Full-session review can expose hacking sprees by ai agents; Cisco open sources Quarry tool for detecting risks

Why session context matters

Many detection systems look for individual actions, such as prompt injection attempts or the use of an attack tool. Cisco argues that a single action can appear harmless without the surrounding steps.

Amy Chang, Cisco’s head of AI threat and security research, compared this challenge to credit card fraud detection. A configuration-file read and an external request may each be legitimate, but together they could indicate data exfiltration.

Quarry evaluates relationships between actions across an agent session. One tool call might seem appropriate until a later step sends the information to an attacker-controlled inbox or server, Chang said.

What Quarry can monitor

Quarry covers single- and multi-turn large language model conversations, AI agents, tool use, Model Context Protocol interactions and multimodal inputs. Its rules can flag specific activity for review or blocking.

Chang said a rule would block a tool call containing base-64 encoded malware. Another rule can flag tool calls that contact an external server not included on a task’s allow list.

Possible relevance to Hugging Face

Cisco researchers have not tested Quarry on data from the OpenAI-Hugging Face incident. They said a complete, step-by-step record of the session could have provided several opportunities for Quarry rules to flag the agents’ actions for human review.

Rules still need oversight

Cisco researchers said Quarry’s rules do not replace chain-of-thought monitors or other forms of human oversight. They described the tool as a way to record behavior patterns that other teams can review, test and apply to their agents.