As global governments<\/span> and tech giants reckon with widespread of revelations of autonomous AI agents unexpectedly breaking into computer systems, documents obtained by The Intercept show the U.S. Army is looking to harness that exact technology to seek and destroy.<\/p>\n Army Cyber Command is developing a platform to turn AI agents into autonomous weapons that can navigate and \u201cneutralize\u201d the computer systems of adversaries, the documents show.<\/p>\n Since 2010, Army Cyber Command, or ARCYBER, has led the U.S. Army\u2019s cyber operations. This includes the defensive effort of protecting domestic computer systems and the secretive offensive work of hacking military targets. So far, this has largely been the work of human soldiers operating computers, like those of the 780th Military Intelligence Brigade. But as the government races to adopt artificial intelligence technology, ARCYBER is looking to offload some of its attacks to AI.<\/p>\n The nascent program, codenamed \u201cECHOTRIBBLE,\u201d is based on one of the leading trends of the AI boom: agents. AI agents are essentially software programs that leverage machine learning technology, often large language models like Anthropic\u2019s Claude, to autonomously accomplish tasks provided by their user. Consumers can deploy AI agents to schedule meetings, generate itineraries, make online purchases, or book tickets. Through ECHOTRIBBLE, the Pentagon plans to turn AI agents into tools of war \u201cdesigned to autonomously navigate infrastructures\u201d and capable of \u201cidentifying and neutralizing identified threats\/targets,\u201d according to an ARCYBER document reviewed by The Intercept circulated to potential contractors.<\/p>\n The military\u2019s adoption of cutting-edge technologies is unsurprising, especially considering Defense Secretary Pete Hegseth\u2019s fervent embrace of AI<\/a>. But amid constant revelations<\/a> of rogue behavior<\/a> by agents, the potential for serious mishaps is immense, experts warn.<\/p>\n \u201cGiven the known failure modes of the current AI paradigm, making autonomous AI systems with a mandate to \u2018neutralize threats\u2019 is incredibly dangerous,\u201d David Krueger, a professor of machine learning at the University of Montreal who founded Evitable, an organization that advocates for a moratorium on AI development. \u201cWe\u2019ve seen AI systems knowingly attack systems that were not intended targets. In simulations, AIs have even proven willing to kill to achieve their goals.\u201d<\/p>\n <\/p>\n A Q&A document answering questions from potential contractors offers more details about the initiative. It explains that ECHOTRIBBLE is \u201cprimarily focused\u201d on offensive missions, and explains that \u201cneutralizing\u201d a target could include \u201cdisabling the threat completely or temporarily, deleting the threat from the target.\u201d ECHOTRIBBLE would function almost like a computer worm, silently navigating a foreign network and hopping from device to device until it finds the Army\u2019s quarry, hitting targets in the cloud as well as those on \u201cair-gapped\u201d systems that are disconnected from networks entirely.<\/p>\n Once its task is complete, ECHOTRIBBLE\u2019s agents would effectively self-destruct, ideally without having been noticed by the target at all. The agents themselves will be designed for stealth, minimally reporting back to the Army and concealing whatever outside transmissions are necessary.<\/p>\n \u201cWe\u2019ve seen AI systems knowingly attack systems that were not intended targets.\u201d<\/p>\n<\/blockquote>\n<\/figure>\n Although documents say the Army will be able to program ECHOTRIBBLE agents with some initial \u201cpredefined triggers\u201d \u2014 dictating what and where to attack \u2014 the software \u201cmust operate with minimal human oversight\u201d and be capable of \u201cSelf-Directed Behavior.\u201d<\/p>\n A PowerPoint presentation to interested vendors at a June 24 ARCYBER event<\/a> provided a hypothetical example of this self-direction. Once ECHOTRIBBLE is uploaded to a laptop, the software on its own \u201cidentifies other potential targets\u201d on the same network and then \u201cproduces a replica of itself tailored specifically for the iPad, Apple desktop, and Windows 11 PC.\u201d<\/p>\n The Army\u2019s move toward autonomous self-propagating comes after a flurry of revelations about agentic systems taking unintended disturbing actions while attempting to accomplish their goals, including breaking into computers of the Australian government, breaching the infrastructure<\/a> of the AI firm Hugging Face, uploading malicious software into online platform RubyGems, and attempted to hack into<\/a> the U.S. Education Department.<\/p>\n These attacks occurred during scenarios in which agents had been given no commands to attack anything. Experts say militarized versions given explicitly destructive objectives could cause a threat to the public, even with nominal rules set in place by the military. Just as the Army of old<\/a> might consider the destruction<\/a> of civilian infrastructure<\/a> an acceptable means<\/a> to an end<\/a>, a self-directed AI agent dispatched by the Pentagon might make similar determinations about collateral damage.<\/p>\n Governmental intelligence agencies frequently route their offensive operations through civilian devices. Volt Typhoon, a Chinese state hacking group, has directed its attacks through homes and small businesses, and preemptively hacks American IT systems for later use. A hack of a Chinese university attributed to the National Security Agency made use of the school\u2019s internet routers. What happens if ECHOTRIBBLE decides these kinds of stepping stones are part of the problem?<\/p>\n \u201cThe target may well be hit. But what path will it take?\u201d asked Hyrum Anderson, co-founder and CEO of the AI security firm Abundant. \u201cWill it go through a US water utility on its way, because that\u2019s where the adversary has staged its command and control, and take that down too?\u201d<\/p>\n Anderson, who previously worked in cybersecurity at Microsoft and for the U.S. government, said that a vast amount of the internet is vulnerable to agentic attacks.<\/p>\n \u201cThere\u2019s a huge class of public and private organizations that fall below the security poverty line,\u201d he said. \u201cThey include critical national infrastructure, small businesses, mom-and-pop shops, dentist offices and law firms, and whoever else doesn\u2019t have a single cybersecurity professional on staff.\u201d With their networks wide open to infiltration, Hyrum worries about \u201cthese organizations getting hit directly, or getting caught in the blast radius of a target that gets hit along the way.\u201d<\/p>\n Given the impressive ability of AI agents to overcome obstacles placed in their path \u2014 even by their creators \u2014 it follows that the Pentagon would want to leverage that power for military purposes. But agentic software has proven unpredictable and prone to executing its commands in ways those ostensibly in control did not want, akin to a drone that get its target but hits a hospital on the way. It\u2019s critical to remember that agents are a piece of software lacking human judgment.<\/p>\n\n
![\"\"](\"https:\/\/theintercept.com\/wp-content\/uploads\/2026\/10\/Picture1.jpg?fit=1430%2C812\")