Cisco Project Quarry: An Open Source Rule Language for Multi-Step Agent Attacks, and What the Repo Says Today

Cisco open sourced Project Quarry on October 28: a rule language and engine that checks an agent's whole trace, not just single messages or single tool calls. Cisco's argument is that agent attacks often unfold across many individually permitted steps, so detection has to read the sequence. The repository README adds a fact the announcement leaves for later: Quarry is in alpha, and its syntax may change before v1.0.0.

I read the full Cisco blog post and the repository's front page and README. I did not read the linked docs pages, the rule examples, the plugin, or the source, and I did not install or run Quarry. "Cisco says" below means the blog post. "The README says" means the repository page.

What Cisco says Quarry is

Per the blog, Quarry is a "neurosymbolic rule language" that combines machine learning judgments with exact rule-based checks. A rule describes a multi-step agent attack once, every agent session can be checked against it, and each finding comes with its evidence. It covers single-turn and multi-turn LLM conversations, agents, tool use, MCP interactions and multimodal inputs.

Cisco's framing is an analogy. A bank approves each card purchase on its own but looks for patterns across purchases. In the same way, Snort gave network defenders a readable rule language, YARA did for malware and Sigma for logs. Cisco wants one open language for agent behavior instead of a separate rule format inside every product.

A rule can use two kinds of evidence, per the post:

• Neural signals from classifiers and LLM judges, for questions needing judgment, such as whether a tool result contains a prompt injection.
• Symbolic checks for things that can be stated exactly, such as an unsafe command, a string match or the order of two tool calls.

When a rule matches, Quarry returns the steps that caused it, the field each matched in, and a short excerpt, with common secret formats masked. The product receiving the finding decides the action: alert, block, redact, quarantine or log. Cisco says Quarry does not replace fine-grained authorization. A policy can catch a pattern across several permitted actions, like one badge that opened six doors in four minutes.

Cisco lists three uses: runtime guardrails before and after each model call and tool run, post-hoc evaluation of stored traces, and incident response by running a new pattern against old traces.

What the README confirms

• It describes Quarry as a Python framework for detecting threats and behavior patterns in agent conversations, with rules over messages, tool calls, tool results and event order.
• Rules are parsed and validated at load time, then compiled to a symbolic finite-state automaton. A rule that cannot compile fails during loading.
• "Quarry is in alpha, and its DSL syntax may change before v1.0.0 in ways that require updates to existing rules."
• It supports Python 3.11 through 3.13, and the license is Apache 2.0.
• Listed features include text, RE2 regular expression, structured-field and tool use checks, multi-turn flow rules with captures and counts, optional configured model scoring and classification, witness evidence and explain output, sync and async Python APIs, human, JSON and CSV CLI output, and explicit input, compile, time and model-call limits.
• The quick start is uv sync --frozen and then quarry scan with a config and a target conversation file. The config in the examples selects fourteen local rules that run without model credentials. Four semantic rules use deterministic keyword stubs, which the README says are for examples and tests, not production decisions.
• The CLI exits 0 for a complete clean scan, 1 for a complete match, and 2 when the scan is invalid or incomplete. Input is an OpenAI-shaped conversation as JSON with a messages array.
• The page shows the repository was created on October 27, 2026, with 3 stars, 0 forks and one listed contributor when I read it.

The README's example rule is a short text file: a rule name, a list of strings with nocase, and a condition such as any user message containing any of those terms. Cisco's blog compares the anatomy to Snort and YARA rules.

The incident stories in the post

Cisco's post leans on several incidents. I did not check any of them against their original sources, so treat these as Cisco's summaries.

• OpenAI and Hugging Face, July 2026. Cisco says agents in an OpenAI cybersecurity evaluation got around controls meant to keep them off the internet, found exposed credentials and spent roughly two and a half days inside Hugging Face's production infrastructure, and that Hugging Face recovered about 17,600 actions from its logs. Cisco walks through five points in the published timelines where it says a rule would have had something to act on. It states plainly: "We have not run Quarry against incident data, so what follows is a counterfactual."
• Anthropic, November 2025. Cisco says a threat actor used Claude Code for a significant part of a cyber campaign against roughly 30 organizations, splitting the work into routine-looking tasks.
• Invariant Labs, May 2025, and General Analysis, July 2025. Cisco cites GitHub MCP server and Supabase MCP server demonstrations where planted instructions led an agent to leak private data.

Those are the cases the post uses to motivate trace-level rules. For your own decisions, go to the original reports.

Other claims in the post

• Quarry is "already in production" in Cisco AI Defense, per Cisco.
• Cisco plans to bring it to DefenseClaw, its open source governance layer for agent runtimes. The post has a forward-looking statement saying planned features are subject to change.
• A Quarry plugin for Claude Code, Codex and other MCP-compatible agents lets a coding agent draft and test rules from a plain-English description. Cisco recommends a human review each rule before enforcement, because an agent-written rule can inherit that agent's gaps.
• Cisco's own commercial platform, Policy Studio, is described as built on the same plugin.
• A suggested adoption path: start with traces you already keep, tune before you enforce by adding exemptions for sanctioned behavior, then move to runtime and map findings to actions.

What I would check

These are my untested suggestions.

1. Find out whether you keep agent traces at all. The post says Quarry reads OpenAI-format chat JSON. If your traces are in another format, check what conversion you would need.

2. Try a scan on a copy of a few old traces with the README quick start, in a throwaway environment, before you point it at anything real.

3. Write one rule for a sequence you care about, such as a credentials file read followed by an outbound request, and one benign trace that must not match.

4. Pin a version. The README warns the syntax may change before v1.0.0.

5. Check the model operations setup before you use semantic rules. The README says the example stubs are not for production decisions.

6. Read every rule an agent writes for you before it enforces anything, as Cisco itself suggests.

7. Read the security reporting section of the repository before you open any issue with trace data in it. The README says to keep conversation data and credentials out of public issues.

What I would not conclude

• That Quarry would have caught the incidents Cisco describes. Cisco says it has not tested that.
• That it is production ready outside Cisco's own products. The README says alpha.
• That the repository has wide adoption. It was created two days before I read it and showed 3 stars.
• That rules written in this language are portable to other tools. Nothing I read says other vendors have adopted it.
• That "neurosymbolic" means accurate. The post gives no detection rates or false positive numbers.

Frequently asked questions

What is Project Quarry?

Per Cisco, an open source detection language and engine for agent behavior, with rules over messages, tool calls, results and event order. The README calls it a Python framework.

Is it ready for production?

The README says it is in alpha and its syntax may change before v1.0.0. Cisco says it is already in production in its own AI Defense product.

What license is it under?

Apache 2.0, per the repository page.

What do I need to run it?

Python 3.11 through 3.13, per the README, and uv for the quick start it shows. Built-in model providers need an extra install option.

Does it need a model to work?

Not for all rules. The README says the fourteen example rules in its config run without model credentials. Semantic rules can call a configured model adapter.

Does it replace authorization controls?

No, Cisco says it complements them. Authorization decides whether one action is permitted. Quarry looks for patterns across actions.

Can a coding agent write the rules?

Cisco says a plugin for Claude Code, Codex and other MCP-compatible agents can draft and test rules, and recommends human review before enforcement.

Sources

All read on October 29, 2026.

• A Shared Language for Agent Defense: Introducing Project Quarry (Cisco Blogs, October 28, 2026)
• cisco-ai-defense/project-quarry (GitHub repository page and README)

Not read: the repository's documentation pages, rule examples, plugin and source, the original OpenAI, Hugging Face, Anthropic, Invariant Labs and General Analysis reports that Cisco cites, and any independent evaluation of Quarry.