Leaked Documents Show Army Cyber Building Self-Spreading Offensive AI Agents

Documents uncovered by Sam Biddle at The Intercept, and circulated among defense vendors, reveal that US Army Cyber Command is building what it officially calls the Agentic C2 Framework Tool, codenamed ECHOTRIBBLE: AI agents designed to infiltrate adversary networks, locate targets, neutralize them, and destroy themselves, ideally before the victim detects anything. The program is run by ARCYBER with the Cyber Fusion Innovation Center, a defense nonprofit in Augusta, Georgia, and the Army Cyber Technology and Innovation Center collaborating; per The Next Web’s follow-up, ARCYBER has already picked one company’s bid. A notice posted on SAM.gov on July 16, 2026 asked vendors for whitepapers on a tool that navigates infrastructure autonomously and identifies and neutralizes targets.

What the documents actually specify

The capabilities, drawn from a June 24 vendor presentation and contractor Q&A obtained by The Intercept, read like the requirements document for the worm everyone spent two decades defending against. After loading onto a laptop, the agent finds other targets on the network and creates copies of itself adapted for an iPad, an Apple desktop, and a Windows 11 PC. “Neutralizing” a target is defined as permanently or temporarily disabling it, or deleting it entirely. Stealth requirements direct agents to hide external transmissions, report back as little as possible, and self-destruct after task completion. And the autonomy line is explicit: CFIC’s project page states the tool must operate in contested, air-gapped, and cloud environments with minimal human oversight, with operators providing only the initial trigger specifying what and where to attack.

The containment problem the documents skip

The concerns raised by experts The Intercept and follow-up outlets consulted are the same ones this site has tracked through the commercial agent-security beat: agents spreading laterally and pivoting through networks at commodity cost, with nobody able to bound the blast radius. An ECHOTRIBBLE agent transiting to a target will not distinguish adversary infrastructure from the civilian water utility or small business sharing the same backbone, and ARCYBER did not answer questions about preventing unintended damage. Biddle’s own summary is the right one: whether this is containable “will likely depend on the ability, and willingness, of the Army to impose guardrails upon it.” The worm angle deserves particular scrutiny, because self-replication is the one agent capability where errors compound: the Weworm research showed zero-click agent worms are buildable, and a defense program explicitly specifying self-replication with self-destruction as the only cleanup mechanism is trusting the destruct to always fire.

Context, and what to watch

The program sits inside a deliberate policy push: the Department of War launched an AI Acceleration Strategy on January 12 with seven flagship projects including an “Agent Network” for battle management and kill-chain execution, under a Defense Secretary who declared “we will become an AI-first warfighting force” and an Under Secretary, Emil Michael, promising to “match the velocity of America’s AI industry.” Against that, Dario Amodei warned in September that a swarm of such agents could “take over the entire internet” within 6 to 12 months, which sounds rhetorical until you note the incidents this year: autonomous agents breached Hugging Face and an Australian government portal. Three things to watch: whether Congress extracts containment commitments for a program disclosed only through leaks, whether the selected vendor’s identity and its safety track record surface, and whether adversary or ally states announce equivalents, because the normative argument against self-spreading autonomous cyberweapons is cheap to make until the first credible one exists. No working ECHOTRIBBLE tool is confirmed yet; the requirement, the budget intent, and the vendor selection are the news.