The U.S. Army is developing AI agents that would move through foreign computer networks, pick out targets and disable them with “minimal human oversight,” according to documents obtained by The Intercept. The program, codenamed ECHOTRIBBLE, is run by Army Cyber Command (ARCYBER). It is still at an early stage. What makes it notable is less the technology than a gap in the rules: the Pentagon’s main policy on autonomous weapons does not cover cyber tools at all.
What the documents describe
The Intercept, in a report by Sam Biddle on October 19, reviewed a document ARCYBER circulated to potential contractors, a question-and-answer sheet for vendors, and a slide deck shown at an industry event on June 24. Together they describe AI agents “designed to autonomously navigate infrastructures” and tasked with “identifying and neutralizing identified threats/targets.” The program is “primarily focused” on offensive missions.
“Neutralizing,” in the vendor Q&A, can mean “disabling the threat completely or temporarily” or deleting it from the target system. The Army would set “predefined triggers” for what and where to attack. After that, the software “must operate with minimal human oversight” and be capable of “Self-Directed Behavior.”
The slide deck walks through a hypothetical. The software is uploaded to a laptop, finds other devices on the same network and builds versions of itself for an iPad, an Apple desktop and a Windows 11 PC. The documents also call for agents that work in cloud systems and in “air-gapped” networks, which are physically cut off from the internet, that report back to operators as little as possible, and that delete themselves after the job. The Intercept compares the design to a computer worm, malware that copies itself from machine to machine.
How far along it is
The formal name, according to eSecurity Planet’s review of the program, is the Agentic C2 Framework Tool (“C2” is military shorthand for command and control). It is being run with the Cyber Fusion Innovation Center, a nonprofit in Augusta, Georgia, that connects the Army with private companies. The center says one company was selected on October 8, with the statement of work and contracts still to come. The winner has not been named.
That makes ECHOTRIBBLE a set of requirements and a chosen bidder, not a working weapon. The requirement to run in air-gapped environments also does not show that the software could cross an air gap on its own. ARCYBER did not answer The Intercept’s questions, including how it would prevent unintended damage.
The Army is working on defensive AI agents too. eSecurity Planet points to ARCYBER’s Task Force Lexington, whose agents have operated inside parts of the military’s own network. Army Cyber Command’s chief has said those agents stayed within their assigned roles because of strict limits and daily human checks. ECHOTRIBBLE’s documents ask for the opposite: minimal check-ins, inside someone else’s network.
The bystander problem
Offensive cyber operations often pass through other people’s machines. The Intercept notes that state hackers routinely route attacks through civilian devices, as China’s Volt Typhoon group has done with American routers. An agent hopping from device to device on its way to a target could end up in a water utility or a small business with no security staff.
“The target may well be hit. But what path will it take?” Hyrum Anderson, chief executive of the AI security firm Abundant, told The Intercept. He warned that agents under pressure “treat guardrails as obstacles.” David Krueger, a machine learning professor at the University of Montreal, called autonomous systems with a mandate to “neutralize threats” “incredibly dangerous.” RAND’s William Marcellino said goal-driven machines without human judgment could “go sideways.”
Those warnings are not abstract. The Intercept lists recent cases in which AI agents from commercial labs got into Australian government systems and Hugging Face’s infrastructure and tried to break into the U.S. Education Department, as we covered in our report on AI agents and government websites. None of those agents had been told to attack anything. ECHOTRIBBLE would start from an instruction to attack.
A rule that does not apply
The Pentagon does have a policy for weapons that select and engage targets on their own: DoD Directive 3000.09, updated in 2023. It requires that such systems allow “appropriate levels of human judgment over the use of force” and go through senior review before development and fielding. But as DefenseScoop reported when the update came out, “autonomous or semi-autonomous cyberspace capabilities are not subject to Directive 3000.09.” Michael Horowitz, then the official in charge of the policy, said cyber had been excluded since the original 2012 version and that “a number of different policies” govern cyber systems instead.
Those other policies are largely classified, so the public cannot see what rules would apply to an agent like ECHOTRIBBLE. The result is that a drone that picks its own target faces a published review process, while software designed to pick and disable targets across networks does not.
Our take
Writing requirements is not the same as building a working weapon, and it is fair to note how early this program is. But the requirements themselves are worrying: stealth, self-replication, minimal reporting and minimal oversight are the traits that make an agent hardest to stop if it goes wrong. Commercial AI agents have already wandered into systems they were never meant to touch. The Pentagon wrote clear public rules for autonomous weapons that fire missiles; it should do the same for autonomous code that can break things in networks other people depend on, before a prototype exists rather than after.