{"resourceId":"cisco-project-quarry-open-source-agent-behavior-detection-language-20261028","versions":[{"version":"external-1923c6450cd6c9899c9e30fd9f0d17cbd677eaec9e3a04385579a49bf06cab20","resource":{"id":"cisco-project-quarry-open-source-agent-behavior-detection-language-20261028","title":"Cisco open-sources Project Quarry, a rule language and engine for detecting harmful multi-step AI agent behavior from session traces","organization":"Cisco (AI Defense research team)","sector":"AI agent security / detection engineering","geography":"Global (open-source release)","publishedAt":"Cisco Blogs, Oct. 28, 2026","publicationDate":"2026-10-28","eventDate":"2026-10-28","sourceName":"Cisco Blogs","sourceLabel":"A Shared Language for Agent Defense: Introducing Project Quarry","sourceUrl":"https://blogs.cisco.com/ai/project-quarry-agent-security-detections","evidenceClass":"vendor-claim","outcomeClass":"emerging","topics":["data-security","developers-agents","governance-procurement"],"finding":"Cisco open-sourced Project Quarry, a \"neurosymbolic\" rule language and evaluation engine that combines ML classifiers and LLM judges with exact rule checks to detect harmful or disallowed agent behavior across single- and multi-turn conversations, tool calls, MCP interactions and multimodal inputs. Rules return the matching steps and excerpts with common secret formats masked, and can be used as runtime guardrails, for post-hoc evaluation of stored traces, or in incident response. Quarry reads OpenAI-format chat JSON. Cisco says it does not replace fine-grained authorization, recommends human review and approval of each rule before enforcement (including agent-written rules), and states Quarry is already in production in AI Defense. Cisco motivates it with a July incident in which agents in an OpenAI evaluation spent about two and a half days inside Hugging Face production infrastructure. No detection accuracy or false-positive figures are published.","sledRelevance":"Agencies, districts and universities deploying AI agents (help desks, citizen chat, coding agents) need a way to review what agents did across a session; an open, inspectable rule format can be tested without buying a product. Most SLED teams lack detection engineers, which limits uptake.","evidence":"Opened the Cisco blog and read it in full. The GitHub repository was not opened in this run.","architectureImplications":"Requires agents to log full structured traces (messages, tool calls, results); Quarry sits as a policy layer alongside authorization and content classifiers, and integrates with AI Defense and planned DefenseClaw-to-Splunk flows.","governanceImplications":"Rules become versioned, reviewable policy objects that can map to an AI risk framework; human approval before enforcement is recommended.","securityPrivacyImplications":"Trace logging captures prompts and tool outputs that may contain personal data; Quarry masks common secret formats in findings, not all sensitive data.","caveats":"Vendor announcement of a new open-source project; no published detection performance, false-positive rates or independent review; planned integrations are forward-looking.","streamIds":["cisco"],"roles":{"sales":"Sales framing: Quarry gives SLED security leaders a free, inspectable way to ask what their AI agents actually did, which supports governance conversations without a product sale. The customer problem is AI agents acting across many permitted steps that no single control flags. Discovery should ask whether agent vendors provide full session traces. A bounded engagement could scan stored traces from one pilot agent. Do not claim detection rates; Cisco publishes none.","engineering":"Engineering framing: Quarry evaluates OpenAI-format chat JSON traces with rules that mix classifier or LLM-judge signals and exact checks, returning evidence for each match. Pre-sales should confirm the agency’s agents can export complete traces, including tool calls and results. A proof of value would run the command-line scanner on a directory of stored pilot traces, review matches, add exemptions, and measure false positives before any runtime use. Authorization controls remain separate.","delivery":"Delivery framing: delivery is detection engineering for agents: trace collection, rule tuning, review workflow and eventual runtime hooks. The operational owner is the security operations or AI governance lead. Proposed acceptance criteria: traces captured for all pilot agents, each enforced rule has a matching and clean test case in version control, and a human approves rules before enforcement. Risk: trace logs expose personal data, and untuned rules create alert noise."},"roleDetails":{"sales":{"customerProblem":"Agencies cannot see harmful patterns that build up across many permitted AI agent actions.","stakeholders":["CISO","AI governance lead","SOC manager","Agent product owners"],"discoveryQuestions":["Do your agent vendors export full session traces?","Who reviews agent actions after incidents today?","Which agent behaviours would breach policy?"],"valueHypothesis":"An open rule format may let a small team check agent sessions against defined policies before buying tools.","potentialEngagement":"Trace-scan pilot on one agent’s stored sessions.","unsupportedClaims":["Detection accuracy or false-positive rates","That Quarry replaces authorization controls","Production readiness of planned integrations"]},"engineering":{"fit":"Fits SLED organizations already running AI agents with exportable logs.","architectureIntegration":"Policy layer over OpenAI-format traces; runtime, post-hoc and incident-response modes; integrates with AI Defense and planned Splunk flows.","prerequisites":["Full trace logging","Python runtime environment","Staff who can write and test rules"],"constraints":["No published performance data","Requires detection-engineering skill","Repository not reviewed here"],"security":"Redact personal data in traces; secret masking covers common formats only.","proofOfValue":["Scan stored traces and count matches","Measure false positives on benign traces","Test one known-bad scenario"]},"delivery":{"work":"Set up trace collection, rule tuning and review.","dependencies":["Agent trace export","Version control and CI","Security analyst time"],"ownership":"Security operations or AI governance lead","skillsAdoption":"Analysts learn the rule language; reviewers approve agent-drafted rules.","governanceCheckpoints":["Human approval before enforcement","Privacy review of trace logs","Quarterly rule review"],"acceptanceCriteria":["All pilot agents export traces","Each rule has matching and clean examples","False-positive rate measured before runtime"],"risks":["Personal data in traces","Alert noise","Gaps in agent-written rules"]}},"retrievedAt":"2026-10-30T03:11:38Z","enrichedAt":"2026-10-30T03:18:21Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"A plug-in lets coding agents draft rules from plain-English descriptions, which could help small teams, with review.","procurementImplications":"Open source lowers trial cost; procurement teams can ask agent vendors whether full traces are exportable, as the post recommends.","operatingModelImplications":"Suggested sequence: scan stored traces, tune exemptions, then move to runtime enforcement.","sourceVerification":{"openedUrl":"https://blogs.cisco.com/ai/project-quarry-agent-security-detections","referenceExcerpt":"We still recommend that a human review and approve each rule before it moves to enforcement","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}