As cited
Copy frozen at (site build).
ai security
Cisco open sources tool for detecting AI agents on hacking sprees
Cisco has open sourced Project Quarry, a behavior detection engine designed to monitor artificial intelligence (AI) agents and prevent rogue agents from conducting unauthorized actions. Unlike existing tools that focus on individual interactions such as prompt injection attempts, Quarry analyzes entire agent sessions to detect suspicious patterns: reading a sensitive file alone may be legitimate, but reading a sensitive file followed by sending data to an external server signals potential data exfiltration. The tool supports single and multi-turn conversations, agents, tool use, Model Context Protocol interactions, and multimodal inputs, with rule packs similar to YARA and Snort formats.
Why it matters: Security teams managing AI agents need behavior detection beyond single-action checks to prevent unauthorized data theft and lateral movement, especially following incidents like the Hugging Face compromise where compromised credentials were discovered and used to exfiltrate data.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
ai security
Cisco open sources tool for detecting AI agents on hacking sprees
Cisco has open sourced Project Quarry, a behavior detection engine designed to monitor artificial intelligence (AI) agents and prevent rogue agents from conducting unauthorized actions. Unlike existing tools that focus on individual interactions such as prompt injection attempts, Quarry analyzes entire agent sessions to detect suspicious patterns: reading a sensitive file alone may be legitimate, but reading a sensitive file followed by sending data to an external server signals potential data exfiltration. The tool supports single and multi-turn conversations, agents, tool use, Model Context Protocol interactions, and multimodal inputs, with rule packs similar to YARA and Snort formats.
Why it matters: Security teams managing AI agents need behavior detection beyond single-action checks to prevent unauthorized data theft and lateral movement, especially following incidents like the Hugging Face compromise where compromised credentials were discovered and used to exfiltrate data.
- Source published
- First seen by Cybersecurity Tracker