AI agents are software programs, often built on large language models, that carry out tasks on their own.
According to an ARCYBER document sent to potential contractors, the agents would be "designed to autonomously navigate infrastructures" and be capable of "identifying and neutralizing identified threats/targets." A Q&A document says the effort is "primarily focused" on offensive missions.
That comes after reports of AI agents breaking into systems they were never told to attack, including Australian government computers, Hugging Face's infrastructure, the RubyGems platform, and a U.S. Education Department attempt.
Experts quoted by The Intercept warn that agents given destructive goals could cause collateral damage.
Hyrum Anderson, CEO of the AI security firm Abundant, asked whether an agent might route through a U.S. water utility and take it down, noting that many critical-infrastructure operators and small businesses lack any cybersecurity staff.
William Marcellino of the RAND Corporation said current public AI lacks the judgment that human operators bring.
The documents describe a design resembling a computer worm. It would move silently from device to device inside a foreign network, reaching cloud systems and "air-gapped" machines disconnected from networks, then self-destruct once its task is done, ideally undetected. Neutralizing a target could mean disabling a threat temporarily or completely, or deleting it. The Army could set initial "predefined triggers," and a June 24 vendor presentation showed software on a laptop identifying other targets on the network and building copies tailored for an iPad, an Apple desktop, and a Windows 11 PC. ARCYBER did not respond to The Intercept's questions about safeguards, and the risks will likely depend on what guardrails the Army imposes, which experts say are hard to enforce on autonomous agents.