The behavior detection engine watches sequences of agent actions, aiming to give security teams a shared language for spotting AI agents gone wrong
Cisco has released Project Quarry as open source. It is a behavior detection engine built to keep watch over AI agents and catch the ones that start misbehaving.
Cisco is framing Quarry around a specific worry: rogue agents that go off the rails, as they did in the Hugging Face hack. Or, in the company’s framing, something worse.
What Project Quarry actually does
Most existing detection tools zero in on a single moment. They examine one specific interaction with an AI model or agent and judge whether it looks dangerous.
Quarry takes a different route. It analyzes sequences of actions rather than isolated events, looking for risky behavior that only becomes visible over time.
An agent might take a series of steps that each look harmless on their own. Strung together, those same steps could add up to data leaking out or permissions being abused.
Cisco says the goal is a “shared language” for evaluating how agents behave. Instead of every vendor and security team writing its own private definitions of suspicious activity, Quarry aims to give everyone a common vocabulary.
The Snort and YARA playbook
Cisco is explicitly modeling Quarry on two well-known security projects. The first is Snort, which Cisco also maintains, and which became a standard way to detect malicious network traffic.
The second is YARA, which did something similar for rule-based malware identification. Both projects succeeded partly because they gave defenders a common format for describing threats.
If Quarry catches on, a detection rule written by one team to flag a dangerous agent behavior could be reused by others. That is the network effect Snort and YARA built, and Cisco clearly wants a sequel.
Part of a broader Cisco push
Quarry does not arrive alone. Cisco has rolled out several open-source security tools for AI agents under its AI Defense initiative across late 2025 and 2026.
That lineup includes the A2A Scanner, DefenseClaw, MCP Scanner and Skill Scanner. Each is aimed at improving how organizations detect problems in, and govern, autonomous AI operations.
The tools share a common thread. They rely on behavioral analysis techniques, including heuristics and static and dynamic inspection, focusing on patterns of behavior, mismatches in intent, and how agents communicate.
The Hugging Face incident served as a catalyst for Cisco’s attention to rogue agent risk.
Why this matters for security teams
The core problem Quarry addresses is visibility. Organizations are handing AI agents access to systems, data and tools, and those agents can take actions without a human approving every step.
For security teams, an open-source engine has practical appeal. They can inspect how it works, adapt it to their own environments, and contribute rules back.
