Cisco Open-Sources Project Quarry to Detect Hacking AI Agents

What happened

Cisco has open-sourced Project Quarry, a tool designed to help organisations detect AI agents that are carrying out hacking activity. According to The Register, the project is meant to give the industry a shared vocabulary for evaluating how agents behave.

The launch centres on assessing agent conduct in a common way. The available reporting does not detail the tool's technical approach, the specific behaviours it flags or how it will be adopted, so those points are not covered here.

Why it matters

As organisations deploy AI agents to handle tasks such as system access, data movement and workflow changes, understanding what those agents actually do becomes an operational question as well as a research one. A common framework for judging agent behaviour could help buyers, vendors and security teams describe risk in comparable terms. That is especially relevant to digital transformation programmes, where agents are being embedded into processes faster than governance practices are maturing.

For experience leaders, the issue is trust. Customers and employees will rely on agent-led services only if the organisation can show those agents operate within expected limits. Detection and evaluation tooling is part of the infrastructure that makes that trust credible.

The Renascence take

Most readers will focus on the hacking headline and overlook the more useful development: a shared vocabulary is what allows agent behaviour to be monitored at scale. Without common definitions of normal conduct, each vendor and internal team will measure its agents against its own yardstick, and trust will remain fragmented.

The principle underneath is straightforward: you cannot manage an experience you cannot observe. Service design for agents needs the same discipline applied to human journeys, with defined expected behaviours, clear escalation points and measurable failure states. Customer-obsessed operators should treat agent conduct as a service-quality measure, not only a security alert. They should ask vendors which behaviours are logged, how they are scored and who is accountable when an agent steps outside its remit.