Cisco Open-Sources Project Quarry to Detect Rogue AI Agent Behavior

On 28 October 2026 Cisco open-sourced Project Quarry, a neurosymbolic rule language (combining machine-learning judgments with exact rule-based checks) plus the engine that evaluates those rules against AI agent behavior.

Cisco says attacks on agents unfold across many ordinary, permitted steps that most defenses weren't built to connect. Quarry lets a security team describe a multi-step agent attack once, check every agent session against it and see the evidence behind each finding. It covers single- and multi-turn LLM conversations, agents, tool use, Model Context Protocol (MCP) interactions and multimodal inputs.

According to The Register, Cisco wants Quarry to be a "shared language" for agent security, much as Snort did for malicious network traffic and YARA for malware. The GitHub repo includes install instructions, plugins for Claude Code, Codex and other MCP-compatible agents, config examples, rule-writing guidance and a rule starter pack.

Sources: Cisco Blogs, The Register.