ARCYBER expanding use of AI agents for network operations

Army Cyber Command is upping its use of AI for network operations, according to top service officials, expanding the number of work roles that AI agents are assigned to and teasing upcoming contracts expected to reshape the way service uses the technology in cyberspace.

Lt. Gen. Christopher Eubank, the head of ARCYBER, said Monday at the annual AUSA conference in Washington, D.C., that a team his command established earlier this year has continued to develop AI cyber agents, giving them additional responsibilities and allowing them to work in the Army’s portion of the Department of Defense Information Network (DODIN).

Task Force Lexington, which ARCYBER stood up in April, started developing a handful of cyber work roles that AI agents would tackle, such as exploitation analysts and data engineers. Now, he said, they’ve “mapped out” an entire Cyber Protection Team composed of agents, including for analytic support and network analysts, among other roles.

“The task force has built those out. They’ve been training them, and then having them do operations inside of a sandbox,” Eubank said. He added that humans oversee the agents’ actions, retrain them and then have let the agents work inside the Army’s network “over time.”  

The Army’s development of AI agents for cyber purposes comes amid deep concerns about the technology, especially after high-profile incidents where agents from frontier labs have escaped human oversight and hacked third-party organizations. 

At the same time, service officials have said that adversaries are wielding the technology against the U.S., and it is too powerful to sideline against those threats. 

Eubank said none of ARCYBER’s agents “have strayed to this point,” citing the command’s “tight framework” on using them.

“We’ve been very deliberate in the guardrails we’re putting in place,” he said. “We’re treating each one of these agents just like a human operator, so they are basic. And so with that mindset, they’re only allowed to do so much.”

Eubank described a process in which human operators check agent work in the network and retrain them before the human-machine pair moves on to the next task. At its outset, Task Force Lexington was staffed by nearly a dozen civilians and service members, and headed by a colonel.

While the roles are narrow, Eubank alluded to even more expanded use of agents and said that the task force is sharing tools it has built to other cyber-oriented military agencies such as the Defense Cyber Defense Command (DCDC). 

“As they get trained and learn, we open the framework up,” he said of the AI agents. “The guardrails are really tied to cybersecurity, really based on what humans have learned over the years on what we should do inside of operating and securing the network, defending the network, and attacking a network. We have been very deliberate in kind of ‘okay, what did we learn as humans? How do we write those guardrails, and then how do we incrementally reduce the guardrails over time?’”

Meanwhile, the Army is set to announce two awards for its Project Griffin initiative on Friday, according to the service’s principal cyber advisor. Project Griffin, DefenseScoop previously reported, is an effort by the service to build an ecosystem of agents to defend its networks as cyberspace is increasingly defined by how quickly defenders can respond to AI-backed threats.

Brandon Pugh, the Army’s top cyber advisor, said the service received over 100 industry submissions to build such an ecosystem, which was narrowed down to ten companies and then two, which he did not disclose the names of but said will be announced this week.

That capability will be run by ARCYBER, specifically by Task Force Secure, according to Eubank, who said it is being run by a lieutenant colonel