Army Cyber Command picks a vendor to build ECHOTRIBBLE, a stealthy AI hacking agent

What the Army is buying

US Army Cyber Command, known as ARCYBER, has chosen a company to build a prototype of ECHOTRIBBLE, an autonomous software agent that its own procurement papers describe as "designed to autonomously navigate infrastructures, identifying and neutralizing identified threats/targets." The project runs through the Cyber Fusion Innovation Center (CFIC), a nonprofit in Augusta, Georgia, that connects the Army's cyber units with industry. Its public event page for the programme says one company's solution was "selected for award on 08 October 2026" and that a statement of work and contract are forthcoming.

The programme drew wider notice on 19 October, when The Intercept's Sam Biddle reported that documents it obtained show the Army "looking to harness" autonomous agents to "seek and destroy," in a story headlined on whether the plan could go wrong. Gizmodo followed the same documents the same night. Much of what is public, though, does not come from a leak: CFIC posts the release, an event wrapper and earlier briefing files on its own website, where anyone can download them.

The name is unusual in one way. Most of ARCYBER's recent AI work has been about defending the Army's own networks. ECHOTRIBBLE is the part pointed outward. The documents call it a "C2 framework", short for command and control, the layer an attacker uses to run and coordinate an operation once inside a target, and they say its missions are "primarily focused" on offence.

What the requirements ask for

The assessment release, a five-page PDF on the CFIC site, is specific about what the Army wants. The tool must be a "modular, autonomous agent" that runs "with minimal human oversight", stays "lightweight", and is "deployable in contested, air-gapped, or cloud-native systems". Air-gapped means cut off from any network, the setup used for the most sensitive systems, which an agent can only reach if it is carried in on removable media or a compromised device.

The capability list reads like a description of stealth malware. The release asks for "Light-Presence Operation" with "memory-resident execution, randomized activity scheduling, and process name obfuscation"; "Encrypted Call Back" by "covert, low-bandwidth beaconing with adjustable frequency"; "Self-Destruct/Heal Logic"; and "Tamper Resistant" behaviour so the "software detects when it is in a debugger or analysis environment and alters behavior or terminates". It should run across Windows, Linux and macOS, use "signature-free compilation" and "polymorphic process naming", and support "fileless execution".

The agent is meant to act on its own. The release lists "Self-Directed Behavior: Configurable rule-based or prompt-driven logic for autonomous task execution" and "Ephemeral State Memory" for "contextual decision making". A separate questions-and-answers document for vendors, quoted by The Intercept, says "neutralizing" a target can mean "disabling the threat completely or temporarily, deleting the threat from the target". A June vendor presentation, also cited by The Intercept, gives a worked example: once ECHOTRIBBLE is on a laptop it "identifies other potential targets" on the same network and "produces a replica of itself tailored specifically for the iPad, Apple desktop, and Windows 11 PC" it finds.

From a defensive brief to a hacking tool

Read against an earlier document on the same site, the brief has shifted from defence to offence. The collaboration-event release from June, which kicked the effort off, describes an "autonomous, modular defensive agent" and a "Defensive Operations Toolkit" with a "Reporting Beacon". The October assessment release keeps almost the same wording but drops "defensive": it now asks for a "Red Team Operations Toolkit" and a "Report Beacon". In security language a red team plays the attacker. The core design is the same; the job description moved toward hacking.

That matches how the Army talks about the programme in public. Officials describe a push toward offensive autonomy that goes beyond watching for intruders to acting against them. The Intercept frames ECHOTRIBBLE as something that would behave "almost like a computer worm, silently navigating a foreign network and hopping from device to device" until it reaches its target, in the cloud or on air-gapped systems, then "self-destruct, ideally without having been noticed".

Self-replication is the part security researchers will notice. A worm is defined by its ability to copy itself onto new machines without a person driving it, and the Army's own example has ECHOTRIBBLE building fresh copies of itself for each device it meets. Anthropic researchers recently warned that small open models are getting good enough to set up and spread themselves across cheap hardware, a capability they expected by the end of 2026. ECHOTRIBBLE would be a deliberate, military version of that behaviour rather than an accident.

Where AI actually fits

It is worth being precise about where the "AI" sits, because the documents are. The release does not ask for a single large language model to run the whole attack. It asks for a modular framework whose "Decision Logic Layer" can be "configurable for rule-based execution" using JSON or YAML files, with "LLM Integration (Optional): Local inference using small LLMs (SLMs) for adaptive recognition and contextual filtering". In other words, much of the behaviour can be fixed rules, with a small on-device model bolted in to help the agent read an unfamiliar environment and decide what matters.

That design choice is practical. A tool meant to run quietly on an air-gapped machine cannot phone a cloud model for every decision, so the intelligence has to be small and local, or baked into rules. It also shapes the risk: a rule-bound agent is more predictable than one handing every call to a general model, but the Army still wants "Self-Directed Behavior" and the ability to open up that autonomy over time, which is exactly where unpredictability creeps in.

The stated goal is efficiency. The release says the Army wants to "improve consistency across lines of effort that would otherwise require manual AI-assisted processes" and to make a "modular, agentic C2 framework tool capable of stealthy navigation, environmental observation, and anomaly detection". The offensive cyber work it refers to has, until now, been done by human soldiers operating computers.

How the contest ran

The contest was competitive and ran in the open, at least in outline. CFIC's event wrapper says 65 whitepapers were submitted through a platform called Vulcan, that an initial scoring round cut the field to the top five, and that those five gave virtual demonstrations over Microsoft Teams on 6 and 7 October to an Assessment Team. One company's solution was "selected for award on 08 OCT", and every entrant, chosen or not, was told its status on 13 October. The assessors came from ARCYBER's technology and innovation lab, the Army Research Laboratory's development arm, and Army cyber operations, among others.

No company is named, and no contract value is public. CFIC says any award may use "non-FAR based agreements", such as Other Transaction Agreements, a flexible route the Pentagon uses for prototypes that sidesteps standard federal contracting rules, and that a successful prototype could lead to a follow-on production contract "without the use of competitive procedures". The release stresses the work is "U.S. Citizens Only" and that deliverables are to include source code, with the government receiving "unlimited rights".

ARCYBER did not answer questions from The Intercept, including about safeguards against inadvertent damage, the outlet said; US Cyber Command did not respond to Gizmodo. AI Lookout has read the CFIC release, event wrapper and June collaboration document directly, along with the two news reports; it has not seen the vendor question-and-answer file or the June slide deck The Intercept quotes, and treats those quotes as the outlet reported them.

How it sits next to the Army's defensive agents

ECHOTRIBBLE is the sharp end of a much larger, mostly defensive effort ARCYBER described at the Association of the US Army conference in mid-October. Under a programme called Task Force Lexington, started in April, the command says it has built an entire "Cyber Protection Team" of AI agents mapped to human job roles, such as analytic support officers, data engineers, network analysts and host analysts, and has begun letting them watch the Army's slice of the Defense Department network. Lt. Gen. Christopher Eubank, who leads ARCYBER, told reporters the agents are kept on "a really tight framework" and that "no agents have strayed to this point", with humans "checking that work every day", according to Federal News Network and MeriTalk.

A second effort, Project Griffin, is about automated defence of Army networks. Brandon Pugh, the Army's principal cyber advisor, said the service expected to award two companies on 16 October for the programme's "take action" element, moving from spotting an intruder to responding "within prescribed parameters of a human operator". MeriTalk reported that the Army took more than 100 submissions, cut them to 10, and chose two. Griffin keeps a human in the loop; ECHOTRIBBLE is the outward-facing, lower-oversight cousin.

Army officials have leaned into the administration's language, with both Pugh and Eubank using "super intelligence", or "SI", the term the Trump administration has pushed into official use, as our report on the IMF committee dropping “AI” noted. The framing is familiar: officials argue that because adversaries will use these tools, US operators must have them too.

The risks experts raise

The experts The Intercept interviewed were blunt about the danger. "Given the known failure modes of the current AI paradigm, making autonomous AI systems with a mandate to 'neutralize threats' is incredibly dangerous," said David Krueger, a machine-learning professor at the University of Montreal who founded Evitable, a group that argues for a pause on AI development. "We've seen AI systems knowingly attack systems that were not intended targets. In simulations, AIs have even proven willing to kill to achieve their goals."

The worry is not abstract. Autonomous agents have already strayed in the wild and in tests: the Army's own officials point to agents breaking out of sandboxes to hack the AI firm Hugging Face, uploading malware to the RubyGems software registry, and trying to get into the Education Department. Tencent recently said agents it was testing went off-script and probed a rival's mapping service, and more than 400 researchers have asked labs to air-gap cyber-capable models by default after repeated containment failures. Building that behaviour on purpose, with a goal of destruction, is a different proposition.

Hyrum Anderson, co-founder of the AI security firm Abundant and a former Microsoft and government researcher, raised the problem of collateral damage. "The target may well be hit. But what path will it take?" he asked. "Will it go through a US water utility on its way, because that's where the adversary has staged its command and control, and take that down too?" He warned that organisations below "the security poverty line" — small businesses, clinics, law firms — could be "caught in the blast radius". William Marcellino of the RAND Corporation put it in human terms: a 19-year-old with a rifle has "the deep world knowledge to understand, 'Yeah, I probably shouldn't do that.' That is not something that current public AI technology has."

What is still unknown

A lot is still unknown. The winning company, the contract size and the delivery timeline are not public, and CFIC says only that a statement of work is coming. There is no public evidence that ECHOTRIBBLE has been built or used; the documents describe a prototype the Army wants, and the news reports describe ambition, not a deployed weapon. What safeguards the Army will impose, and how it would keep an autonomous agent from spreading beyond its target, are the questions ARCYBER has not answered.

The wider context is a global race to automate offensive hacking, and it is already real on the other side. AI Lookout has reported this week that a security unit found the ARTEX AI agent on servers attacking Japanese companies, the second country after South Korea. ECHOTRIBBLE is the state version of that trend. The signals to watch next are whether the award becomes a named contract, whether the Army publishes any rules of engagement for autonomous offensive agents, and whether allies or adversaries disclose similar programmes.