Cisco Releases Open‑Source Quarry to Spot Stealthy AI‑Agent Threats

Cisco has made its newly developed Project Quarry publicly available, offering the security community a rule‑language framework designed to uncover malicious AI‑driven behaviors that hide behind sequences of innocuous actions. The move, announced on the company's security blog, aims to address a growing concern that sophisticated autonomous agents can evade traditional defenses by distributing harmful intent across multiple benign steps.

Quarry enables analysts to define multi‑stage detection rules that consider the context and order of events, rather than evaluating each action in isolation. By doing so, it can flag patterns where, for example, a seemingly harmless file download, followed by a routine system query, and later a legitimate network request collectively form an attack vector orchestrated by an AI agent. The language is built to be extensible, allowing security teams to tailor rules to the specific tactics observed in their environments.

The open‑source release follows a broader industry push to confront the emerging threat of autonomous agents that can adapt, learn, and execute complex campaigns without direct human input. Researchers have warned that such agents can exploit the trust placed in routine system operations, making detection harder for signature‑based tools. By providing a community‑driven platform, Cisco hopes to accelerate the development of shared defenses and reduce the time it takes to respond to novel AI‑powered tactics.

Project Quarry joins a growing portfolio of Cisco’s security contributions, which include threat‑intel sharing platforms and open‑source tools for network visibility. The company emphasizes that the framework is compatible with existing security information and event management (SIEM) solutions, enabling organizations to integrate the new rule language without overhauling their current infrastructure. Early adopters are encouraged to contribute rule sets back to the project, fostering a collaborative ecosystem.

Analysts view the initiative as a timely response to the escalating arms race between defenders and AI‑enhanced adversaries. As enterprises continue to embed intelligent automation across their operations, the ability to detect stealthy, multi‑step attacks will become a critical component of robust cyber‑defense strategies. Cisco’s open‑source Quarry may therefore play a pivotal role in shaping how the industry monitors and mitigates the subtle footprints left by malicious AI agents.