Cisco open sources tool for detecting AI agents on hacking sprees

Cisco released Project Quarry, an open source engine that scores entire AI agent sessions instead of isolated actions, so security teams can flag credential theft and exfiltration as connected sequences. Cisco frames it as a shared rule language for agent behavior, in the vein of Snort and YARA.

Cisco open sourced a behavior detection engine called Project Quarry that watches AI agents across whole sessions, aiming to stop rogue agents from turning legitimate-looking steps into data theft like the Hugging Face intrusion.

The tool gives security teams a rule format for describing agent behavior and a Python engine that evaluates those rules against session traces. Cisco compares it to Snort , the network intrusion detector it also maintains, and to YARA , the rule-based malware identifier. Both gave defenders a common vocabulary for describing what they look for. Quarry aims to do the same for agent behavior.

Most agent security tools inspect one moment at a time: did the model take the bait on a prompt injection, or did it reach for an attack tool?

"But what is missing is the entire context under which something may occur," Amy Chang, head of AI threat and security research at Cisco, said.

Chang compared the gap to credit card fraud detection. A small test charge, or one purchase in a city far from the cardholder's usual pattern, may pass unnoticed on its own. "And then you try again," making another fraudulent purchase, "and that went through, too. So now I'm gonna buy the PS5," Chang said. "Those are the things that Quarry addresses by taking into consideration the entire agent session."

A single tool call can look in-scope until the step ships that data to an attacker-controlled inbox or server, Chang said.

Data theft runs as a chain, not a single action. Agentic security firm Invariant Labs showed that with a proof-of-concept attack against GitHub's MCP server, where a malicious GitHub Issue hijacked a user's agent and coerced it into leaking data from private repositories. Reading a configuration file counts as normal agent work. Sending a request to an external endpoint counts as normal agent work. Combine them and you have exfiltration.

Quarry's rules capture that link. Chang and fellow Cisco researchers Adam Swanda, Ravikumar Balakrishnan, and Konstantin Berlin described the mechanics in a blog post shared with The Register: "A policy can produce a finding when the trace shows a sensitive file read followed within a defined window by an external send. The risk comes from the relationship between the two actions, so the finding should preserve evidence from both."

The rule syntax borrows from YARA and Snort. A header names the traffic to examine, content fields hold the pattern to match, and metadata tags let teams track rules across deployments. Here's a Quarry rule that flags an agent reading a credentials file:

The engine handles single-turn and multi-turn large language model conversations, agent tool use, Model Context Protocol interactions, and multimodal inputs. The GitHub repository ships with installation instructions, supported Python versions, plugins for Claude Code, Codex and other MCP-compatible agents, configuration examples, rule-writing guidance, and a starter pack of rules.

One starter rule blocks base64-encoded malware sitting anywhere inside a tool call, Chang said.

The Cisco researchers have not run Quarry against traces from the OpenAI-Hugging Face incident. They argued that several moments in the intrusion would have given a rule something to flag if the intrusion had been recorded as one continuous session.

OpenAI's technical report on the intrusion describes July 10, when an agent validated 14 exposed Hugging Face tokens with write access and passed them along. Quarry would likely have flagged the sandbox reaching the internet and the credentials resurfacing later, Chang said.

"The rule can flag specific tool calls that reach an external server asset that wasn't in the task's allow list," Chang said. "Another one would be credentials found and used somewhere else."

"We don't want you to go and for credentials that may have been leaked or inadvertently exposed and then utilize them to conduct a task," Chang added.

Rules reach a ceiling

The Cisco team says rules alone don't replace chain-of-thought monitors or human review. What they do is write down a pattern, so another team can review it, test it, and apply it to their own agents instead of starting from a blank page.

Chang framed the release as one contribution among many. "Do we have all the answers? No," Chang said. "We all see slices of the problem, and it's important for us to what we see."

Agent deployments keep widening across CI pipelines, ticketing systems, and code hosts, and each integration hands the agent another credential and another network path. Sessions get longer, tool calls get more numerous, and the moment where a human could spot trouble in a log moves past attention span. A shared rule language lets teams publish detections the way Snort rules and YARA rules circulated: copied, adapted, and argued over in public.

For homelab and enterprise defenders alike, the practical first step is uneventful. Install Quarry, point it at session traces from the agents you already run, and write one rule for the boundary you care most, such as which servers an agent may call after it reads a secrets file. The rule pack gives you a starting set, and the engine does the correlating your log review won't do by eye.

Source : theregister.com