AI agent hujumini aniqlash shunchaki katta pichan ichida tarqalgan bir nechta kichik ignalarni topish emas; bu ignalar bir-biriga bog'langanmi va nima maqsadda bog'langanligini aniqlashdir.
An'anaviy xavfsizlik nazorati har bir alohida harakatni baholab, niyat yomon yoki zararsiz ekanligini aniqlaydi. Bu yondashuv AI agent faoliyatida ishlamaydi, chunki yomon niyat faqat bir qator zararsiz harakatlar ketma-ketligida namoyon bo'ladi. Bu faqat harakatlarning umumiy ketma-ketligi ko'rib chiqilganda yoki harakatga keltirilganda aniq bo'ladi.
Firibgarlikni aniqlash bunga misol. Bank har bir xaridni alohida tahlil qiladi. Bu asosan an'anaviy xavfsizlikning ishlash usuli. Biroq, firibgarlikni aniqlash bir nechta xaridlar, ehtimol turli joylarda va g'ayritabiiy vaqtda (ehtimol agent qobiliyatidan foydalanib) sodir bo'lgan, ko'rinishda zararsiz alohida xaridlar ketma-ketligini ko'rishni talab qiladi. "Agent xavfsizligi xuddi shu kombinatsiyani — naqshni aniqlash va dalillarni — agent qadamlariga, xaridlarga emas, qo'llashni talab qiladi," deb yozadi Cisco Project Quarry ochiq manba loyihasini e'lon qilishda.
Cisco Quarry loyihasini neyrosimvolik qoida tili sifatida ta'riflaydi, bu mashinaviy o'rganish hukmini qoida asosidagi tekshiruvlar bilan birlashtiradi. "U bitta burilishli va ko'p burilishli katta til modellari (LLM) suhbatlarini, agentlarni, vosita foydalanishini, Model Context Protocol (MCP) o'zaro ta'sirlarini va multimodal kirishlarni qamrab oladi."
Har bir belgilangan qoida ML klassifikatorlari va LLM hakamlari tomonidan taqdim etilgan neyron dalillarga, shuningdek, aniq shartlar, ketma-ketliklar, satr mosliklari va vosita munosabatlarini tekshiradigan simvolik qoidalarga tayanadi. U har bir detektor yoki har bir ijro nazorati o'rnini bosish emas, balki umumiy siyosat qatlamini ta'minlash uchun mo'ljallangan.
Quarry agentlarda ish vaqti himoya chiziqlarini ta'minlash, keyingi tahlil uchun qoida to'plami xavfsizlik tahlili va hodisaga javob berish uchun ishlatilishi mumkin. U Cisco'ning mavjud Integrated AI Security & Safety Framework bilan integratsiyalashadi. U ramkani AI xavfini tavsiflashdan agent faoliyatida uni aniqlashga kengaytiradi va ramka uchun siyosat va baholash qatlami sifatida joylashtiriladi. Ramka AI xavflarini belgilaydi, Quarry esa agent faoliyatida bu xavflarni aniqlashni ta'minlaydi — ramka toifalari ham yangi qoidalarni keyingi rivojlantirish uchun yo'l xaritasini taklif qiladi.
Quarry'ning aniqlash maqsadi alohida ruxsat etilgan harakatlar orasida shubhali naqshlarni aniqlashdir. Bunday naqshlar faqat vaqt o'tishi bilan shubhali bo'lishi mumkin. 2025-yilda Claude Code yomon niyatli shaxslar tomonidan ikki kampaniyada ishlatilgan: biri taxminan 30 ta tashkilotga qarshi, ikkinchisi Meksika hukumat muassasalariga qarshi. Birinchi hujum kichik, odatiy ko'rinadigan vazifalarga bo'lingan bo'lib, mavjud himoyaga bu yangi himoya sinovi qismi ekanligini aytgan. Uning qismlaridan ruxsat etilgan pentestga o'xshagan, ammo haqiqiy niyat (ma'lumot o'g'irlash) faqat so'rovlar to'g'ri ketma-ketlikda birlashganda aniq bo'lgan.
AI'ning hujumni bir nechta alohida zararsiz qadamlarga ajratish qobiliyati an'anaviy himoyalarni mag'lub qiladi va bu yangi turdagi neyrosimvolik tahdidni aniqlashni talab qiladi. Ammo bu "bir marta yozib, keyin unutish" talabi emas. Hujumchilar doimiy ravishda hujumlariga yangi yondashuvlar ishlab chiqmoqda. Shuning uchun, har safar yangi hujum texnikasi aniqlanganda, himoyachilar darhol yangi Quarry qoidasini yozib javob berishlari kerak, bu qoida butun dunyodagi barcha tashkilotlar tomonidan ishlatilishi mumkin.
Ammo yangi qoidalarni qo'lda yozish hujumchilarning yangi zararli agentlarni ishlab chiqish uchun AI'dan foydalanishiga qarshi kengaymaydi. "Biz agentlar, shuningdek, xavfsizlik va AI muhandislari Quarry qoidalarini yozishlari mumkin bo'lishini xohlaymiz," deb e'lon qiladi Cisco. Quarry Plugin kodlash agentiga tashkilotning xavfini oddiy ingliz tilidagi tavsifidan qoidalarni tuzish, kompilyatsiya qilish va takomillashtirish, so'ngra bu qoidalarni haqiqiy suhbatlarga qarshi sinash imkonini beradi. Kodlash agentida o'tgan qoida ish vaqti bilan bir xil tarzda ishlashi kerak.
Loyihani ochiq manba qilish orqali an'anaviy kiberxavfsizlikning hujum va himoya assimetriyasi (bir nechta hujumchilar alohida himoyachilarga qarshi) tenglashtiriladi (bir nechta global hujumchilar endi bir nechta global himoyachilarga qarshi). AI'dan rivojlanish uchun foydalanishga ruxsat berish yomon niyatli shaxslar AI yordamida hujumlarda ega bo'lgan tezlik afzalligini ham muvozanatlashtiradi.
"Ochiq manba loyihasi," deydi Cisco, "amaliyotchilarga aniqlash muhandisligi uchun ishlaydigan asos beradi." Quarry boshlang'ich to'plami quyidagilarni o'z ichiga oladi:
- suhbatlar, vosita foydalanishi va hodisa munosabatlari uchun o'qilishi mumkin DSL;
- har bir qoidani yuklanganda kompilyatsiya qiladigan, sozlanadigan xavfsizlik va resurs chegaralari bilan baholash ish vaqti;
- alohida izlar, kataloglar va ma'lumotlar to'plamlari uchun buyruq satri skaneri;
- ilova integratsiyasi uchun Python SDK;
- semantik signallar uchun ixtiyoriy sozlangan model operatsiyalari;
- Claude Code, Codex va boshqa MCP-mos agentlar uchun Quarry plagini;
- qoida metama'lumotlari, misollar, hujjatlar va xabar formati yo'riqnomasi; va
- qoidalarni ijobiy va zararsiz ma'lumotlar to'plamlariga qarshi tekshirish uchun ish jarayoni.
Project Quarry AI agent hujumlari uchun aniqlashlarni ifodalash va almashish uchun umumiy, ochiq standartga aylanishi mo'ljallangan, xuddi Snort, YARA va Sigma kiberxavfsizlikning boshqa sohalarida standartlarga aylangani kabi. "Hugging Face taxminan 17 600 agent harakatini keyinchalik qayta tikladi," deydi Cisco. "Project Quarry bilan bizning maqsadimiz himoyachilarga shunga o'xshash ketma-ketliklarni ular hali ham davom etayotganda aniqlashga yordam berish va har bir topilma ortidagi dalillarni ularga harakat qilish kerak bo'lgan odamlar uchun saqlab qolishdir."
Bog'liq: Birinchi Agentik AI Ma'lumot Buzilishi Ispaniya Regulyatoriga Xabar Qilingan
Bog'liq: Agentik AI Langflow Orqali Ransomware Hujumini Amalga Oshirish Uchun Ishlatilgan
Bog'liq: Buyuk Britaniya Hukumati Sanoat Majburiyati Bilan Birga Agentik AI Himoya Rejasini E'lon Qildi
Bog'liq: Rig Security 12 Million Dollar Bilan Agentik AI Shaxsni Aniqlash Xavflarini Hal Qilish Uchun Yashirin Rejimdan Chiqdi
Detecting an AI agent attack isn’t simply finding multiple small needles scattered in a large haystack; it is recognizing whether and for what purpose the needles are connected.
Traditional security controls evaluate single actions to classify whether an intent is bad or benign. This approach fails on AI agent activity when the bad intent only emerges over a series of benign actions. It only becomes apparent if and when the overall sequence of actions is viewed or actioned.
Fraud detection is an example. A bank analyzes each purchase on its own. That’s largely how traditional security operates. Fraud detection, however, needs to see patterns of apparently benign single purchases across multiple purchases, possibly in multiple locations with unlikely timing (potentially employing agent capability). “Agent security needs the same combination of pattern detection and evidence, applied to the steps an agent takes rather than to purchases,” writes Cisco in announcing the open sourcing of its Project Quarry.
Cisco describes Quarry as a neurosymbolic rule language, combining machine learning judgment with rule-based checks. “It covers single-turn and multi-turn large language model (LLM) conversations, agents, tool use, Model Context Protocol (MCP) interactions, and multimodal inputs.”
Each defined rule draws on neural evidence from ML classifiers and LLM judges, and symbolic rules that check exact conditions, sequences, string matches, and tool relationships. It is designed to provide a shared policy layer rather than be a replacement for every detector or every enforcement control.
Quarry can be used to provide runtime guardrails on agents, post-hoc rule set security analytics, and incident response. It integrates with Cisco’s existing Integrated AI Security & Safety Framework. It expands the framework from describing AI risk toward detecting it in agent activity, and is positioned as the policy and evaluation layer for the framework. The framework defines AI risks while Quarry provides detection of the risks in agent activity – the framework categories also offer a roadmap for the further development of new rules.
Quarry’s detection purpose is to identify suspicious patterns that span individual permitted actions. Such patterns may only become suspicious over a period of time. In 2025, Claude Code was used by bad actors in two campaigns: one against around 30 organizations, and a second against Mexican government institutions. The former attack was split into small routine-looking tasks that told the existing defense it was part of new defense testing. It looked like an authorized pentest from its parts, but the true intent (theft of data) only became apparent when the requests came together in the right sequence.
It is the ability of AI to separate an attack into multiple individually benign steps that defeats traditional defenses and requires this new form of neurosymbolic threat detection. But it is not a ‘write once and move on’ requirement. Attackers are constantly developing new approaches to their attacks. So, whenever a new attack technique is recognized, defenders must respond immediately by writing a new Quarry rule that can be used by all organizations everywhere.
But writing new rules by hand does not scale against the attackers’ use of AI to develop new malicious agents. “We want agents, as well as security and AI engineers, to be able to write Quarry rules,” declares Cisco. A Quarry Plugin allows a coding agent to compose, compile, and refine rules from a plain-English description of an organization’s risk, and then test those rules against real conversations. A rule that passes in a coding agent should behave the same way at runtime.
By open sourcing the project, the traditional cybersecurity asymmetry of attack and defense (multiple attackers against individual defenders) is equalized (multiple global attackers now face multiple global defenders). Allowing the use of AI for development also balances the speed advantage that bad actors have enjoyed in AI-assisted attacks.
“The open-source project,” says Cisco, “gives practitioners a working foundation for detection engineering.” The Quarry starter pack includes:
- a readable DSL for conversations, tool use, and event relationships;
- an evaluation runtime with configurable safety and resource limits, which compiles each rule when it loads;
- a command-line scanner for individual traces, directories, and datasets;
- a Python SDK for application integration;
- optional configured model operations for semantic signals;
- the Quarry plugin for Claude Code, Codex and other MCP-compatible agents;
- rule metadata, examples, documentation, and message-format guidance; and
- a workflow for validating rules against positive and benign datasets.
Project Quarry is intended to become a common, open standard for expressing and sharing detections for AI-agent attacks, much as Snort, YARA, and Sigma became standards in other areas of cybersecurity. “Hugging Face reconstructed roughly 17,600 agent actions after the fact,” says Cisco. “Our aim with Project Quarry is to help defenders recognize sequences like that one while they are still in progress, and to preserve the evidence behind each finding for the people who have to act on it.”
Related: First Agentic AI Data Breach Reported to Spanish Regulator
Related: Agentic AI Used to Conduct Ransomware Attack via Langflow
Related: UK Government Rolls Out Agentic AI Defense Plan Alongside Industry Pledge
Related: Rig Security Emerges From Stealth With $12M to Tackle Agentic AI Identity Risks