From the Cisco edition of October 30, 2026
The Register: Cisco says Project Quarry rules are not a substitute for human oversight and were not run against the OpenAI–Hugging Face incident data
The Register (interviewing Cisco AI threat research) · AI agent security relevant to SLED agencies and universities deploying agents · Global
- Publisher
- The Register
- Original publication
- October 28, 2026
- Source retrieved
- 2026-10-31
What happened
Reporting on Cisco’s open-source Project Quarry (already archived from Cisco’s blog), The Register adds stated limits from Cisco’s researchers: they have not run Quarry against data describing the OpenAI–Hugging Face intrusion and only suggest where rules would likely have flagged steps; rules are not a substitute for chain-of-thought monitors or other human oversight; and Cisco’s head of AI threat research says, “Do we have all the answers? No.”
Why it matters
Agencies and universities piloting agents (including through Cisco MCP servers) should treat Quarry as an early, community detection layer, not a validated control. The added limitations are what is new versus the archived Cisco announcement.
Evidence and measured results
Interview-based reporting with a vendor spokesperson; hypothetical walk-through of an incident; no test results, false-positive rates or deployments.
Limitations and uncertainty
The Register relays Cisco’s statements; it did not test Quarry. Hypothetical incident mapping is not evidence of detection.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-10-31; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Agencies deploying AI agents lack ways to detect harmful multi-step agent behavior and risk over-trusting new tools.
- Stakeholders
- SOC manager
- AI governance lead
- Application owners of agent pilots
- Discovery questions
- Do you capture full agent session traces today?
- Who reviews agent actions now?
- Would alert-only evaluation be acceptable before blocking?
- Value hypothesis
- Interpretation: a low-cost Quarry trial can show whether rule-based session detection adds signal for one agent workflow.
- Potential engagement
- A two-to-four-week alert-only Quarry evaluation on one agent workflow.
- Unsupported claims
- That Quarry would have detected the Hugging Face incident
- Production-grade accuracy
- Replacement of human oversight
Pre-sales engineering
Role takeaway
- Fit
- Teams with agent pilots that can export session traces.
- Architecture and integration
- Feed agent and MCP traces to the Quarry scanner/runtime; send findings to the SIEM.
- Prerequisites
- Agent trace capture
- Python runtime per repository requirements
- Test datasets of benign and malicious traces
- Constraints
- No published accuracy data
- Rules require ongoing maintenance
- Trace data may be regulated
- Security
- Protect trace stores; redact credentials before analysis where possible.
- Proof of value
- Measure false positives on benign traces
- Confirm detection on synthetic multi-step exfiltration traces
- Verify findings preserve evidence from both linked actions
Delivery
Role takeaway
- Work
- Set up trace capture, deploy scanner in alert-only mode, tune rules, report.
- Dependencies
- Agent platform logging
- SOC analyst time
- Test data
- Ownership
- SOC, with AI governance oversight.
- Skills and adoption
- Train analysts on Quarry rule syntax and on interpreting session-level findings.
- Governance checkpoints
- Trace data privacy review
- Alert-only to blocking decision gate
- Rule-change approval process
- Acceptance criteria
- Proposed: ≥95% of agent sessions captured with tool calls
- Proposed: false-positive rate documented on benign set
- Proposed: synthetic attack sequences flagged
- Risks
- Over-reliance on rules
- Maintenance burden
- Exposure of sensitive trace data
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Quarry evaluates full agent sessions; organizations need complete, retained agent traces (tool calls, results, MCP interactions) for it to work.
Governance
Who approves, reviews and stays accountable for outcomes?
Policies should require human oversight alongside rule-based detection; open rule sharing needs review before adoption.
Security and privacy
What data, permissions and controls need testing?
Agent traces collected for detection can contain credentials and personal data and must be protected.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Writing and tuning rules requires detection-engineering skills scarce in SLED teams.
Procurement
What should contracts, pricing and exit terms secure?
Open-source availability lowers cost of trial but shifts support burden to the adopter.
Operating model
Which teams own the service once it runs?
Detection of agent misuse becomes a SOC function needing agent-trace pipelines and rule maintenance.
Publication history
- 2026-10-30Cisco · Issue 025 resources
Stable resource ID: register-cisco-quarry-limits-not-substitute-for-oversight-20261028