Overview
Cisco has open sourced Project Quarry, a rule language for detecting attacks on AI agents that only become visible across a sequence of individually harmless actions. Cisco calls it a neurosymbolic rule language, combining machine-learning judgment with deterministic rule checks.
Quarry covers single-turn and multi-turn LLM conversations, agents, tool use, Model Context Protocol (MCP) interactions, and multimodal inputs.
How Rules Work
Each rule can combine two kinds of evidence:
- Neural evidence from ML classifiers and LLM judges
- Symbolic checks such as exact conditions, sequences, string matches, and tool relationships
Cisco positions Quarry as a shared policy layer rather than a replacement for every detector or enforcement control. Intended uses are runtime guardrails for agents, post-hoc security analytics across rule sets, and incident response. It integrates with Cisco's Integrated AI Security & Safety Framework, which defines AI risks, while Quarry detects them in agent activity.
Starter Pack
| Component | Purpose |
|---|---|
| Readable DSL | Express conversations, tool use, and event relationships |
| Evaluation runtime | Compiles each rule on load, with configurable safety and resource limits |
| CLI scanner | Scan individual traces, directories, and datasets |
| Python SDK | Integrate into applications |
| Model operations | Optional configured models for semantic signals |
| Agent plugin | For Claude Code, Codex, and other MCP-compatible agents |
| Validation workflow | Test rules against positive and benign datasets |
The plugin lets a coding agent compose, compile, and refine rules from a plain-English description of an organization's risk. Cisco says a rule that passes in a coding agent should behave the same way at runtime.
Why It Matters
Many agent attacks, such as data exfiltration through a chain of permitted tool calls, never trip single-event detectors. Cisco wants Quarry to become a common, open standard for sharing AI-agent attack detections, in the way Snort, YARA, and Sigma did for their domains. Its success will depend on community adoption. The coverage reviewed did not state the license or repository location, so check Cisco's announcement before adopting it.