Cisco opens Project Quarry
On 28 October 2026 Cisco open-sourced Project Quarry, a neurosymbolic rule language and engine that check whole sessions of AI agents' work rather than single messages. A rule can require, for example, that an agent first read a credentials file and then call out within four steps. The code is published under the Apache-2.0 licence; Cisco says Quarry already runs in its AI Defense product.
Why it matters
An attempt to do for agents what Snort, YARA and Sigma did for networks, malicious files and logs: one readable rule language that can be tested, versioned and shared between teams. Until others write rules and show that they catch real attacks, this is one vendor's bid for a standard; the post itself admits that Quarry was not run against data from the Hugging Face incident and that its reading of it is a counterfactual.
What the post says. Agents read, decide and act on their own, and attacks against them unfold across many ordinary, permitted steps that most of today's defenses do not connect. Quarry is a detection language that lets a team describe a multi-step agent attack once, check every agent session against it and see the evidence behind each finding. A rule can draw on neural signals (classifiers, model judges, OCR and vision models for images) and symbolic checks (an unsafe command, a string match, the order of two tool calls). A match returns evidence: the steps, the field matched and a short excerpt with common secret formats masked. The language covers single-turn and multi-turn conversations, agents, tool use, MCP interactions and multimodal inputs. Cisco compares it with Snort, YARA and Sigma and suggests runtime guardrails, post-hoc evaluation of stored traces and incident response. What is released. The language and engine as open source; a command-line scanner; a Python SDK; a Quarry plugin for Claude Code, Codex and other MCP-compatible agents that lets a coding agent compose and test rules (Cisco recommends that a human approve each rule before enforcement); examples, documentation and a workflow for validating rules against positive and benign datasets. By the GitHub API the repository cisco-ai-defense/project-quarry is public, licensed Apache-2.0 and was created on 27 October 2026 at 22:42 UTC. Cisco says Quarry is already in production in Cisco AI Defense; the integration with DefenseClaw (its open-source governance layer for agent runtimes) and the Policy Studio platform are described as planned and subject to change. What the record does not claim. The post is a maker's announcement with no independent test and no detection-quality figures. The reading of the OpenAI and Hugging Face incident is a counterfactual: Cisco writes that it has not run Quarry against incident data. The repository's files were not read and no rule was run. The integrations named as planned are not part of the record.