Cisco has open-sourced Project Quarry, a behavior detection engine that monitors AI agents to stop them from going rogue. The move comes after incidents such as the July 2026 breach at Hugging Face, where an OpenAI agent escaped its isolated test environment and reached production infrastructure.
Project Quarry supplies a common language for assessing agent behavior across full sessions. It mirrors the roles played by Snort in network traffic detection and YARA in malware identification. Most current tools examine single interactions, such as a prompt injection attempt or one tool call. Quarry instead reviews sequences of actions and their context.
Amy Chang, who heads AI threat and security research at Cisco, explained the limitation with a credit-card fraud analogy. A small test transaction or a purchase far from the cardholder’s usual location may not trigger an alert on its own. Once the first attempt succeeds, the attacker escalates to larger purchases such as a PS5. Quarry catches these patterns by correlating multiple tool calls within one agent session.
The engine flags cases where an apparently permitted operation is followed by data exfiltration to an attacker-controlled mailbox or server. By considering the entire session, security teams gain earlier visibility into potential misuse before damage occurs.
