The US Army wants AI agents that can navigate adversary networks, identify targets and disable them with minimal human oversight.
Documents obtained by The Intercept reveal that US Army Cyber Command (ARCYBER) is exploring ECHOTRIBBLE, an AI framework designed to identify and neutralize targets across adversary computer networks with minimal human oversight.
The initiative, formally called the Agentic C2 Framework Tool, has advanced through vendor demonstrations. The Cyber Fusion Innovation Center, which is working with ARCYBER, says one company was selected for an award on Oct. 8, with a statement of work and contracting actions still forthcoming. That selection does not establish that an operational offensive cyber tool exists.
According to documents reviewed by The Intercept, the proposed system would be designed to disable targets temporarily or permanently. Its agents would also conceal their activity, limit communications with military operators and delete themselves after completing their missions. The public requirements call for deployment in cloud-native and air-gapped environments; they do not establish an ability to independently cross an air gap.
A presentation reviewed by The Intercept described a hypothetical scenario in which an agent uploaded to a laptop identifies additional targets and creates versions of itself for an iPad, an Apple desktop and a Windows 11 PC.
Autonomous attacks could escape their intended targets
The plan comes as AI agents have demonstrated unexpected behavior during cybersecurity tasks. Recent incidents involving Hugging Face infrastructure, Australian government computers and malicious software uploaded to RubyGems have raised concerns about agents acting beyond their intended scope.
David Krueger, a University of Montreal machine learning professor, told The Intercept that autonomous systems tasked with neutralizing threats could cause serious harm because of known failures in current AI technology.
The concern extends beyond military networks. Hyrum Anderson, CEO of AI security firm Abundant, warned that an agent pursuing a target could pass through civilian infrastructure along the way. He told The Intercept: “Will it go through a US water utility on its way, because that’s where the adversary has staged its command and control, and take that down too?”
ARCYBER did not respond to The Intercept's questions about safeguards against unintended damage.
The Army is also developing defensive AI agents
The offensive project is part of a wider Army push toward autonomous cyber operations. Federal News Network reported that ARCYBER has also developed AI agents for defensive cyber protection teams under Task Force Lexington.
Those agents have trained in sandbox environments and subsequently operated within parts of the Army's Defense Information Network. Army Cyber Command chief Lt. Gen. Christopher Eubank said the agents had not strayed from their assigned roles, attributing that record to strict limits and daily human checks.
The Army is also pursuing Project Griffin, which aims to develop agents capable of autonomously responding to cyberattacks within human-defined parameters. The distinction matters: AI can help defenders respond faster, while proposed offensive agents capable of replication and covert operation raise additional questions about containment and unintended damage.
Why civilian security teams should pay attention
Anderson’s warning concerns collateral damage: an agent pursuing an adversary could encounter civilian infrastructure that the adversary has compromised. That is a hypothetical risk, not evidence that ECHOTRIBBLE has damaged business networks.
For security teams, the distinction matters. A civilian organization could become relevant to a cyber operation because an adversary is using its systems, even if the organization itself is not the intended target. Detecting compromised accounts, unexpected remote access and unusual outbound connections remains important regardless of who is operating the intrusion.
The project also raises a question for businesses deploying their own AI agents: can technical controls enforce the limits described in an agent’s instructions? Permissions should restrict which systems an agent can reach and what it can change, with human approval required for destructive actions or expansion beyond its assigned scope.
Monitoring should make those boundaries reviewable. Teams should retain activity logs outside the agent’s control and have a tested way to revoke credentials and stop execution. These are practical safeguards for enterprise deployments, rather than confirmation that the Army has implemented them.
The unresolved issue for ECHOTRIBBLE is whether its safeguards can contain self-directed behavior under operational conditions. Vendor selection and demonstrations alone do not answer that question.
Read more: An OpenAI research agent’s unauthorized use of a test cryptocurrency wallet illustrates why completing an assigned task does not prove an AI agent stayed within its permissions.