Cisco has released an open source behavior detection engine designed to monitor AI agents and prevent them from launching attacks like the recent Hugging Face breach. The tool, called Project Quarry, was announced in late October 2026 and aims to create a common framework for assessing agent behavior, similar to how Snort detects malicious network traffic and YARA identifies malware through rule-based patterns. The system watches entire agent sessions rather than isolated actions, looking for dangerous sequences of steps that could signal data theft or system compromise.
Most current detection systems focus on individual interactions with an AI model, such as whether it attempted prompt injection or invoked an attack tool. But according to Amy Chang, Cisco's head of AI threat and security research, what's lacking is the full context surrounding these events. She compared this to credit card fraud detection, where a small test charge or a single purchase far from a cardholder's usual area might not trigger alarms on its own. Quarry addresses this by examining the complete agent session, where one tool call might appear acceptable until the following step sends that information to an attacker-controlled inbox or server. Even data theft unfolds as a sequence rather than a single action, as shown when security firm Invariant Labs demonstrated an attack against GitHub's MCP server that hijacked a user's agent through a malicious GitHub Issue and forced it to leak data from private repositories.
The Cisco researchers write that reading a configuration file or sending a request to an external endpoint may be legitimate actions individually, but combining the two can lead to data exfiltration and demonstrates why relationships between actions matter. A policy can generate an alert when the trace shows a sensitive file read followed within a set time window by an external send, they explain, because the danger comes from the connection between the two actions. Quarry covers single- and multi-turn large language model conversations, agents, tool use, Model Context Protocol interactions, and multimodal inputs. The project's GitHub repository includes installation instructions, supported Python versions, plugins for Claude Code, Codex and other MCP-compatible agents, configuration examples, rule-writing guidance, and a starter pack of rules.
Chang and her colleagues suggest that if the OpenAI-Hugging Face incident had been examined as a complete, step-by-step record of one session, several points would have given Quarry rules something to act on and flag for human review. For instance, Quarry would likely have flagged internet access from a sandbox, since rules can highlight specific tool calls reaching an external server not on the task's allow list. Another trigger would be credentials discovered and then used elsewhere. On July 10 during the actual breach, an agent validated 14 exposed Hugging Face tokens with write access and shared them, which a rule would have caught by detecting a credential in the tool result that then called an outside service. The Cisco team emphasizes that rules alone can't replace chain-of-thought monitors or other forms of human oversight, but they do help document a pattern that other teams can review, test, and apply to their own agents.
The report explains that the benefit of open source and a collective approach to defending against adversarial use of AI lies in shared visibility, with Chang acknowledging that Cisco doesn't have all the answers and that everyone sees only slices of the problem, making it essential to share what they observe. The rule format resembles YARA or Snort rules, with a header detailing the traffic to examine, content to match, and metadata for tracking. For example, if base-64 encoded malware appears somewhere in a tool call, that would result in a block, Chang said. The open source release signals Cisco's bet that agent security will require industry-wide cooperation to define what normal behavior looks like before attacks become widespread. Organizations deploying AI agents now have a framework to write their own detection rules and contribute patterns back to the community, potentially building a shared defense before the next breach happens.