Cisco has released Quarry, a language and engine for security rules that inspect an AI agent’s activity across a session. It connects tool calls and their results so teams can investigate patterns that isolated permission checks miss. Findings retain the steps behind an alert, while human reviewers remain part of the enforcement workflow.
Cisco released Project Quarry on 28 October as an open-source rule language and execution engine for examining AI agent behavior. Security checks can connect conversations, tool requests and results rather than assess each action in isolation. A sensitive-file read followed by an external request illustrates the pattern: either action may be permitted, while their sequence merits attention.[1], [2]
Rules can combine exact text matches with prompt-injection classifiers and assessments by language models. Quarry preserves structured tool information and the steps that matched the rule, including the relevant field and a short excerpt with common secret formats masked. Images and other content can contribute signals through specialized analyzers. The receiving application decides how to respond to a finding, such as by flagging activity, blocking it or keeping a log.[1]
The release includes a compiler, command-line scanner, Python SDK, documentation and example rules. Rules compile on loading, and the proposed testing workflow pairs an expected match with a benign conversation. Cisco recommends human review before enforcement. Quarry supplements authorization controls; the company’s reconstructions of earlier incidents were illustrations, and Cisco explicitly says it did not run the tool against those incident data.[1]
