Cisco Open Sources Quarry to Catch AI Agent Attacks Hidden in Harmless Steps
Cisco open sourced Project Quarry, a rule language for detecting AI agent attacks that only emerge across sequences of benign actions.
Excerpt from the primary source: SecurityWeek
Who is affected
Enterprises
Affected technology: Cisco networking & security
What you should do · Be aware
No immediate action is indicated. Share this with the relevant teams and watch for updates.
Automated guidance based on this story's classification. Check the linked advisories for specifics.
Sources
We link to original and authoritative sources. Headlines and excerpts belong to their publishers.
Related
New Cisco firewall zero-day exploited to crash SSL VPN devices
Cisco released security updates to patch a denial-of-service zero-day in Adaptive Security Appliance (ASA) and Threat Defense (FTD) software that attackers are exploiting to remotely crash vulnerable firewall devices.
Source reporting says attackers are already exploiting this, so exposed Cisco networking & security systems are at immediate risk.
Treat this as an emergency.
NIK C2: The new AI-enabled command-and-control framework
Cisco Talos observed a new AI-integrated command-and-control (C2) framework in the wild called “NIK C2.”
Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August
Cisco on Wednesday released fixes for an exploited vulnerability affecting its Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) software. Tracked as CVE-2026-76418 and assigned a CVSS score of 8.6, the bug resides in the Remote Access SSL VPN service. Attackers can exploit it remotely, without authenticating, to force the device […]…
Source reporting says attackers are already exploiting this, so exposed Cisco networking & security systems are at immediate risk.
Treat this as an emergency.
Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN
Talos has identified UAT-11473, a highly sophisticated APT, who exploited CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances to bypass authentication and gain unauthorized access to affected systems to deploy KeyDrift.
CISA lists this as exploited in the wild. Unpatched Cisco networking & security and Catalyst SD-WAN Controller and Manager systems are exposed to active attacks now.
Treat this as an emergency.