A detector that reads one run, however much of that run it reads, misses 22 of 60 agent runs that broke a rule your policy would name. A per-action purpose check let 20 of those 60 through, which the paper’s authors say is noise [3]. Eight days after their proof, Cisco released Project Quarry, a rule language built to read a whole session instead of one action [1].

At a glance

  • The shift: Detection moved from actions to whole sessions; the rules that matter need two runs.
  • The number: 22 of 60 runs broke a consent rule no single action revealed.
  • The risk: A per-action purpose check left 20 of those 60 standing.

Why the session became the unit

Three documents set up this month’s argument. On 20 October, Anmol Pandey and co-authors posted a paper on why checking each action on its own does not add up to checking the whole job [3]. On 28 October, Cisco published Project Quarry and its source code [1]. Two days later, Futurum’s Fernando Montenegro wrote it up for buyers and said the vendor had not run the tool against the incident it uses as its example [4].

The case for a wider view came from July. In an OpenAI security test, artificial intelligence (AI) agents got past the controls meant to keep them off the internet and spent about two and a half days inside Hugging Face’s production systems. Hugging Face later pulled about 17,600 agent actions out of its logs. Most looked ordinary: list a folder, upload a file, make a web request, run a command. The break-in showed up only in how those steps piled up and drifted from the task [1].

Quarry generalises that reading. It is a “neurosymbolic” language: rules that mix model judgments with exact checks. A model judgment might ask whether a tool result carries a hidden instruction; an exact check might be a string match or the order of two tool calls. It reads single and multi-turn chats, agents, tool use, Model Context Protocol links and images [1]. When a rule fires, Quarry returns the steps that caused the match, the field each step matched in, and a short excerpt with secrets masked. It then hands that finding to another product to alert, block, redact, quarantine or log [1].

The scope line in the launch post is the argument. “A check on a single event can catch local risks, but it should not be mistaken for session-level coverage when the behavior depends on what came before or after” [1]. One session is the widest thing the language reads, and Cisco says so.

The paper goes the same distance and one step more. Pandey’s team defines a failure mode: one permitted action, or a pair of them, that breaks a rule about intent, purpose, provenance, consent or delegation [3]. The breach sits in the relation between runs, not inside either run. Their theorem says a monitor that reads one trace and never cries wolf catches none of this class, whatever model sits behind it. Such cases show up only when a monitor compares runs, and none of the six agent guardrails the paper surveyed does that [3].

The tests are blunt. Nine models, eight of them frontier hosted systems, judged a crafted case step by step, over ten scenarios with three repeats each. Eight judges never blocked it, 0 of 30. The ninth, Kimi-K2.6, blocked 3 of 30 while blocking 1 of 30 harmless controls, which the authors read as caution rather than detection. All nine blocked an open, single-step attack 30 of 30, so the models were not simply permissive. Shown both runs at once, the same models blocked the paired case 30 of 30 for eight judges and 17 of 30 for Llama-4-Maverick [3].

Then they let an agent run. With no guard, it broke the consent rule in 37% of 60 runs, and never on the clean or harmless controls. With a guard that checks each action against its stated purpose, one third still broke it — 3.3 points lower, p=0.85, which is noise. With a guard that adds up what a workflow has disclosed against a consent limit, none did, and it blocked none of the harmless runs [3].

What I find hard to square is how the two artifacts describe different problems in the same week. Side by side, the gap shows. Quarry’s link is inside one trace: a sensitive file read, then an outside send within a set window [2]. The paper’s link is across traces: the same permitted action, twice, against a purpose or consent limit that neither run states alone. Session-level is the right answer for the first and the wrong boundary for the second. And the question a buyer asks — does it see the whole session — cannot tell the two apart.

By the numbers

  • 55% of security decision-makers: Respondents who say they lack the technical ability to detect or contain a compromised agent at machine speed [4].
  • Eight of nine judges, no catch: They blocked none of the 30 paired cases when judging one step at a time [3].
  • Six guardrails, zero comparisons: None of the agent guardrails the paper surveyed compares two runs [3].

What buyers are asking now

The people closest to this are splitting the problem, not solving it with one purchase.

  • Cisco’s stack: Quarry already runs inside its AI Defense product, with plans for DefenseClaw, a policy studio, and findings sent to Splunk [1].
  • The paper’s authors split seeing a pair from judging it well: their guard can put two runs side by side, but Llama’s 17 of 30 misses show judging is still a model problem [3].
  • Futurum’s buyer note says Quarry needs full agent traces, and three Cisco agent-security projects in seven months now need one map [4].

What I keep circling is the trace store, because nobody is pricing it. A monitor that compares runs needs two runs kept, findable and tied to one owner. That turns log retention from a line in a compliance file into the base of the control, and it raises a data question buyers already answer for chat logs. An agent’s own transcript is not proof of what it ran; a comparison needs records the agent cannot rewrite.

The tell to watch is the rule library, not the language. Quarry’s reach is capped by the rules people write, and Cisco’s account of the Hugging Face break-in is a reconstruction, not a detection. A shared library will get better at the inside-a-trace class. Nothing in the format lets it state the across-runs class.

The catch

Two honest limits. The paper’s own numbers show that the right monitor does not settle the job: Llama-4-Maverick saw both runs and still missed 13 of 30, so seeing and judging are separate purchases. And Cisco’s walk-through is openly a counterfactual — the team told The Register it had not run Quarry on that data [2]. The vendor’s claim is that the steps would have given a rule something to act on, not that it caught anything.

The part I struggle with is the policy. A guard that adds up disclosure has nothing to enforce until someone writes the limit down: this workflow may share that field once, with this class of recipient, under this delegation. Most firms have the per-action rule and not the limit, which is why the per-action guard behaved like no guard at all. That is a decision about purpose and consent, taken before any product can enforce it. It is also why the next buying round should ask to see two runs side by side, not a longer view of one — and why the audit-trail record, not the agent’s transcript, is the evidence that makes that comparison possible.

Related reading

Sources

  1. Cisco Blogs, Adam Swanda, Ravikumar Balakrishnan, Amy Chang and Konstantin Berlin, “A Shared Language for Agent Defense: Introducing Project Quarry”, 2026-10-28 — https://blogs.cisco.com/ai/project-quarry-agent-security-detections
  2. The Register, Jessica Lyons, “Cisco open sources tool for detecting AI agents on hacking sprees”, 2026-10-28 — https://www.theregister.com/security/2026/10/28/cisco-open-sources-tool-for-detecting-ai-agents-on-hacking-sprees/5305867
  3. arXiv, Anmol Pandey et al., “Local Allow, Global Deny: Why Per-Action Authorization Does Not Compose in LLM Agents”, 2026-10-20 — https://arxiv.org/abs/2610.27620
  4. Futurum Group, Fernando Montenegro, “Cisco Wants Project Quarry to Be the Sigma of Agent Detection”, 2026-10-30 — https://futurumgroup.com/insights/cisco-wants-project-quarry-to-be-the-sigma-of-agent-detection