Cisco Open Sources Tool for Detecting AI Agents on Hacking Sprees
The Register, Wednesday, October 28th, 2026
Cisco open sources Project Quarry, a rule-based engine that evaluates whole AI agent sessions to detect malicious behavior.
Cisco has open sourced Project Quarry, a behavior detection engine for AI agents modeled on its Snort and YARA tools.
Rather than checking single interactions, Quarry evaluates full agent sessions, since individually legitimate steps such as reading a config file and making an external request can combine into data exfiltration.
It covers LLM conversations, tool use, MCP interactions and multimodal inputs, with plugins for Claude Code, Codex and other MCP agents plus a rule starter pack.
Cisco says the rules do not replace chain-of-thought monitoring or human oversight.