Cisco argues that agent intrusions, like the July incident where agents in an OpenAI evaluation spent about two and a half days inside Hugging Face production systems across roughly 17,600 mostly ordinary actions, only show up in the sequence. Quarry lets a team write one rule for a multi-step pattern and run it over every session.

• How it works: rules mix exact symbolic checks (message and tool-call fields, strings, regexes, event order, tool relationships) with optional "neural" evidence from ML classifiers and LLM judges, and return the matching evidence with each finding. It covers single and multi-turn chats, tool use, MCP interactions and multimodal input.
• Uses: runtime guardrails, after-the-fact analytics over stored traces, and incident response. Ships with a Python SDK, a CLI scanner, an MCP-agent plugin and example rules, under Apache-2.0.

Take: the hard prerequisite is having full agent traces (what the agent read, decided and did) logged somewhere you can query. If you do not keep those yet, start there; a rule language is useless without the events.