins with being able to read what they did.