Cisco announced on October 28, 2026, that it was open-sourcing Project Quarry, a detection language and engine for analyzing AI-agent traces. Quarry can connect events across a session, such as an agent reading a sensitive file and then sending an external request, and return a finding with evidence from the matched steps. The product that receives the finding determines what happens next.
What Quarry looks for in an agent trace
An agent trace records interactions such as messages, tool calls and tool results. Quarry rules can examine a single event or link events across a conversation, including their order and session context. That lets a rule look for a pattern that an isolated tool call might not reveal: for example, a sensitive-file read followed within a defined window by an external send.
Rules can use exact, symbolic checks for strings, commands, structured fields and call order. Cisco also describes optional classifiers and large language model (LLM) judgments for semantic checks, with optical character recognition (OCR) and vision models available to provide signals about image content. Cisco says a finding retains the matching steps and fields, along with a short excerpt; common secret formats are masked.
Cisco describes Quarry for runtime checks around model calls or tool runs, for scanning stored traces after a session, and for examining older traces during incident response. The repository’s command-line scanner can scan OpenAI-format chat JSON, directories or datasets, and the Python software development kit (SDK) lets developers work with Quarry from Python.
A finding is not the same as a block
Quarry evaluates rules and returns findings. An integrating product can map a finding to a response such as alerting, blocking, redacting, quarantining or logging. The available response therefore depends on how that product is configured; Quarry is not a substitute for fine-grained authorization or human review of rules before enforcement.
Cisco says Quarry is already in production in Cisco AI Defense. Cisco described an integration with DefenseClaw as planned. That is a separate status from the AI Defense integration.
What the open-source repository requires
The Project Quarry repository specifies Python 3.11 through 3.13 and an Apache 2.0 license. It labels Quarry alpha and warns that the detection language’s syntax may change before version 1.0.0, so existing rules may need updates.
The quick-start configuration selects 14 local rules that run without model credentials. Four semantic-rule examples use deterministic keyword stubs intended for examples and tests, not production decisions. That distinction matters when trying the starter configuration: those stubs demonstrate the rule structure, rather than providing production semantic judgments.
Cisco’s incident example was a hypothetical analysis
Cisco also discussed where Quarry rules might have matched events in the OpenAI–Hugging Face incident timeline. Cisco said it did not run Quarry against the incident data; the proposed matches are hypothetical, not Quarry detections. Its example illustrates the kind of sequence a trace rule could examine, while leaving the incident separate from any evaluation of the tool.
