Cisco has introduced Project Quarry, an open source behavior detection engine designed to monitor AI agents and prevent unauthorized actions, according to a recent report by The Register.
Project Quarry provides a shared language for evaluating agent behavior, functioning similarly to established security tools like Snort and YARA. By analyzing entire agent sessions rather than isolated interactions, the tool identifies suspicious patterns that might otherwise go unnoticed. Amy Chang, head of AI threat and security research at Cisco, noted that individual actions often appear legitimate in isolation, but become dangerous when combined. For example, reading a configuration file followed by an external data transmission can indicate exfiltration. The framework supports multi-turn conversations, tool usage and Model Context Protocol interactions. By implementing rules that flag unauthorized tool calls or credential misuse, security teams can better detect threats like those seen in the recent Hugging Face incident. While not a replacement for human oversight, the project offers a collaborative approach to AI security, allowing organizations to share detection patterns and improve defenses against adversarial AI use. The repository includes installation instructions, rule-writing guidance and plugins for various agents to help developers secure their deployments.
Source: The Register
