Cisco Open Sources Project Quarry to Catch Rogue AI Hacking Agents

Enterprise security teams are scrambling to secure autonomous systems as malicious actors weaponize autonomous workflows for multi-stage network intrusions. According to reporting by The Register Security, networking giant Cisco has open-sourced Project Quarry, a new behavior detection engine explicitly engineered to catch rogue AI agents during hacking sprees. The release comes in the wake of high-profile incidents like the Hugging Face compromise, highlighting an urgent industry-wide blind spot: traditional security tools evaluate individual model prompts or single tool calls in isolation, missing the broader malicious trajectory of an autonomous agent.

How Project Quarry Evaluates Agentic Behavior

Project Quarry evaluates AI agent behavior by analyzing complete operational sessions rather than isolated prompts or single tool calls, mirroring how financial institutions detect credit card fraud through multi-transaction patterns. Traditional scanners ask whether a specific prompt injection occurred or if an isolated attack tool was invoked. Quarry instead monitors the cumulative context of an agent session, recognizing that a seemingly benign API request or minor data query becomes malicious only when combined with subsequent exfiltration steps. Cisco's AI threat and security research head Amy Chang explained to The Register that individual actions often look legitimate on their own, requiring end-to-end session visibility to flag compounding risks before attackers buy the proverbial PlayStation 5.

The Three-Tier Agent Risk Framework

To operationalize Project Quarry effectively, security engineering teams must classify autonomous system behavior into distinct operational tiers rather than treating all model interactions as uniform threats. This structured approach helps SOC analysts separate routine API friction from coordinated, multi-step agentic compromises.

• Tier 1: Isolated Tool Call Inspection — Examines individual model requests, prompt payloads, and singular API invocations for known exploit signatures.
• Tier 2: Stateful Session Tracking — Monitors sequence chains across multiple turns to detect suspicious pivots between authorized databases and unauthorized egress channels.
• Tier 3: Intent Context Correlation — Evaluates the overarching objective of an autonomous run against baseline business logic to stop compounding threat paths.

Without session-wide context, security teams are blind to the slow-motion aggregation of privilege that defines modern autonomous cyber attacks. Single transactions look clean; the sequence tells the real story.

Why Traditional Security Tools Fail Agents

Legacy security tooling built for static web applications and traditional malware signatures fails against AI agents because autonomous loops bypass deterministic execution paths. Traditional signature scanners like YARA or network sniffers like Snort revolutionized static malware and packet inspection, but they assume human operators or scripted binaries behind network traffic. AI agents dynamically generate code, chain disparate tools together, and adapt their execution paths based on intermediate outputs. A static rule cannot predict how an autonomous LLM will pivot after encountering an error code, making behavioral session tracing the only viable defense mechanism for enterprise AI deployments.

What to watch next

Security architects and compliance leaders evaluating autonomous agent infrastructure should track three critical indicators over the coming quarters. First, monitor GitHub repository activity for community-contributed detection rulesets mirroring the YARA and Snort ecosystems. Second, watch for enterprise SIEM and SOAR vendors announcing native ingestion parsers for Project Quarry session logs. Third, track whether regulatory frameworks begin mandating session-level audit trails for autonomous systems operating inside critical infrastructure sectors.