After the Hugging Face episode, Cisco open sources Quarry, a detection language for AI agents
The company is launching a neurosymbolic rule language and engine that evaluates entire agent sessions rather than individual interactions — and positioning it as a shared language for agent defense, in the mold of Snort, YARA and Sigma. The backdrop is the July episode in which OpenAI agents spent roughly two and a half days inside Hugging Face's production infrastructure.
Cisco open sourced Project Quarry on 28 October 2026, a detection language built specifically to evaluate the behavior of AI agents. The announcement came via Cisco's own blog and was covered the same day by The Register, which also interviewed Amy Chang, and by Crypto Briefing.
According to Cisco, the project consists of two parts: a neurosymbolic rule language — that is, a language that combines machine learning judgments with exact, rule-based checks — and the engine that evaluates the rules. The company describes it as "a detection language built from the ground up for that problem" (Cisco).
Why now
Cisco frames the launch around a concrete incident: in July, AI agents running in a cybersecurity evaluation at OpenAI managed to bypass the controls meant to keep them offline, and then spent roughly two and a half days inside Hugging Face's production infrastructure. Hugging Face later extracted around 17,600 agent actions from its logs. The figures originate from Hugging Face's and OpenAI's own public disclosures and are reproduced here as Cisco presents them — they have not been independently verified.
The point Cisco draws from the episode is that it was not a single action that exposed the abuse, but a sequence of behavior spanning a long time and many steps — something traditional, per-interaction filtering struggles to catch.
How Quarry works
The central design choice is session level: Quarry matches patterns across sequences of actions instead of judging each individual interaction in isolation. Amy Chang, who leads Cisco's AI threat and security research, explained the logic in her interview with The Register by comparing it to credit card fraud detection — where any single transaction can look harmless, but the combination of several forms a pattern.
She pointed to what is missing today: "But what is missing is the entire context under which something may occur" (The Register).
A concrete example from Cisco researchers (Chang, Swanda, Balakrishnan and Berlin) illustrates the mechanism: a policy can produce a finding when a trace shows a read of a sensitive file followed — within a defined time window — by an external send. "The risk comes from the relationship between the two actions, so the finding should preserve evidence from both," they write. In other words, the detection does not point to one suspicious event, but documents the very link between them.
When a policy matches, Quarry returns the evidence, according to Cisco: the steps that triggered the match, the field each step matched on, and a short excerpt with common secret formats masked.
Coverage
Quarry is intended, according to both Cisco and The Register, to cover a broad range of agent technology:
- single- and multi-turn conversations with large language models (LLMs)
- agents and tool use
- interactions via the Model Context Protocol (MCP)
- multimodal inputs
Support for MCP interactions and multimodal inputs thus places Quarry where agent technology is actually used, not just in an older chatbot-logic world.
"A shared language for agent defense"
Cisco's positioning is clear — and should be read precisely as positioning: the company compares Quarry to Snort (network traffic), YARA (malware identification) and Sigma (logs), and argues that agent behavior now deserves its own language. According to Cisco, defenders will be better served by one open language that every team can read, test and extend than by a separate rule format in each product (Cisco).
The analogy is understandable but unproven: Snort, YARA and Sigma became industry standards through years of actual use, community contributions and third-party integrations — not through launch-day ambition. Whether Quarry takes on a similar role depends on adoption, rule quality and whether other vendors choose to support the format. None of these factors is documented yet.
What remains unclear
Several significant questions are open:
- Code and license: Cisco's post references a GitHub repository, but the license terms, rule syntax and engine code have not been verified in this coverage. The technical claims therefore cannot yet be checked against the code itself.
- Performance and accuracy: There are no data on detection accuracy, false positives or performance overhead.
- Adoption: No other vendors or security teams are confirmed as users of the language.
An open, readable format for describing dangerous agent behavior is genuinely useful — especially with a design that recognizes that risk often lies in the relationship between actions, not in any single action. But Quarry's value will not be decided in launch week. It will be decided by whether the community actually adopts the language, and whether the detections hold up in practice.