[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fG_aR2sBw3IIMn0Q3bz7Il8ZHuVCWT-yxYLTm2ohkzGI":3},{"article":4,"iocs":51,"watch_terms":56,"solutions":57,"lesson":148},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"9664450a-b4b3-47b9-9e51-3bab46959889","Cisco Open Sources Quarry to Catch AI Agent Attacks Hidden in Harmless Steps","cisco-open-sources-quarry-to-catch-ai-agent-attacks-hidden-in-harmless-steps-cb7378","Cisco open sourced Project Quarry, a rule language for detecting AI agent attacks that only emerge across sequences of benign actions. The post Cisco Open Sources Quarry to Catch AI Agent Attacks Hidden in Harmless Steps appeared first on SecurityWeek.","Cisco has open sourced Project Quarry, a neurosymbolic rule language designed to detect AI agent attacks that unfold across a series of seemingly benign actions. Traditional security tools often fail to identify these threats because they analyze individual actions in isolation. Quarry combines machine learning with rule-based checks to identify suspicious patterns over time, offering a new layer of defense against sophisticated AI-driven attacks.","Cisco open sources Project Quarry, a rule language for detecting AI agent attacks.","https:\u002F\u002Fwww.securityweek.com\u002Fcisco-open-sources-quarry-to-catch-ai-agent-attacks-hidden-in-harmless-steps\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F09\u002FAI-artificial-intelligence-training.jpeg","2026-10-29T14:18:03+00:00","2026-10-29T15:00:15.89279+00:00",8,[17,20,23,26],{"name":18,"type":19},"Cisco","vendor",{"name":21,"type":22},"Project Quarry","product",{"name":24,"type":25},"AI agent","technology",{"name":27,"type":25},"LLM","839da5c1-3c34-47e2-9499-f7201640e3ac",{"id":28,"icon":30,"name":31,"slug":32},null,"AI Security","ai-security",[34,39,44,46],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":45},{"id":28,"icon":30,"name":31,"slug":32},{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52],{"type":53,"value":54,"context":55},"malware","Claude Code","Used by bad actors in two campaigns in 2025.",[18,21],{"controls":58,"vendors":144},[59,88,117],{"slug":60,"name":61,"problem":62,"products":63},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":89,"name":90,"problem":91,"products":92},"soc-automation","SOC automation and AI analysts","Alerts arrive faster than the team can investigate them, so real attacks wait in the queue or are closed unread.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"torq","Torq","\u002Fvendor-logos\u002Ftorq.png","torq-ai-soc-platform","Torq AI SOC Platform","https:\u002F\u002Ftorq.io\u002Fai-soc-platform\u002F","No-code security automation combined with AI agents, including the Socrates AI analyst, to triage, investigate and respond to alerts across the security stack.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"splunk","Splunk","\u002Fvendor-logos\u002Fsplunk.png","splunk-soar","Splunk SOAR","https:\u002F\u002Fwww.splunk.com\u002Fen_us\u002Fproducts\u002Fsplunk-security-orchestration-and-automation.html","Security orchestration and automation that runs playbooks to investigate and respond to incidents in seconds.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"vega","Vega","\u002Fvendor-logos\u002Fvega.png","vega-agentic-triage","Agentic Triage and Investigation","https:\u002F\u002Fvega.io\u002Fplatform\u002Ftriage","AI agents investigate every alert and hand analysts a verdict with the evidence behind it.",{"slug":32,"name":118,"problem":119,"products":120},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[121,129,137],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-airs","Prisma AIRS","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fai-security\u002Fprisma-airs","Security for AI applications, models and agents, including runtime protection against prompt injection.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-agentstudio","Boomi Agentstudio","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fagentstudio\u002F","Agent builder whose Agent Control Tower registers and monitors Boomi agents and agents on Amazon Bedrock, Microsoft Copilot and other platforms, keeps audit logs and can switch agents off where the provider allows it.",{"vendor_slug":138,"vendor_name":18,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"cisco","\u002Fvendor-logos\u002Fcisco.png","ai-defense","Cisco AI Defense","https:\u002F\u002Fwww.cisco.com\u002Fsite\u002Fus\u002Fen\u002Fproducts\u002Fsecurity\u002Fai-defense\u002Findex.html","Discovery of AI use, testing of models and guardrails for AI applications.",[145],{"slug":138,"name":18,"logo_path":139,"roles":146},[147],"reported_by",{"slug":149,"title":150,"body":151,"framework_refs":152,"framework_notes":160},"ciscos-quarry-targets-multi-step-ai-agent-attacks-that-evade-traditional-tools","Cisco's Quarry Targets Multi-Step AI Agent Attacks That Evade Traditional Tools","AI-powered agents can execute attacks through sequences of individually harmless actions, each of which passes standard security checks while collectively achieving a malicious goal. Traditional security tools fail here because they evaluate events in isolation rather than tracking behavioral patterns over time. This represents a fundamental blind spot in conventional logging and monitoring stacks, which were not designed for the emergent, multi-step threat model that AI agents enable. Cisco's open-source Quarry project addresses this gap by combining machine learning with rule-based logic to detect suspicious sequences — highlighting how defenders must evolve their monitoring capabilities to match attacker sophistication.",[153,154,155,156,157,158,159],"CIS Control 8: Audit Log Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","MITRE ATT&CK T1566: Phishing","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","CIS Control 17: Incident Response Management",{"NIS2 Article 21(2)(b)":161,"MITRE ATT&CK T1566: Phishing":162,"CIS Control 8: Audit Log Management":163,"NIST SP 800-53 SI-2: Flaw Remediation":164,"CIS Control 17: Incident Response Management":165,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":166,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":167},"NIS2 mandates incident handling capabilities that include detection of sophisticated, multi-vector threats — precisely the scenario where sequence-aware tools like Quarry are required to meet the directive's intent.","Multi-step AI agent attacks mirror living-off-the-land and chained technique approaches catalogued in ATT&CK, where individually benign steps combine into a full attack sequence that defenders must learn to track across the kill chain.","Traditional tools analyzing actions in isolation lack the correlated, time-sequenced log management that CIS Control 8 requires, which would be necessary to detect multi-step AI agent attack chains.","Vulnerability management programs must now account for emergent AI agent attack patterns as a class of exploitable weakness requiring detection tooling updates and procedural remediation.","Incident response playbooks must be updated to include procedures for identifying and containing AI agent attacks that span multiple benign-looking steps before a response can be triggered.","Agentic AI attack surfaces represent an emerging class of technical vulnerability that organisations must identify, assess, and mitigate as part of a structured vulnerability management process.","Enforcing least-privilege access for AI agents limits the damage any single compromised step in a multi-stage attack can cause, directly constraining the attack surface Quarry was built to address."]