Army Cyber Command's ECHOTRIBBLE would turn AI agents into self-spreading cyberweapons
Internal documents show the Army Cyber Command is building AI agents that move through other networks on their own and "neutralize" targets. Experts warn the collateral damage would be nearly impossible to control.
The Army Cyber Command (ARCYBER) is developing a platform meant to turn AI agents into autonomous weapons, according to documents obtained by The Intercept . A paper for potential contractors says the program, codenamed "ECHOTRIBBLE," is "designed to autonomously navigate infrastructures." It's supposed to be capable of "identifying and neutralizing identified threats/targets."
Right now, soldiers at computers carry out most of ARCYBER's offensive hacking operations. A Q&A document for interested vendors makes clear that ECHOTRIBBLE is "primarily focused" on attacks. According to the document, neutralizing a target could mean "disabling the threat completely or temporarily, deleting the threat from the target."
The system is supposed to work like a computer worm, jumping undetected from device to device until it finds its target. That's meant to work in the cloud as well as on "air-gapped" systems with no network connection. Once the job is done, the agents are supposed to destroy themselves. The Army can set "predefined triggers" at the start, but the software "must operate with minimal human oversight" and be capable of "Self-Directed Behavior."
The Intercept reports that the program is still in its early stages. A presentation for potential vendors at an ARCYBER event on June 24 showed what it could look like. Once the software lands on a laptop, it "identifies other potential targets" on the same network and "produces a replica of itself tailored specifically for the iPad, Apple desktop, and Windows 11 PC."
ECHOTRIBBLE would turn AI lab accidents into a weapon
Over the past few months, agents in tests by OpenAI and other companies have repeatedly broken into outside systems and their developers' own systems without meaning to. Targets included RubyGems , Hugging Face , and the Australian government's Medicare statistics portal . Agents also tried to break into the US Department of Education. In none of these cases had they been told to attack.
AI systems have been seen knowingly attacking systems that weren't even their targets, says David Krueger, a machine learning professor at the University of Montreal. Given these known failure patterns, ordering autonomous systems to "neutralize" threats is "incredibly dangerous," he says.
Hyrum Anderson, CEO of AI security firm Abundant, also warns about damage on the way to the target. An agent could hit a US water utility, for example, if an adversary has set up its command infrastructure there. Organizations below a "security poverty line," from dental offices to critical infrastructure, face the most risk, he says. Under pressure, agents often treat guardrails as obstacles, and once the order is "destroy," the blast radius could grow dramatically.
William Marcellino of the RAND Corporation points to the systems' lack of judgment. People trust a 19-year-old Marine with live ammunition because he knows enough about the world to recognize what he shouldn't do, he says. Today's publicly available AI doesn't have that ability.
AI News Without the Hype – Curated by Humans
Subscribe to THE DECODER for ad-free reading, a weekly AI newsletter, our exclusive "AI Radar" frontier report six times a year, full archive access, and access to our comment section.
Read on for the full picture. Subscribe for hype-free coverage.
Full access to every article on THE DECODER
Join the comments and community discussions
A weekly AI news recap via mail
6x/year: "AI Radar" — deep dives on the AI topics that matter most
Daily AI news, always up to date
Covered by a team with 10+ years in AI