AI 보안 · AI 에이전트기타 산업 (software / AI security tooling)
시스코가 AI 에이전트 공격을 탐지하는 규칙 언어 '프로젝트 쿼리(Quarry)'를 오픈소스로 공개했다.
출처 [1] SecurityWeek · 2026년 10월 29일 · “Cisco Open Sources Quarry to Catch AI Agent Attacks Hidden in Harmless Steps” ↗
도입 단계: 연구 — Paper, lab demo or benchmark — no named operator using it.
요약
시스코가 AI 에이전트 공격을 탐지하는 규칙 언어 '프로젝트 쿼리(Quarry)'를 오픈소스로 공개했다. ML 분류기와 LLM 판정의 신경적 근거에 조건·순서·문자열·툴 관계를 검사하는 기호 규칙을 결합한 신경기호 규칙 언어로, 단일·다중 턴 LLM 대화, 에이전트, 툴 사용, MCP 상호작용, 멀티모달 입력을 다루며 런타임 가드레일·사후 분석·사고 대응에 쓰인다. 기사는 2025년 Claude Code가 약 30개 조직과 멕시코 정부기관 공격에 쓰였고 공격이 평범해 보이는 작은 작업들로 쪼개졌다고 적었으며, 시스코는 쿼리가 Snort·YARA·Sigma처럼 공개 표준이 되길 바라고 허깅페이스가 약 17,600개 에이전트 행동을 사후 재구성했다는 사례를 들었다.
Kenny의 관점
이 도구가 겨누는 것은 "나쁜 한 수"가 아니라 "하나하나는 허용된 수의 나쁜 순서"다. 에이전트 공격이 평범한 작은 작업으로 쪼개진다는 점을 시스코 스스로 2025년 사례로 들었다. 단계는 연구다 — 시스코 외에 쓰는 조직이 기사에 없다. 이름 있는 운영사나 다른 보안 벤더가 쿼리 규칙을 공유하기 시작하면 시범 적용(PoC)으로 올리고, 1년 뒤에도 시스코 혼자면 표준이 되겠다는 말은 말로 남는다.
AI 초안 · Kenny 검토 승인
분석 (영문)
Stage: research. This is a vendor open-source release; the source names no organisation other than Cisco that has adopted Quarry, so under the taxonomy rule it stays at research until a named adopter appears.
For the pattern agent-attack-sequence-detection, the design point is that detection is applied to sequences of individually permitted agent actions rather than to single actions, with rules that mix ML/LLM judgement and exact symbolic conditions. The source frames the need with the 2025 Claude Code campaigns (around 30 organisations; Mexican government institutions) in which the attack was split into routine-looking tasks, and with Hugging Face's after-the-fact reconstruction of roughly 17,600 agent actions.
For q-ai-defence-direction, the source states Cisco's intent for Quarry to become a shared detection standard in the way Snort, YARA and Sigma did; whether other vendors or operators pick it up is not in the source. Nothing in the article touches operational technology, ships, plants or grids, so it adds no direct evidence to q-agent-security-ot.
원문에서 확인한 사실 (영문)
- F1Cisco open sourced Project Quarry, which it describes as "a neurosymbolic rule language, combining machine learning judgment with rule-based checks"; it "covers single-turn and multi-turn large language model (LLM) conversations, agents, tool use, Model Context Protocol (MCP) interactions, and multimodal inputs". [1]
- F2Each rule "draws on neural evidence from ML classifiers and LLM judges, and symbolic rules that check exact conditions, sequences, string matches, and tool relationships"; it is "designed to provide a shared policy layer rather than be a replacement for every detector or every enforcement control". [1]
- F3Quarry can provide "runtime guardrails on agents, post-hoc rule set security analytics, and incident response", and integrates with Cisco's Integrated AI Security & Safety Framework as its policy and evaluation layer. [1]
- F4The article says that in 2025 Claude Code was used by bad actors in two campaigns, "one against around 30 organizations, and a second against Mexican government institutions", and that the former "was split into small routine-looking tasks" whose intent only became apparent in sequence. [1]
- F5A Quarry Plugin "allows a coding agent to compose, compile, and refine rules from a plain-English description of an organization's risk"; the starter pack includes a DSL, an evaluation runtime, a command-line scanner, a Python SDK, and a plugin "for Claude Code, Codex and other MCP-compatible agents". [1]
- F6Cisco: "Hugging Face reconstructed roughly 17,600 agent actions after the fact"; Quarry is "intended to become a common, open standard for expressing and sharing detections for AI-agent attacks, much as Snort, YARA, and Sigma became standards". [1]
언급된 조직: Cisco
반론 — Codex 검증 메모
Codex가 각 문장을 원문과 대조하고 반대 증거를 찾은 기록입니다 (영문 원문). 판정: Codex 검증 · 부분 일치.
- 반대 증거Cisco says Quarry is already in production in its AI Defense product, though it names no external operator. The source-of-record article does not establish a named operator using it. [2]
- 반대 증거Mexico’s tax authority and electoral institute reported finding no evidence of breaches, and Jalisco denied a breach. This qualifies claims of successful compromise, though the signal says the institutions were targeted. [3]
문장별 검증 메모 7건
- summary_enpartly-supported: Both cited Claude Code campaigns were split into small routine-looking tasks. — The article attributes that tactic only to the former, approximately 30-organisation campaign.
- summary_kopartly-supported: Both cited Claude Code attacks were divided into ordinary-looking small tasks. — As in the English summary, the wording extends a detail reported only for the first campaign to both.
- analysispartly-supported: The 2025 Claude Code campaigns were split into routine-looking tasks. — The source specifies the former campaign.
- takepartly-supported: Cisco’s 2025 examples show agent attacks being chopped into routine-looking tasks. — The English Take generalises a tactic documented for only the first campaign.
- takepartly-supported: 시스코 스스로 2025년 사례로 에이전트 공격이 평범한 작은 작업으로 쪼개진다는 점을 들었다. — The Korean Take likewise generalises the first campaign’s tactic to the examples collectively.
- takeunsupported: Sharing Quarry rules by a named operator or another vendor moves it to pilot. — The taxonomy requires a named organisation trialling Quarry on real data within a bounded scope or time; sharing rules alone does not meet that rule.
- takeunsupported: 이름 있는 운영사나 다른 보안 벤더가 쿼리 규칙을 공유하기 시작하면 시범 적용으로 올린다. — The Korean Take has the same pilot-stage error: rule sharing alone is insufficient under the taxonomy.
출처
- [1] SecurityWeek — “Cisco Open Sources Quarry to Catch AI Agent Attacks Hidden in Harmless Steps” 원문
- [2] blogs.cisco.com 반대 증거 (Codex)
- [3] latimes.com 반대 증거 (Codex)
이어 읽기
Stay in the loop.