思科已将一款用于监视AI智能体的行为检测引擎开源，以帮助安全团队防止失控的智能体像“抱抱脸”黑客事件那样越轨行事——或者造成更严重的后果。该项目名为“采石场计划”，旨在为评估智能体行为提供一种“共同语言”，其思路类似于思科同样维护的Snort在检测恶意网络流量方面所做的工作，以及YARA在基于规则的恶意软件识别方面所做的工作。
Cisco has open sourced a behavior detection engine that watches AI agents, to help security teams prevent rogue agents from going off the rails like they did with the Hugging Face hack – or worse. It’s called Project Quarry, and it aims to provide a “shared language” for evaluating agent behavior, along the lines of what Snort, which Cisco also maintains, did for detecting malicious network traffic and what YARA did for rule-based malware identification.
大多数检测工具依赖于与AI模型或智能体的特定交互。它是否尝试了提示注入？或者该智能体是否调用了攻击工具？思科AI威胁与安全研究负责人艾米·张在接受《The》独家采访时表示：“但缺失的是某件事可能发生时所处的完整上下文。”她将此比作信用卡欺诈检测。没有上下文，单笔交易——比如一笔小额测试扣款，或一次发生在远离持卡人常用地点之外的单独消费——可能不会引起任何警觉。
Most detection tools rely on specific interactions with an AI model or agent. Did it attempt prompt injection? Or did the agent call an attack tool? “But what is missing is the entire context under which something may occur,” Amy Chang, head of AI threat and security research at Cisco, said in an exclusive interview with The. She likened this to credit card fraud detection. Without context, individual transactions such as a small test charge or a single purchase in a location far away from a card-holder's usual location may not raise any flags.
“然后你再试一次，”进行另一笔欺诈性消费，“那笔也通过了。所以现在我要去买PS5了，”张说。“这些正是‘采石场’通过考量整个智能体会话来解决的问题，”她解释道。“一次工具调用可能看起来在合理范围内，直到你意识到下一步就是把该信息发送到攻击者控制的收件箱或服务器。”甚至数据窃取也是一个序列，而非单一的智能体动作。
“And then you try again,” making another fraudulent purchase, “and that went through, too. So now I’m gonna buy the PS5,” Chang said. “Those are the things that Quarry addresses by taking into consideration the entire agent session,” she explained. “One tool call may seem in-scope until you realize that that next step is taking that information and sending it to an attacker-controlled inbox or server.”Even data theft is a sequence and not a single agentic action.
智能体AI安全公司Invariant Labs通过一次针对GitHub MCP服务器的概念验证攻击演示了这一点：该攻击通过一个恶意的GitHub Issue劫持了用户的智能体，并胁迫其泄露私有仓库中的数据。单纯读取配置文件，或向外部端点发送请求，都可能是合法的智能体动作。
Agentic AI security firm Invariant Labs demonstrated this with a proof-of-concept attack against GitHub's MCP server that hijacked a user's agent via a malicious GitHub Issue, and coerced it into leaking data from private repositories. Simply reading a configuration file, or sending a request to an external endpoint may be legitimate agentic actions.
然而，将两者结合起来可能导致数据外泄——这也说明了“为什么动作之间的关系很重要”，Chang与思科研究员亚当·斯万达、拉维库马尔·巴拉克里希南和康斯坦丁·柏林在《The》提前获得的一篇关于Quarry的博客文章中写道。“当追踪记录显示在既定时间窗口内先读取了敏感文件、随后又发生了对外发送时，一条策略就能产生一条发现结果，”他们写道。
However, combining the two can lead to data exfiltration – and shows “why action relationships matter,” wrote Chang and fellow Cisco researchers Adam Swanda, Ravikumar Balakrishnan, and Konstantin Berlin in a blog post about Quarry shared with The ahead of publication “A policy can produce a finding when the trace shows a sensitive file read followed within a defined window by an external send,” they wrote.
“风险来自这两个动作之间的关系，因此该发现结果应当保留两者的证据。”Quarry覆盖单轮和多轮大语言模型对话、智能体、工具使用、模型上下文协议（MCP）交互以及多模态输入。除开源代码本身外，该项目的GitHub仓库还包含安装说明、支持的Python版本、适用于Claude Code、Codex及其他兼容MCP的智能体的插件、配置示例、规则编写指南以及一个规则入门包。
“The risk comes from the relationship between the two actions, so the finding should preserve evidence from both." Quarry covers single- and multi-turn large language model conversations, agents, tool use, Model Context Protocol (MCP) interactions, and multimodal inputs. In addition to the open source code itself, the project’s GitHub repository includes installation instructions, supported Python versions, plugins for Claude Code, Codex and other MCP-compatible agents, configuration examples, rule-writing guidance, and a rule starter pack.
例如，借助该规则包，“如果工具调用中某处出现了base-64编码的恶意软件，那就会被拦截，”Chang说。规则格式看起来类似于YARA或Snort规则，带有详细说明要检查的流量、要匹配的内容以及用于跟踪该规则的元数据的头部。下面是一条Quarry规则，用于标记读取凭据文件的智能体：尽管思科AI研究人员尚未用描述OpenAI- Hugging Face事件的数据运行Quarry，但他们表示，如果将该入侵事件作为单一会话的完整、逐步记录来解读，那么AI智能体的多个步骤本可以为Quarry规则提供可据以采取行动并向人类标记的内容。
For instance, with the rule pack, “If a base-64 encoded malware is somewhere in the tool call, that would result in a block,” Chang said. The rule format looks similar to a YARA or Snort rule, with a header that details the traffic to examine, content to match, and metadata for tracking the rule. Here’s a Quarry rule that flags an agent that reads a credentials file: While the Cisco Ai researchers have not run Quarry against data describing the OpenAI-Hugging Face incident, they suggest that if the intrusion had been read as a complete, step-by-step record of a single session, there were several points where the AI agents’ steps would have given a Quarry rule something to act on and flag for humans.
例如，Quarry很可能会标记出从沙箱发起的互联网访问。“该规则可以标记出那些访问了不在任务允许列表中的外部服务器资产的特定工具调用，”Chang说。
For example, Quarry would probably have flagged internet access from a sandbox. “The rule can flag specific tool calls that reach an external server asset that wasn’t in the task’s allow list,” Chang said.
“另一种情况是，凭据在其他地方被发现并使用。”根据OpenAI关于Hugging Face入侵事件的技术报告，7月10日，一名代理验证了14个具有写入权限的暴露Hugging Face令牌并将其共享，情况正是如此。“该规则会标记出，工具结果中存在一个凭据，随后该凭据调用了外部服务，而这很可能不在你希望在这种情况下采取的操作范围之内，”张说。
“Another one would be credentials found and used somewhere else.”According to OpenAI’s technical report about the Hugging Face intrusion, this is exactly what happened on July 10, when an agent validated 14 exposed Hugging Face tokens with write access and shared them. “The rule would flag that there was a credential in the tool result that then called an outside service, which is likely not within the parameters of what you would want to do in this case,” Chang said.
“我们不希望你去搜索可能已被泄露或无意中暴露的凭据，然后利用它们来执行任务。”思科团队很快表示，仅靠规则并不能替代思维链监控器或其他形式的人工监督——但它们确实有助于记录一种模式，其他团队随后可以“审查、测试并应用到自己的代理中”，他们写道。开源的好处以及集体应对AI对抗性使用的方法也在于此，张说。
“We don't want you to go and search for credentials that may have been leaked or inadvertently exposed and then utilize them to conduct a task.”The Cisco team is quick to say that rules along are not a substitute for chain-of-thought monitors, or other forms of human oversight – but they do help record a pattern that other teams can then “review, test, and apply to their own agents,” they wrote. Herein also lies the benefit of open source, and a collective approach to defending against adversarial use of AI, Chang said.
“我们拥有所有答案吗？没有，”张说。“我们每个人都只看到问题的一部分，分享我们所看到的内容很重要。”®
“Do we have all the answers? No,” Chang said. “We all see slices of the problem, and it’s important for us to share what we see.”®