Cisco Quarry Open-Source Release: Detecting AI Agent Attacks Hidden in Benign Action Sequences — Defender's Guide

Cisco has open sourced Project Quarry, a rule language purpose-built to detect attacks against AI agents that are invisible to conventional, single-event security tooling. The core problem Quarry addresses is one that every SOC running or planning to run LLM-powered agents needs to internalize immediately: modern agentic attacks are deliberately fragmented across sequences of individually benign actions. Each step — an API call, a file read, a tool invocation — passes every point-in-time control. The malicious outcome only materializes when the sequence is viewed as a whole.

This is not a theoretical research release. It is a direct response to an active and accelerating class of attacks against agentic AI deployments: prompt injection chains, tool-abuse sequences, and multi-step exfiltration patterns that current SIEM correlation and EDR telemetry do not model. Organizations that have deployed AI agents with access to internal data, code repositories, ticketing systems, or cloud APIs are exposed today. The release of Quarry as open source gives defenders a concrete, inspectable mechanism to begin closing that gap — but only if it is integrated into a broader detection and governance strategy.

This post breaks down the threat Quarry is designed to catch, how to think about detection coverage for agentic systems, and the specific operational steps security teams should take now.

Technical Analysis

What Project Quarry Is

Project Quarry is a rule language for expressing detections over sequences of agent actions, rather than discrete events. The design premise is that the security-relevant signal in agentic systems lives in the relationship between actions across time: which tools were called, in what order, with what arguments, against which data sources, and what changed as a result.

This is a direct architectural departure from traditional detection content:

• SIEM correlation rules operate on log events and thresholds, not semantic action graphs.
• EDR sees host-level process and file activity, but an agent calling a sanctioned API with a maliciously crafted argument looks identical to legitimate use.
• LLM input/output filters catch single-turn injection attempts but are blind to multi-turn sequences where each individual message is innocuous.

Quarry addresses this by allowing defenders to write rules that match on temporal and causal patterns across an agent's action trace — for example, "an agent that reads a file from a sensitive path, then within N actions calls an external HTTP tool with a parameter derived from that file's contents."

The Threat Class: Sequence-Based Agent Attacks

The attack patterns Quarry targets include the following, all of which are actively observed in real-world agentic deployments and red-team exercises:

1. Fragmented data exfiltration. The agent is induced (via indirect prompt injection in a retrieved document, email, or web page) to read a sensitive resource and then leak it in fragments across multiple subsequent tool calls — no single call is large or anomalous enough to alert.
2. Privilege-escalation chains via tool composition. An attacker steers an agent to combine two or more legitimate tools in a sequence that produces an unauthorized outcome — e.g., read credentials from a config store, then pass them to a deployment tool.
3. Indirect prompt injection with delayed execution. Malicious instructions are planted in content the agent will retrieve later (a poisoned wiki page, a crafted calendar invite, a compromised RAG document). The injection only fires when the agent reaches the relevant step in a multi-step task — long after the content was ingested and any ingestion-time scan ran.
4. Denial-of-wallet and resource exhaustion loops. Sequences that individually look like normal retries or exploration but, in aggregate, drive runaway API spend or rate-limit exhaustion against downstream services.

Affected Systems

This is not a vulnerability in a specific product and there is no CVE associated with this announcement. The exposure applies to any organization operating LLM-based agents that can:

• Call external or internal tools/APIs (function calling, MCP-style tool use)
• Read from and write to internal data stores, ticketing systems, code repositories, or SaaS platforms
• Retrieve and act on untrusted content (web pages, emails, documents, messages)

In practice, this describes the majority of production agentic deployments in 2026, including customer-facing copilots, internal automation agents, and SOC/coding assistants with tool access.

Exploitation Status

Prompt injection and agent-manipulation techniques are actively used in real-world engagements and have been demonstrated repeatedly against production systems. Indirect prompt injection via retrieved content is documented, reproducible, and not fully mitigated by any current model vendor's guardrails. The absence of a CVE does not indicate low risk — it reflects that this is a design-level attack class, not a patchable bug. Defense must be architectural and detection-driven.

Detection & Response

This is a technical threat (an active attack class against AI agents). Detection content below is grounded in the observable telemetry that agentic systems generate: tool-call logs, API invocation records, and agent action traces. The rules are written for environments where agent activity is logged to a SIEM (Sentinel via custom logs / API Gateway logs / application telemetry) and where endpoints hosting agent runtimes are instrumented.

Sigma Rules

The following rules target endpoint-observable behaviors associated with agent compromise: the agent runtime process making unexpected outbound connections, the runtime accessing sensitive credential stores, and suspicious child processes spawned by agent frameworks. These are deliberately conservative — the primary detection surface for agentic attacks is the action trace (covered in KQL), but endpoint telemetry catches the moments where an agent is steered into breaking out of its intended execution envelope.

---
title: AI Agent Runtime Process Unexpected Network Egress
id: 9f2c7a41-3d8e-4b6a-9c1f-5e7a2d8b4f01
status: experimental
description: Detects an AI agent runtime process (common Python/Node agent frameworks) establishing outbound connections to destinations outside an approved allowlist. Indicative of prompt-injection-driven exfiltration where the agent is steered to call an attacker-controlled endpoint. Tune the allowlist for your environment before deployment.
references:
  - https://www.securityweek.com/cisco-open-sources-quarry-to-catch-ai-agent-attacks-hidden-in-harmless-steps/
  - https://attack.mitre.org/techniques/T1071/001/
  - https://attack.mitre.org/techniques/T1041/
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.exfiltration
  - attack.t1041
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection_runtime:
    Image|endswith:
      - '\python.exe'
      - '\python3.exe'
      - '\node.exe'
  selection_agent_path:
    Image|contains:
      - '\agents\'
      - '\langchain'
      - '\autogen'
      - '\crewai'
      - '\agent-runtime'
  filter_known_good:
    DestinationIp|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
  condition: selection_runtime and selection_agent_path and not filter_known_good
falsepositives:
  - Legitimate agent calls to external SaaS APIs (OpenAI, Anthropic, etc.) — allowlist approved API endpoints
level: medium
---
title: Agent Runtime Accessing Credential Stores
id: 2b8e4d6c-1a5f-4c9b-8e3d-7f2a9c1b5d03
status: experimental
description: Detects an AI agent runtime process accessing OS credential stores or sensitive credential files. A compromised or injected agent attempting to harvest secrets to complete a multi-step attack will often touch these artifacts. High signal in environments where agents have no legitimate need for local credential access.
references:
  - https://www.securityweek.com/cisco-open-sources-quarry-to-catch-ai-agent-attacks-hidden-in-harmless-steps/
  - https://attack.mitre.org/techniques/T1003/
  - https://attack.mitre.org/techniques/T1552/001/
author: Security Arsenal
date: 2026/04/10
tags:
  - attack.credential_access
  - attack.t1003
  - attack.t1552.001
logsource:
  category: file_event
  product: windows
detection:
  selection_runtime:
    Image|endswith:
      - '\python.exe'
      - '\python3.exe'
      - '\node.exe'
  selection_target:
    TargetFilename|contains:
      - '\.aws\credentials'
      - '\.azure\'
      - '\.kube\config'
      - '\.ssh\id_'
      - '\.env'
      - '\secrets'
  filter_agent_workdir:
    TargetFilename|contains:
      - '\agent-workdir\'
      - '\sandbox\'
  condition: selection_runtime and selection_target and not filter_agent_workdir
falsepositives:
  - Agents with legitimate, documented access to specific secret paths — scope those precisely
level: high

KQL (Microsoft Sentinel / Defender)

The core Quarry-style detection problem — sequences of benign actions — maps to Sentinel hunting over agent action traces. The following query assumes agent tool-call telemetry is ingested into a custom log table (e.g., via a logging pipeline from your agent framework, API gateway, or MCP proxy). It hunts for the classic fragmented exfiltration pattern: a sensitive-data read followed within a short window by an outbound HTTP tool call carrying a derived payload.

// Hunt: sensitive read followed by outbound egress within a short action window.
// Assumes agent tool-call telemetry ingested into a custom table 'AgentAction_CL'.
// Adapt table/column names to your ingestion schema.
let SensitiveRead =
    AgentAction_CL
    | where TimeGenerated > ago(24h)
    | where ToolName_s in ("read_file", "get_document", "query_database", "read_email")
    | where ToolArgs_s has_any ("/confidential", "/finance", "customer_pii", "secrets", "credentials")
    | project ReadTime=TimeGenerated, SessionId=SessionId_s, ReadTarget=ToolArgs_s, AgentId=AgentId_s;
let OutboundCall =
    AgentAction_CL
    | where TimeGenerated > ago(24h)
    | where ToolName_s in ("http_request", "web_request", "send_email", "post_message", "upload_file")
    | project CallTime=TimeGenerated, SessionId=SessionId_s, DestUrl=ToolArgs_s, AgentId=AgentId_s;
SensitiveRead
| join kind=inner OutboundCall on SessionId, AgentId
| where CallTime between (ReadTime .. ReadTime + 5m)
| extend ActionGapSeconds = datetime_diff('second', CallTime, ReadTime)
| project ReadTime, ReadTarget, CallTime, DestUrl, ActionGapSeconds, SessionId, AgentId
| order by ReadTime desc;

A second hunt targets tool-call frequency anomalies within a single session — catching denial-of-wallet loops and brute-force-style agent behavior that only emerges in aggregate:

// Hunt: abnormally high tool-call volume within a single agent session,
// indicative of denial-of-wallet loops or injection-driven runaway behavior.
AgentAction_CL
| where TimeGenerated > ago(24h)
| summarize ToolCallCount=count(),
            DistinctTools=dcount(ToolName_s),
            FirstCall=min(TimeGenerated),
            LastCall=max(TimeGenerated)
    by SessionId_s, AgentId_s
| extend SessionDurationMinutes = datetime_diff('minute', LastCall, FirstCall)
| where ToolCallCount > 200 or (SessionDurationMinutes <= 5 and ToolCallCount > 50)
| order by ToolCallCount desc;

Velociraptor VQL

For endpoint forensics on hosts running agent runtimes, hunt for agent framework processes with suspicious command lines or loaded from non-standard paths — common when an attacker gains code execution inside an agent's environment or deploys a rogue agent.

-- Hunt for AI agent runtime processes executing from non-standard paths
-- or with suspicious command-line arguments (potential rogue/compromised agents).
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE (Name =~ '(?i)python|node'
       AND (CommandLine =~ '(?i)agent|langchain|autogen|crewai|llm'))
  AND NOT Exe =~ '(?i)program files|system32|/usr/bin|/opt/approved'

For deeper inspection of network activity from agent hosts:

-- Enumerate active outbound connections from agent runtime processes
-- to identify unexpected egress destinations during a live investigation.
SELECT Pid, Name, RemoteAddress, RemotePort, Status
FROM netstat()
WHERE Name =~ '(?i)python|node'
  AND Status =~ 'ESTABLISHED'
  AND NOT RemoteAddress =~ '^(10\\.|192\\.168\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.)'

Remediation / Hardening Script

The following Bash script audits a Linux host running agent workloads: it enumerates running agent processes, checks for agent runtime network listeners, verifies that agent service accounts are not running as root, and confirms logging of tool-call activity is enabled. Run it on agent hosts or via your configuration management pipeline.

#!/bin/bash
# Agent Runtime Security Audit — Security Arsenal
# Audits hosts running AI agent workloads for common exposure conditions.

set -euo pipefail

echo "=== [1] Running agent runtime processes ==="
ps aux | grep -Ei 'python|node' | grep -Ei 'agent|langchain|autogen|crewai|llm|mcp' | grep -v grep || echo "No agent processes detected."

echo ""
echo "=== [2] Agent processes running as root (HIGH RISK) ==="
ROOT_AGENTS=$(ps aux | grep -Ei 'python|node' | grep -Ei 'agent|langchain|autogen|crewai|llm|mcp' | grep '^root' | grep -v grep || true)
if [ -n "$ROOT_AGENTS" ]; then
  echo "WARNING: agent runtime processes running as root:"
  echo "$ROOT_AGENTS"
else
  echo "OK: no agent runtime processes running as root."
fi

echo ""
echo "=== [3] Outbound connections from agent processes (non-RFC1918) ==="
ss -tnp 2>/dev/null | grep -Ei 'python|node' | grep -Ev '10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.' || echo "No unexpected outbound connections from agent processes."

echo ""
echo "=== [4] World-readable credential files in agent working directories ==="
for dir in /opt/agent* /srv/agent* /home/*/.config 2>/dev/null; do
  [ -d "$dir" ] && find "$dir" -type f \( -name '.env' -o -name '*credential*' -o -name '*secret*' \) -perm -o=r 2>/dev/null
done || echo "No agent directories found."

echo ""
echo "=== [5] Audit: is tool-call/action logging enabled? ==="
echo "Verify your agent framework writes structured action traces (tool name, args hash, session id, timestamp) to a SIEM-ingestible sink."
echo "Quarry-style sequence detection is impossible without this telemetry."

echo ""
echo "Audit complete. Review WARNING items immediately."

Remediation

There is no patch to apply — defense against sequence-based agent attacks is architectural. The following steps are prioritized for immediate action:

1. Instrument agent action traces now. Sequence detection is impossible without complete, structured telemetry of every tool call: tool name, arguments (or argument hashes for sensitive payloads), session identifier, timestamp, and outcome. Pipe this telemetry to your SIEM. If your agent framework does not emit this today, place a logging proxy (API gateway or MCP-level proxy) in front of tool endpoints.

2. Evaluate and deploy Quarry. Pull the open-source Project Quarry release from Cisco's repository (see the SecurityWeek coverage at https://www.securityweek.com/cisco-open-sources-quarry-to-catch-ai-agent-attacks-hidden-in-harmless-steps/ for the source link). Stand up a proof-of-concept against replayed agent traces in a lab environment before production deployment. Write an initial rule set covering your highest-risk sequences: sensitive-read → outbound-egress, credential-access → tool-invocation, and high-frequency tool loops.

3. Enforce least privilege on agent tool access. Every tool an agent can call is attack surface. Remove tools the agent does not strictly need for its task. Scope file-system and API access to the narrowest possible paths and operations. Agents should authenticate as dedicated, low-privilege service identities — never as root, never with broad IAM roles.

4. Segregate untrusted content. Content retrieved from external sources (web pages, emails, user uploads, RAG documents) must be treated as hostile. Architecturally separate the reasoning context that handles untrusted content from the context that holds credentials or can invoke sensitive tools. Where this separation isn't feasible, apply strict allowlists on which tools can be invoked in sessions that have ingested untrusted content.

5. Implement egress controls for agent runtimes. Apply DNS and IP allowlisting to outbound connections from agent hosts. An agent that can only reach approved API endpoints cannot exfiltrate to an attacker-controlled destination, regardless of how it is manipulated.

6. Add agentic attack scenarios to your detection validation and purple-team program. Replay fragmented exfiltration, delayed indirect prompt injection, and tool-composition attacks against your telemetry. If your current detections do not fire on these sequences, that is your coverage gap — and it is the gap Quarry is built to close.

7. Govern agent deployment. Maintain an inventory of every AI agent in production, its tool access, its data access, and its owner. Unmanaged, unmonitored agents are the highest-risk assets in this threat class.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub