What happened
Cisco announced Project Quarry on October 28, 2026, describing it as an open-source detection language for AI-agent security. The project is intended for cases in which an attack emerges through a sequence of individually ordinary and permitted actions rather than through one clearly malicious prompt, tool call, or model response. Cisco says a security team can describe such a multi-step pattern once, apply it to every agent session, and receive evidence for any finding.
The company frames the relevant unit of observation as a trace: the step-by-step record of what an agent saw, said, and did, plus its interactions with the environment. Its example is a chain in which an agent receives an untrusted instruction through a tool result and then executes a shell command, or reads a sensitive file and subsequently sends a request to an external destination. A classifier operating on isolated messages and an authorization layer allowing or denying individual actions can still be useful, Cisco says, but neither alone establishes coverage for behavior that only becomes risky across a session.
Quarry is a neurosymbolic policy language and an engine that evaluates those policies. A rule can combine neural signals from machine-learning classifiers or LLM judges with symbolic checks. Cisco positions the former for judgments such as whether a tool result contains prompt injection, and the latter for exact conditions such as an unsafe command, a string match, or the ordering of two tool calls. OCR and vision models can also contribute neural signals for images. Rules specify the data to inspect, signals to run, their combination, exemptions, and the condition that constitutes a match.
The project covers single-turn and multi-turn LLM conversations, agents, tool use, Model Context Protocol interactions, and multimodal inputs. It retains event structure, including a tool name, arguments, result, and metadata, so a policy can examine either an individual event or a full session. On a match, Quarry returns the steps, matching fields, and a short excerpt; Cisco says common secret formats are masked. The receiving product can then alert, block, redact, quarantine, or log. Cisco lists runtime guardrails around model calls and tool runs, post-hoc analysis of stored traces, and incident-response searches over historical traces as intended uses.
What the archive adds
We have not covered Quarry before; it opens a new thread. It is adjacent to Cloudflare links vulnerability discovery to defense with OpenAI, which documented an operational security use case, and Measuring LLMs' impact on N-day exploits, which showed why AI-assisted exploit capability raises the value of stronger defenses.
Trend signal
This supports the pattern that agent security moves to runtime boundaries. Quarry does not itself enforce every boundary: Cisco explicitly presents it as a policy and evaluation layer rather than a replacement for detectors or controls. But it makes runtime traces, tool results, session context, and evidence-bearing rules the place where a defender can recognize risky agent behavior.
Connections to other events
The Cloudflare case focused on using AI in vulnerability discovery and defense, while the N-day exploit report described models producing working exploits from recent patches. Quarry addresses a different point in that security chain: observing the behavior of deployed agents that can read, invoke tools, and act over time. The connection is not that Quarry prevents either reported outcome, but that it supplies a detection mechanism for agent execution itself.
Why it matters
Many agent deployments already log tool calls, model messages, and execution results, but raw logs do not automatically yield a reusable definition of dangerous behavior. Quarry proposes a versionable policy layer over those records. That could let a security team turn an observed incident pattern into a rule, test it against old traces, and apply it to later sessions without reducing the problem to keyword filtering.
The practical implication is architectural. Teams should distinguish permissioning an action from detecting a hazardous sequence of allowed actions. An agent may be allowed to read a repository, call a browser, and execute a command, while the combination remains inappropriate for its assigned task. Evidence attached to a finding also matters: an alert that identifies the relevant steps and fields is more reviewable than a score with no trace context. Open sourcing creates the possibility of shared policies, but that value depends on rule quality, integration, and operational adoption.
What happens next
- Security teams will begin testing trace-level rules alongside per-tool authorization controls. (6 months, 65%). Watch for: integrations that evaluate rules around agent and tool execution.
- Reusable rule sets for prompt injection and agent overreach will emerge if Quarry gains users beyond Cisco. (12 months, 45%). Watch for: community-maintained policy repositories and published detection coverage.
Limits and uncertainty
Cisco's announcement establishes the design and intended uses of Quarry, not its detection accuracy, latency, false-positive rate, or adoption by independent teams. It does not provide benchmark results comparing Quarry with standalone classifiers, authorization systems, or other agent-security products. Nor does it establish which integrations are available now, how rules are distributed or governed, or whether organizations can safely use LLM judges for high-stakes blocking decisions. A rule that correctly identifies a suspicious sequence can still be difficult to tune when legitimate workflows have similar traces.
Skill to build now
Create a small trace-review exercise for one production-like agent this week. Pick a workflow that can read data and call tools, then write down two sequences that should trigger review even though every individual action is permitted: for example, reading a credential-bearing file followed by an outbound request, or a tool result introducing new instructions followed by command execution. Ensure your logs preserve tool names, arguments, results, session order, and the task boundary. That gives a future policy engine—and a human reviewer—enough evidence to reason about the sequence.
Reader takeaway
Agent security cannot be reduced to spotting one bad message or denying one sensitive call. Project Quarry is an open attempt to make multi-step agent behavior expressible, inspectable, and reusable as security policy. Builders should treat complete, structured execution traces as a prerequisite for detecting the failures that emerge only across a session.
Open question
Can an open rule language develop portable, high-quality detection packs without making teams dependent on opaque LLM-judge decisions or intolerable false positives?