Cisco open sources tool for detecting AI agents on hacking sprees

Cisco has released a behavior detection engine, Project Quarry, as open source to help security teams identify rogue AI agents before they cause harm, similar to how Snort and YARA identify malicious network traffic and malware. Amy Chang, head of AI threat and security research at Cisco, explained that Quarry provides a "shared language" for evaluating agent behavior and considers the entire context of an agent session, not just individual actions.

This approach can detect potential data theft or other malicious activities, which may appear innocuous when viewed in isolation. The open source Project Quarry includes installation instructions, supported Python versions, plugins for various MCP-compatible agents, and a set of rule examples. One example rule flags an agent that reads a credentials file, while another identifies an agent that sends data to an external server after finding credentials.

While Quarry is not a replacement for human oversight, the open source approach allows for collective defense against adversarial use of AI.