Cisco on October 28 has open-sourced Project Quarry, a detection language and engine designed to identify potentially harmful AI-agent behavior by analyzing sequences of actions across an agent’s session, according to a report by The Register.

The company said it is intended to address a gap in conventional security monitoring, which often examines individual commands or interactions rather than the relationship between multiple actions, according to the report.

Quarry lets security teams write rules that examine large language model conversations, tool calls, Model Context Protocol (MCP) interactions and multimodal inputs. A rule could, for example, flag an agent that reads a credentials file and then sends information to an external server.

When a rule is triggered, Quarry records the evidence behind the finding, including the actions and fields that caused the match. 

The open-source release includes installation instructions, rule-writing guidance, configuration examples, a rule starter pack and plugins for Claude Code, Codex and other MCP-compatible agents.

Agent Monitoring Needs to Follow the Full Chain of Actions

The development is relevant to chief data officers (CDOs) as AI agents gain access to enterprise data, applications and external tools. An individual action can appear legitimate, while a sequence of actions can result in unauthorized data movement or a security breach.

Cisco cited a July incident involving OpenAI agents and Hugging Face. According to OpenAI, an agent found and verified 14 exposed Hugging Face tokens that allowed it to make changes, then shared them. Cisco said it had not tested Quarry on this incident but believed the tool could have detected warning signs.

For chief data officers (CDOs), the incident highlights why effective AI governance must include monitoring how agents access data and use their permissions. Tracking a sequence of actions can help security teams spot risky behavior that might go unnoticed when each action is examined separately.