Cisco Open-Sources Project Quarry, a Snort-Style Rule Language for AI Agent Behavior
Cisco has open-sourced Project Quarry, a detection rule language and engine that spots risky multi-step AI agent behavior across a whole session, such as reading credentials and then sending data out.
Rules look like Snort or YARA, and plugins for Claude Code and Codex are included.
A single tool call can look perfectly fine. The trouble usually shows up in the step that follows. Cisco's newly open-sourced Project Quarry is aimed at exactly that kind of attack, one stitched together from ordinary-looking actions.
Quarry is a detection rule language plus the engine that evaluates it. Cisco says it wants Quarry to become a shared foundation for spotting harmful or disallowed agent behavior, much as Snort did for network traffic and YARA did for malware.
Rules that read the whole session
Amy Chang, Cisco's head of AI threat and security research, told The Register to think of credit card fraud: a small test charge, then another, then the big purchase, and none of them looks alarming alone. Agents work the same way. One tool call may seem in scope until the next step sends what it found to an attacker-controlled inbox or server. Quarry's answer is to judge the entire session.
The format is deliberately familiar to security engineers, similar to YARA or Snort, with a section for what to inspect, conditions to match and metadata for tracking. Cisco says a rule can combine two kinds of evidence: exact symbolic checks, such as a command, a string or the order of two tool calls, and semantic judgments from classifiers or LLMs, such as whether a tool result hides a prompt injection. When a rule matches, the engine returns the steps and an excerpt, with common secret formats masked.
What you get out of the box
According to Cisco, the open-source release includes the rule DSL, an evaluation runtime, a command-line scanner, a Python SDK, a starter rule pack, and plugins for Claude Code, Codex and other MCP-compatible agents. Teams can start by pointing the scanner at traces they already keep, review the matches, and tune before enforcing anything.
Cisco is also clear that rules are no substitute for chain-of-thought monitoring or human oversight. Their value is in capturing known patterns that other teams can review, test and reuse. With more companies letting agents touch code and credentials, a shared language like this may matter more than any single detector.