Cisco open-sourced Project Quarry, a behavior detection engine for AI agents. The goal is a “shared language” for agent behavior, like Snort (which Cisco also maintains) did for network traffic and YARA did for malware.
Why it’s different
Most tools look at single events: a prompt injection, a call to an attack tool. Quarry looks at the whole session. Cisco’s Amy Chang compared it to card fraud: one small charge looks fine until you see the pattern. Reading a config file is fine, and so is sending a request out, but a sensitive file read followed by an external send within a set window is how exfiltration happens.
What’s in it
- Coverage for single- and multi-turn LLM chats, agents, tool use, MCP interactions and multimodal input.
- Snort/YARA-style rules, a starter rule pack and rule-writing guidance.
- Plugins for Claude Code, Codex and other MCP-compatible agents.
My take
Session-level detection is exactly what agent security has been missing. If you run agents, it’s worth a look. Read the repo and test it in a lab before you wire it into anything.
God Bless, and Happy hacking!
