AI security · AI agentOther industries (software / AI security tooling)
Cisco has open-sourced Project Quarry, a neurosymbolic rule language for detecting AI-agent attacks: rules combine neural evidence from ML classifiers and LLM judges with symbolic checks on conditions, sequences, string matches and tool relationships, across single- and multi-turn LLM conversations, agents, tool use, MCP interactions and multimodal inputs, for runtime guardrails, post-hoc analytics and incident response.
Source [1] SecurityWeek · 29 Oct 2026 · “Cisco Open Sources Quarry to Catch AI Agent Attacks Hidden in Harmless Steps” ↗
Adoption stage: Research — Paper, lab demo or benchmark — no named operator using it.
Summary
Cisco has open-sourced Project Quarry, a neurosymbolic rule language for detecting AI-agent attacks: rules combine neural evidence from ML classifiers and LLM judges with symbolic checks on conditions, sequences, string matches and tool relationships, across single- and multi-turn LLM conversations, agents, tool use, MCP interactions and multimodal inputs, for runtime guardrails, post-hoc analytics and incident response. The article cites 2025 campaigns in which Claude Code was used against around 30 organisations and against Mexican government institutions, split into small routine-looking tasks. Cisco wants Quarry to become an open standard like Snort, YARA and Sigma, and points to Hugging Face reconstructing roughly 17,600 agent actions after the fact as the kind of sequence it aims to catch in progress.
Kenny's take
What this tool aims at is not one bad action but a bad sequence of individually allowed actions; Cisco's own 2025 examples show agent attacks being chopped into routine-looking tasks. The stage is research — the article names no user other than Cisco. It moves to pilot when a named operator or another security vendor starts sharing Quarry rules; if a year from now it is still Cisco alone, the standard ambition stays an ambition.
AI draft · approved by Kenny
Analysis
Stage: research. This is a vendor open-source release; the source names no organisation other than Cisco that has adopted Quarry, so under the taxonomy rule it stays at research until a named adopter appears.
For the pattern agent-attack-sequence-detection, the design point is that detection is applied to sequences of individually permitted agent actions rather than to single actions, with rules that mix ML/LLM judgement and exact symbolic conditions. The source frames the need with the 2025 Claude Code campaigns (around 30 organisations; Mexican government institutions) in which the attack was split into routine-looking tasks, and with Hugging Face's after-the-fact reconstruction of roughly 17,600 agent actions.
For q-ai-defence-direction, the source states Cisco's intent for Quarry to become a shared detection standard in the way Snort, YARA and Sigma did; whether other vendors or operators pick it up is not in the source. Nothing in the article touches operational technology, ships, plants or grids, so it adds no direct evidence to q-agent-security-ot.
Facts from the source
- F1Cisco open sourced Project Quarry, which it describes as "a neurosymbolic rule language, combining machine learning judgment with rule-based checks"; it "covers single-turn and multi-turn large language model (LLM) conversations, agents, tool use, Model Context Protocol (MCP) interactions, and multimodal inputs". [1]
- F2Each rule "draws on neural evidence from ML classifiers and LLM judges, and symbolic rules that check exact conditions, sequences, string matches, and tool relationships"; it is "designed to provide a shared policy layer rather than be a replacement for every detector or every enforcement control". [1]
- F3Quarry can provide "runtime guardrails on agents, post-hoc rule set security analytics, and incident response", and integrates with Cisco's Integrated AI Security & Safety Framework as its policy and evaluation layer. [1]
- F4The article says that in 2025 Claude Code was used by bad actors in two campaigns, "one against around 30 organizations, and a second against Mexican government institutions", and that the former "was split into small routine-looking tasks" whose intent only became apparent in sequence. [1]
- F5A Quarry Plugin "allows a coding agent to compose, compile, and refine rules from a plain-English description of an organization's risk"; the starter pack includes a DSL, an evaluation runtime, a command-line scanner, a Python SDK, and a plugin "for Claude Code, Codex and other MCP-compatible agents". [1]
- F6Cisco: "Hugging Face reconstructed roughly 17,600 agent actions after the fact"; Quarry is "intended to become a common, open standard for expressing and sharing detections for AI-agent attacks, much as Snort, YARA, and Sigma became standards". [1]
Organisations: Cisco
Counterpoint — verification notes
Codex checked each sentence against the source and searched for counter-evidence. Verdict: Codex check · partly supported.
- Other sideCisco says Quarry is already in production in its AI Defense product, though it names no external operator. The source-of-record article does not establish a named operator using it. [2]
- Other sideMexico’s tax authority and electoral institute reported finding no evidence of breaches, and Jalisco denied a breach. This qualifies claims of successful compromise, though the signal says the institutions were targeted. [3]
7 sentence-level checks
- summary_enpartly-supported: Both cited Claude Code campaigns were split into small routine-looking tasks. — The article attributes that tactic only to the former, approximately 30-organisation campaign.
- summary_kopartly-supported: Both cited Claude Code attacks were divided into ordinary-looking small tasks. — As in the English summary, the wording extends a detail reported only for the first campaign to both.
- analysispartly-supported: The 2025 Claude Code campaigns were split into routine-looking tasks. — The source specifies the former campaign.
- takepartly-supported: Cisco’s 2025 examples show agent attacks being chopped into routine-looking tasks. — The English Take generalises a tactic documented for only the first campaign.
- takepartly-supported: 시스코 스스로 2025년 사례로 에이전트 공격이 평범한 작은 작업으로 쪼개진다는 점을 들었다. — The Korean Take likewise generalises the first campaign’s tactic to the examples collectively.
- takeunsupported: Sharing Quarry rules by a named operator or another vendor moves it to pilot. — The taxonomy requires a named organisation trialling Quarry on real data within a bounded scope or time; sharing rules alone does not meet that rule.
- takeunsupported: 이름 있는 운영사나 다른 보안 벤더가 쿼리 규칙을 공유하기 시작하면 시범 적용으로 올린다. — The Korean Take has the same pilot-stage error: rule sharing alone is insufficient under the taxonomy.
Sources
- [1] SecurityWeek — “Cisco Open Sources Quarry to Catch AI Agent Attacks Hidden in Harmless Steps” original
- [2] blogs.cisco.com counter-evidence (Codex)
- [3] latimes.com counter-evidence (Codex)
Keep reading
Stay in the loop.