Radar / AI security / Cisco Project Quarry

Cisco Project Quarry: open-source behavior detection engine for AI agents

Cisco open-sourced Project Quarry on 28 Oct 2026: a behavior detection engine that watches AI agents at the session level and flags risky sequences with Snort/YARA-style rules, rather than judging single tool calls in isolation. It covers LLM conversations, agents, tool use, MCP interactions, and multimodal inputs, ships a rule starter pack plus plugins for Claude Code, Codex, and other MCP-compatible agents, and is motivated by the July 2026 incident in which an agent validated 14 exposed Hugging Face tokens.

new launchsecurity · complianceJEV traction 0.42added 2026-10-28

Open Cisco Project Quarry →View on the radar

Why it matters

A shared, rule-based language for agent behavior: a sensitive file read followed by an external send is flagged as one finding with evidence from both actions, catching exfiltration patterns that per-call checks miss.

What you could build with it

A platform team running customer-facing coding agents could feed agent session traces through Quarry rules to flag credential reads followed by external sends before they become incidents, instead of reviewing raw logs after the fact.

Does it hold up?

Too early to judge: announced today with no independently verified deployments yet, and the repository was not public under Cisco's AI Defense org at check time, so the design is credible but unproven in production.

Built with Cisco Project Quarry

Cisco open sources tool for detecting AI agents on hacking spreesarticle · The Register's exclusive: session-level rules, the credentials-file rule example, the Hugging Face incident motivation, and Cisco's caveat that rules do not replace human oversight.

Learn more

news coverage →

First spotted on article: source.

More AI security

iFixAi: independent auditing of AI agentsIndependent AI-agent auditor: 250+ inspections across 69 misalignment categories (red teaming + operational assurance)…security · JEV 0.76NVIDIA SkillSpector: security scanner for AI agent skills, trending againNVIDIA's open-source SkillSpector scanner is trending on GitHub today: it audits AI agent skills before installation…security · JEV 0.75Cloudflare security-audit-skill: six-phase agent-driven security audits with independently verified findingsOpen-source MIT coding-agent skill that runs a codebase through six audit phases — reconnaissance, coverage-led…security · JEV 0.74OpenAI, Anthropic and Google DeepMind jointly unveil cyber-focused safety models and safeguardsThe three rival labs disclosed weeks of behind-the-scenes coordination and jointly released a set of cyber-focused AI…security · JEV 0.73OpenAI textGrain watermarking for ChatGPT and Codex in the EUOpenAI will roll out its invisible textGrain watermarking system to ChatGPT/Codex users in the EU over the coming…security · JEV 0.65Cloudflare security-audit-skill: multi-phase security audits for coding agentsA coding-agent skill that runs multi-phase security audits with independently verified, machine-checkable findings.security · JEV 0.63

Get the week's best AI launches, plus 3 ideas worth building

One email every Saturday. Ranked by traction, not hype. Free.