Army is developing AI agents for offensive cyberattacks, The Intercept reports

U.S. Army Cyber Command is developing AI agents intended to navigate computer networks and disable targets with minimal human oversight, according to documents obtained by The Intercept. The disclosure describes a proposed offensive platform called ECHOTRIBBLE—not a deployed weapon—and raises concerns about what autonomous software might damage on its way to an adversary.

Sam Biddle’s October 19 report draws on materials circulated to potential contractors, including a question-and-answer document and a vendor presentation. Together, they outline software meant to do more than recommend an attack to a human operator: it would move through infrastructure, identify targets and act against them.

From one laptop to other targets

AI agents are software programs that use machine learning to carry out tasks for a user. In this case, the task would be offensive. The contractor Q&A describes ECHOTRIBBLE as “primarily focused” on offensive missions. Neutralizing a threat could mean disabling it temporarily or completely, or deleting it from the target system.

The proposed system would behave somewhat like a computer worm: software that moves from device to device. ECHOTRIBBLE is intended to navigate a foreign network quietly until it reaches its target. The requirements encompass cloud systems as well as “air-gapped” systems, which are disconnected from networks.

A presentation at a June 24 Army Cyber Command vendor event illustrated the intended behavior. In its hypothetical scenario, software placed on a laptop identifies other potential targets on the same network. It then creates copies tailored to an iPad, an Apple desktop and a Windows 11 PC. That example describes a design goal, not a demonstrated attack.

Initial instructions, then self-direction

The documents allow the Army to give agents initial “predefined triggers” governing what and where to attack. But they also require minimal human oversight and “Self-Directed Behavior.” The intended division is therefore not simply a person approving every move: the software would receive initial conditions and then make decisions as it proceeds.

Stealth is another requirement. Agents would report back to the Army only minimally and conceal necessary outside transmissions. After completing their task, they would effectively self-destruct, ideally without alerting the target. Those features describe a tool designed to operate quietly, rather than maintain a constant, visible exchange with its operators.

The target may well be hit. But what path will it take?

Hyrum Anderson, co-founder and CEO of AI security firm Abundant, speaking to The Intercept

Civilian systems along the route

Anderson’s concern is that reaching the right target would not necessarily spare systems along the way. He offered a hypothetical: an adversary stages its command-and-control infrastructure at a U.S. water utility, and an agent takes down the utility while pursuing it. This was a warning about possible collateral damage, not an incident attributed to ECHOTRIBBLE.

He also warned that organizations without dedicated cybersecurity staff—including small businesses and parts of critical infrastructure—could be hit directly or caught in an attack’s wider effects. RAND senior behavioral scientist William Marcellino raised a related concern: current public AI technology lacks the human judgment needed to recognize when pursuing an assigned goal would be inappropriate.

Army Cyber Command did not answer The Intercept’s questions, including what measures would prevent inadvertent damage. That leaves a central safeguard question unanswered: how the Army would constrain agents explicitly designed to select further targets and act with little human supervision.