The US Army wants AI agents that hack its enemies with almost no human oversight

The US Army is shopping for AI agents that can slip into computer networks, find targets and “neutralize” them with little human oversight, according to a public notice from Army Cyber Command and internal documents obtained by The Intercept. The program is called ECHOTRIBBLE.

The notice, posted on the government contracts site SAM.gov in July, invited companies to pitch an “Agentic C2 Framework tool designed to autonomously navigate infrastructures, identifying and neutralizing identified threats/targets.” It says the software “must operate with minimal human oversight” and be deployable in “contested, air-gapped, or cloud-native systems.”

What the Army asked for

The wish list in the notice reads much like a description of advanced malware, with optional AI built in. Companies were asked for a modular agent that can run on Windows, Linux and macOS and that offers:

• Self-directed behaviour: “configurable rule-based or prompt-driven logic for autonomous task execution”, with small language models running locally as an option.
• Stealth: memory-resident and fileless execution, “process name obfuscation”, randomised sleep cycles and “covert, low-bandwidth beaconing” back to its operators.
• Self-destruct: “policy-driven cleanup and recovery routines”, and software that spots when it is being analysed in a debugger and changes behaviour or shuts down.
• Controlled spread: what the notice calls “safe, rule-bound propagation”, moving only on “configured conditions or predefined triggers.”

The work is run through the Cyber Fusion Innovation Center in Augusta, Georgia, with Army Cyber Command (ARCYBER) and its technology centre, ArCTIC. Whitepapers were due on August 13, chosen companies gave private virtual demonstrations from October 6 to 8, and the notice says final selections would be emailed on or about October 15. Winners could get prototype deals and, if those succeed, follow-on production contracts awarded “without the use of competitive procedures.” The Army has not said whether anyone has been selected.

“Primarily focused” on attack

The public notice is mostly couched in defensive language such as anomaly detection, but the documents The Intercept obtained are blunter. A question-and-answer document for interested contractors says ECHOTRIBBLE is “primarily focused” on offensive missions, and defines “neutralizing” as “disabling the threat completely or temporarily, deleting the threat from the target.” A slide shown to vendors at a June 24 ARCYBER event describes software that “produces a replica of itself tailored specifically for the iPad, Apple desktop, and Windows 11 PC.” Those documents have not been published, so MadRobot could not check them.

ARCYBER did not respond to The Intercept’s questions, including how it would stop ECHOTRIBBLE from causing damage it did not intend.

“What path will it take?”

Experts who spoke to The Intercept said the risk lies in what happens between launch and target. David Krueger, a machine learning professor at the University of Montreal, called autonomous AI systems with a mandate to “neutralize threats” “incredibly dangerous”, adding: “We’ve seen AI systems knowingly attack systems that were not intended targets.” Hyrum Anderson, chief executive of the AI security company Abundant, put the worry this way:

The target may well be hit. But what path will it take? Will it go through a US water utility on its way, because that’s where the adversary has staged its command and control, and take that down too?

Hyrum Anderson, Abundant

William Marcellino, a senior behavioural scientist at the RAND Corporation who studies military AI, said today’s systems lack the judgment a human soldier brings:

If I give powerful machines that have no judgment, and no context for judgment, a goal, unless you’ve done a really good job building scaffolding around them, there’s a real chance that they’ll go sideways on you.

William Marcellino, RAND Corporation

The fear is not abstract. On Monday a single hacker set AI agents loose on 1,200 websites, and they broke into several big companies. Last week Geoffrey Hinton, Yoshua Bengio and 400 other scientists urged AI labs to cut hacking-capable models off from the internet.

Why it matters

ECHOTRIBBLE is one of the clearest signs yet that the US military wants AI agents that act on their own inside other people’s networks, not only AI that advises human operators. It sits alongside the Pentagon’s new command for autonomous warfare, and it arrives while nobody has shown how to keep a self-spreading agent from hitting the wrong system.

Sources: US Army, Agentic C2 Framework Tool (ECHOTRIBBLE) Assessment Event notice, SAM.gov; The Intercept.