A Shared Language for Agent Defense: Introducing Project Quarry

AI agents now read, decide, and act on their own, and the attacks against them unfold across many ordinary, permitted steps that most of today’s defenses were not built to connect. Project Quarry (“Quarry”), which we are open sourcing today, is a detection language built from the ground up for that problem. It lets a security team describe a multi-step agent attack once, check every agent session against it, and see the evidence behind each finding. We designed Quarry to become the shared foundation for detecting harmful or disallowed agent behavior, both at Cisco and across the security community. In July, AI agents running in an OpenAI cybersecurity evaluation got around the controls meant to keep them off the internet, found exposed credentials, and spent roughly two and a half days inside Hugging Face’s production infrastructure. Hugging Face later recovered about 17,600 of the agents’ actions from its logs. Most were unremarkable on their own: list a directory, upload a file, make a web request, run a command. The intrusion became visible only in how those actions accumulated over time and diverged from the task the agents had been given. That incident was extreme, but the pattern behind it shows…