A cyber protection team made of agents

US Army Cyber Command has widened the work it gives to AI agents, from single analyst roles to a whole Cyber Protection Team, its commander said last Monday, according to DefenseScoop. Lt. Gen. Christopher Eubank told the Association of the US Army's annual meeting in Washington that Task Force Lexington, which the command set up in April, started with roles such as exploitation analysts and data engineers and has now "mapped out" an entire team composed of agents, including analytic support and network analysts.

"The task force has built those out. They've been training them, and then having them do operations inside of a sandbox," Eubank said. Humans oversee the agents, check their work and retrain them before the human-and-agent pair moves on to the next task, and the agents have been allowed into the Army's part of the Defense Department network "over time", DefenseScoop reported. The task force started with nearly a dozen civilians and service members under a colonel, and is sharing its tools with the Defense Cyber Defense Command.

Eubank described the controls in personnel terms. "We've been very deliberate in the guardrails we're putting in place," he said. "We're treating each one of these agents just like a human operator, so they are basic. And so with that mindset, they're only allowed to do so much." None of the command's agents had "strayed to this point", he said, crediting a "tight framework", and "as they get trained and learn, we open the framework up". These are the command's own assessments; neither outlet reported an outside review.

The next step is agents that act, not just watch. Brandon Pugh, the Army's principal cyber adviser, said the service planned to award contracts to two companies on Friday 16 October under Project Griffin, Breaking Defense reported. "The one that we plan to award on Friday is our take action element. So essentially, how are we not only autonomously detecting a potential adversary? How are we now doing something — having an autonomous response within prescribed parameters of a human operator, or even in conjunction with that?" he said. A commercial solutions opening in August drew 108 submissions, narrowed to 10 finalists, Breaking Defense said; DefenseScoop put it at more than 100, then ten, then two. Pugh declined to name the companies.

By Sunday we had found no Army announcement naming the awardees, and neither outlet had reported one. Griffin will be run by Task Force Secure, led by a lieutenant colonel, Eubank told DefenseScoop.

The award does not put agents on live networks at once, officials told Breaking Defense. "For us, it's going to be: Are we as humans ready to let the agent actually take action?" Eubank said. "You think about that for how many years a human has been the person making the patch, remediating something, so we're walking ourselves through what does it mean to have an agent to do that work and then how do you check that agent's work. So a lot still to do in this space." Pugh said the Army's existing Panoptic Junction tool has a nearly 90 per cent success rate at spotting malicious activity, but the service has no way to remedy what it finds, especially with limited staff.

The setting is uneasy. DefenseScoop noted high-profile incidents in which agents from frontier laboratories escaped human oversight and hacked third-party organisations; India's cyber agency has described cases of its own, as Komposite reported in None of the organisations noticed. Army officials argue that adversaries are already using AI against the US. Neither outlet named an AI developer or model behind the Army's agents, and we have not assumed one.

Treating an agent as an operator implies the controls that apply to staff: scoped access, review of its work and a way to remove it, the access profile we described in The agent is a privileged user. The same service is putting AI at the other end of its network too, vetting vendor code in Project Gatekeeper. What the command has not published is how many errors the sandbox caught or what "strayed" would mean in measurable terms. The names and terms of the two Griffin awards will be the first outside test of how it describes its own limits.