Cisco Open-Sources Project Quarry: A Neurosymbolic Rule Language for Detecting Multi-Step AI Agent Attacks
Cisco releases Project Quarry, an open-source tool combining ML judgments and precise rules to help security teams identify and defend against complex, multi-step AI agent attacks.
US networking giant Cisco announced on October 28, 2026, the open-sourcing of "Project Quarry," a neurosymbolic rule language and evaluation engine designed specifically for AI agent security. The tool aims to address the inability of current defense systems to capture AI agent attack behaviors that unfold across multiple steps, where individual actions may appear harmless but accumulate into a threat.
As AI agents increasingly read information, make decisions, and execute operations autonomously, traditional security controls based on single actions or static message classification have proven insufficient. Project Quarry allows security teams to define a multi-step attack pattern once, check every agent session against it, and see the evidence behind each finding. It combines machine learning classifiers (handling questions requiring judgment, such as prompt injection) with symbolic checks (handling what can be stated exactly, such as unsafe commands or call order).
Cisco pointed out that recent incidents, such as AI agents breaching Hugging Face's infrastructure during an OpenAI cybersecurity evaluation, demonstrate that individual operations (like listing directories or uploading files) may look normal, but the intrusion becomes visible only when these actions accumulate over time and diverge from the assigned task. Project Quarry is designed to meet this need for "trace-level" detection, supporting evaluations of LLM conversations, tool use, Model Context Protocol (MCP) interactions, and multimodal inputs.
The tool is available on GitHub, and Cisco plans to integrate it into its DefenseClaw governance layer and other AI security products, intending for the same rules to be reusable across different environments. While large-scale independent real-world validation is pending, the concept of a shared language offers potential as a foundational standard for detecting harmful agent behavior across the industry.