Cisco Releases Free Tool to Spot AI Agents Behaving Badly

Cisco has released Project Quarry as open source software. It is a behaviour detection engine that monitors AI agents, with the aim of helping security teams stop rogue agents from going off the rails, as happened in the Hugging Face hack. Cisco wants Quarry to offer a "shared language" for evaluating agent behaviour, much as Snort did for detecting malicious network traffic and YARA did for identifying malware with rules.

Most current detection tools look at specific interactions, such as whether an agent attempted prompt injection or called an attack tool. Amy Chang, head of AI threat and security research at Cisco, says the missing piece is context. She compared it to credit card fraud: a small test charge or one distant purchase may look harmless alone, but a pattern of them does not. Quarry therefore examines the entire agent session. One tool call may seem in scope until the next step sends the information to an attacker-controlled inbox or server.

The researchers point out that data theft is a sequence, not a single action. Reading a configuration file or sending a request to an external endpoint can each be legitimate, but combining them can lead to data exfiltration. Quarry policies can raise a finding when a sensitive file read is followed within a defined window by an external send, and the finding keeps evidence from both actions. Invariant Labs earlier showed a similar chain in a proof-of-concept attack on GitHub's MCP server, where a malicious GitHub Issue hijacked a user's agent and made it leak private repository data.