{"slug": "cisco-open-sources-project-quarry-to-detect-rogue-ai-agents", "title": "Cisco open sources Project Quarry to detect rogue AI agents", "summary": "Cisco Systems Inc. has open-sourced Project Quarry, a behavior detection engine that watches sequences of AI agent actions to help security teams spot agents gone wrong, the company said. Cisco reported $63.3B in revenue for its fiscal year ended 2026-07-25, up 11.8% year over year, with $13.267B in net income and a 24.3% operating margin. The release aims to give security teams a shared language for identifying misbehaving AI agents.", "body_md": "# Cisco open sources Project Quarry to detect rogue AI agents\n\nPhoto: Tima Miroshnichenko / Pexels\n\nThe behavior detection engine watches sequences of agent actions, aiming to give security teams a shared language for spotting AI agents gone wrong\n\n## Cisco Systems Inc. and its peers\n\n| Company | Price | Market cap | P/E (trailing) | Forward P/E | Annual revenue (USD) | Annual revenue growth | Annual net income (USD) | Operating margin | \n|---|---|---|---|---|---|---|---|---|\n| [Cisco Systems Inc.](https://cryptobriefing.com/markets/cisco/) CSCO · Price dated Oct 27, 2026 · tokenized CSCOx | $111 | $439.1B | 33.4 | Unavailable | $63.3BFY ended 2026-07-25 · [10-K](https://www.sec.gov/Archives/edgar/data/858877/000085887726000132/) | +11.8%FY ended 2026-07-25 vs 2025-07-26 · [10-K](https://www.sec.gov/Archives/edgar/data/858877/000085887726000132/) | 13,267,000,000FY ended 2026-07-25, attributable to the company · [10-K](https://www.sec.gov/Archives/edgar/data/858877/000085887726000132/) | 24.3%FY ended 2026-07-25 | \n| [Arista Networks Inc.](https://cryptobriefing.com/markets/arista-networks/) ANET · Price dated Oct 27, 2026 | $187 | $235.8B | 59.2 | Unavailable | $9.0BFY ended 2025-12-31 · [10-K](https://www.sec.gov/Archives/edgar/data/1596532/000159653226000013/) | +28.6%FY ended 2025-12-31 vs 2024-12-31 · [10-K](https://www.sec.gov/Archives/edgar/data/1596532/000159653226000013/) | 3,511,400,000FY ended 2025-12-31, attributable to the company · [10-K](https://www.sec.gov/Archives/edgar/data/1596532/000159653226000013/) | 42.8%FY ended 2025-12-31 | \n| [Palo Alto Networks Inc.](https://cryptobriefing.com/markets/palo-alto-networks/) PANW · Price dated Oct 27, 2026 · tokenized PANWx | $402 | $328.6B | 1,004.3 | Unavailable | $11.5BFY ended 2026-07-31 · [10-K](https://www.sec.gov/Archives/edgar/data/1327567/000132756726000023/) | +24.5%FY ended 2026-07-31 vs 2025-07-31 · [10-K](https://www.sec.gov/Archives/edgar/data/1327567/000132756726000023/) | 307,000,000FY ended 2026-07-31, attributable to the company · [10-K](https://www.sec.gov/Archives/edgar/data/1327567/000132756726000023/) | 6.1%FY ended 2026-07-31 | \n| [Dell Technologies Inc.](https://cryptobriefing.com/markets/dell/) DELL · Price dated Oct 27, 2026 | $502 | $321.3B | 29.2 | Unavailable | $113.5BFY ended 2026-01-30 · [10-K](https://www.sec.gov/Archives/edgar/data/1571996/000157199626000008/) | +18.8%FY ended 2026-01-30 vs 2025-01-31 · [10-K](https://www.sec.gov/Archives/edgar/data/1571996/000157199626000008/) | 5,936,000,000FY ended 2026-01-30, attributable to the company · [10-K](https://www.sec.gov/Archives/edgar/data/1571996/000157199626000008/) | 7.2%FY ended 2026-01-30 | \n\nMissing figures stay unavailable. Forward P/E requires a dated source. Annual revenue, revenue growth, net income and margin come from each company's own 10-K, in US dollars, and each row shows that fiscal year. Revenue growth compares the fiscal year with the prior year stated in the same 10-K. Net income is the full year amount attributable to the company, or available to common stockholders where the filing states only that, or consolidated net income. Each row names its basis. Trailing P/E reads \"Not meaningful\" when the dated trailing diluted EPS is a loss or zero. An operating margin appears only when the filing states both the operating income and the revenue for the same year.\n\nSources: SEC filings, Gloria daily closes and CoinGecko. Oldest record refresh: Oct 27, 2026, 8:43 PM EDT. Refresh is not a price or filing date. Each row shows its price date and its annual fiscal period. Peers use industry code and company size, or editorial selection. Market cap multiplies that row price by the company share total the latest SEC filing states for every share class together. Trailing P/E divides it by trailing diluted earnings from SEC filings. Rolled earnings per share are approximate because share counts can change between periods. Both appear only when the SEC data carries its date, so they are estimates at one price date, not synchronized filing valuations. Not investment advice.\n\n[Cisco](https://cryptobriefing.com/markets/cisco/) has released Project Quarry as open source. It is a behavior detection engine built to keep watch over AI agents and catch the ones that start misbehaving.\n\nCisco is framing Quarry around a specific worry: rogue agents that go off the rails, as they did in the Hugging Face hack. Or, in the company’s framing, something worse.\n\n## What Project Quarry actually does\n\nMost existing detection tools zero in on a single moment. They examine one specific interaction with an AI model or agent and judge whether it looks dangerous.\n\nQuarry takes a different route. It analyzes **sequences of actions** rather than isolated events, looking for risky behavior that only becomes visible over time.\n\nAn agent might take a series of steps that each look harmless on their own. Strung together, those same steps could add up to data leaking out or permissions being abused.\n\nCisco says the goal is a “shared language” for evaluating how agents behave. Instead of every vendor and security team writing its own private definitions of suspicious activity, Quarry aims to give everyone a common vocabulary.\n\n## The Snort and YARA playbook\n\nCisco is explicitly modeling Quarry on two well-known security projects. The first is Snort, which Cisco also maintains, and which became a standard way to detect malicious network traffic.\n\n### AI, tech, and the markets they move—in one daily briefing.\n\nDaily. Free. Join 34,000+ readers across crypto, finance, and policy.\n\nThe second is YARA, which did something similar for rule-based malware identification. Both projects succeeded partly because they gave defenders a common format for describing threats.\n\nIf Quarry catches on, a detection rule written by one team to flag a dangerous agent behavior could be reused by others. That is the network effect Snort and YARA built, and Cisco clearly wants a sequel.\n\n## Part of a broader Cisco push\n\nQuarry does not arrive alone. Cisco has rolled out several open-source security tools for AI agents under its AI Defense initiative across late 2025 and 2026.\n\nThat lineup includes the A2A Scanner, DefenseClaw, MCP Scanner and Skill Scanner. Each is aimed at improving how organizations detect problems in, and govern, autonomous AI operations.\n\nThe tools share a common thread. They rely on behavioral analysis techniques, including heuristics and static and dynamic inspection, focusing on patterns of behavior, mismatches in intent, and how agents communicate.\n\nThe Hugging Face incident served as a catalyst for Cisco’s attention to rogue agent risk.\n\n## Why this matters for security teams\n\nThe core problem Quarry addresses is visibility. Organizations are handing AI agents access to systems, data and tools, and those agents can take actions without a human approving every step.\n\nFor security teams, an open-source engine has practical appeal. They can inspect how it works, adapt it to their own environments, and contribute rules back.\n\n**Disclosure:** This article was edited by Diego Almada Lopez. For more information on how we create and review content, see our [Editorial Policy](https://cryptobriefing.com/editorial-policy/).", "url": "https://wpnews.pro/news/cisco-open-sources-project-quarry-to-detect-rogue-ai-agents", "canonical_source": "https://cryptobriefing.com/cisco-open-sources-project-quarry-ai-agents/", "published_at": "2026-10-28 12:11:11+00:00", "updated_at": "2026-10-28 12:15:35.723637+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-tools", "artificial-intelligence"], "entities": ["Cisco Systems Inc.", "Project Quarry", "Arista Networks Inc.", "Palo Alto Networks Inc.", "Dell Technologies Inc."], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/cisco-open-sources-project-quarry-to-detect-rogue-ai-agents", "markdown": "https://wpnews.pro/news/cisco-open-sources-project-quarry-to-detect-rogue-ai-agents.md", "text": "https://wpnews.pro/news/cisco-open-sources-project-quarry-to-detect-rogue-ai-agents.txt", "jsonld": "https://wpnews.pro/news/cisco-open-sources-project-quarry-to-detect-rogue-ai-agents.jsonld"}}