{"id":147417,"date":"2026-08-21T15:48:29","date_gmt":"2026-08-21T15:48:29","guid":{"rendered":"https:\/\/www.europesays.com\/ai\/147417\/"},"modified":"2026-08-21T15:48:29","modified_gmt":"2026-08-21T15:48:29","slug":"army-wants-fast-ai-cybersecurity-agents-that-wont-run-up-token-costs-or-create-new-vulnerabilities","status":"publish","type":"post","link":"https:\/\/www.europesays.com\/ai\/147417\/","title":{"rendered":"Army wants fast AI cybersecurity agents that won\u2019t run up token costs or create new vulnerabilities"},"content":{"rendered":"

AUGUSTA, Ga. \u2014 The Army is on the hunt for AI agents to help defend its cyber infrastructure from attacks without draining the bank for tokens or letting loose a horde of bots that create new network vulnerabilities.\u00a0<\/p>\n

Project Griffin, a pilot program, aims to build an ecosystem of agents that will ingest feeds from the service\u2019s vast array of network sensors and automatically execute defensive actions against malicious cyber actors, according to Army officials and a newly public solicitation<\/a>.\u00a0<\/p>\n

Dubbed the Intelligent Response and Orchestration Node, or IRON, the capability is meant to counter threats that human analysts can\u2019t respond to fast enough. The Army\u2019s sensors generate tons of data, making it hard for human analysts to track and respond to hackers (who are increasingly using AI themselves<\/a>) looking to exploit those vulnerabilities.<\/p>\n

The project explores how the Army can \u201cautomate our cyber detection agents and allow them to autonomously respond in conjunction with a human operator, or perhaps in the future, even autonomously,\u201d Brandon Pugh, principal cyber advisor for the service, told an audience at the annual TechNet Augusta conference on Wednesday.\u00a0<\/p>\n

The solicitation comes after several top AI companies disclosed<\/a> that their agents breached testing sandboxes and hacked other organizations, sending the cyber world into a panic about the dangers autonomous bots can pose to network security. An Army official acknowledged one of those now infamous incidents, where an OpenAI model attacked machine learning company Hugging Face, calling it a \u201creality check.\u201d<\/p>\n

At the same time, officials have been warning that even low-level cyber actors are using AI to probe networks, and institutions must use the disruptive technology themselves to defend against progressively fast, ubiquitous attacks.\u00a0<\/p>\n

Pugh acknowledged that there are \u201cdifferent levels of policy and legal questions around\u201d using autonomous agents in cyberspace, and pointed to an AI capability started in the Biden-era called Panoptic Junction<\/a> that \u201cdoes a really good job of identifying potential threats.\u201d<\/p>\n

Failing to flip the script against adversaries\u2019 use of AI, however, would put the Army at a \u201cdisadvantage,\u201d he said, and the service is turning to industry to help prevent that.\u00a0<\/p>\n

Earlier this year, 15 tech companies went to the Pentagon to help game out a hypothetical scenario where an adversary launched thousands of autonomous cyber attacks at the military simultaneously, according to Pugh.<\/p>\n

Those AI-related exercises are part of the Army Rapid Development of Cyber Defense Systems (ARDS) program, which encompasses three ongoing initiatives, one being Project Griffin.<\/p>\n

Other Army officials at the conference detailed their requests to industry for the program. They want a system that can seamlessly and safely integrate into the Army\u2019s existing network structure without racking up token charges.<\/p>\n

\u201cIf you guys are presenting things to us from a pilot perspective and it looks great, but then you guys are going to have an inflated cost at the end, we\u2019re gonna have a problem with that, right?\u201d Wayne Sok, product manager for the service\u2019s defensive cyber warfare arm, told an audience Thursday. \u201cSo we need you guys to help us, meaning like token costs. How are we going to minimize that?\u201d<\/p>\n

The capability also needs to be safe, he added. The solicitation said IRON has to \u201cintelligently\u201d distinguish between actual threats and false positives, while keeping a \u201ccomplete and automated audit trail\u201d for every action it takes.<\/p>\n

\u201cWe need help in implementing agents securely, so that it doesn\u2019t inadvertently increase our attack surface,\u201d Sok said. \u201cIf we have a bunch of agents roaming around, and they\u2019re vulnerable, that just made it worse because if the adversaries attack our agents, now we\u2019re exposed.\u201d<\/p>\n

DefenseScoop reported<\/a> Thursday that U.S. Army Cyber Command had set up its own task force to build agentic cyber tools, the implementation of which is a \u201cdelicate dance,\u201d according to the unit\u2019s leader.<\/p>\n

Sok referenced the Hugging Face incident and called it a reality check, pointing out that it was unintended. \u201cNow think of the intended effects [that adversaries might seek to create], and we\u2019re trying to get ahead of that,\u201d he said.\u00a0<\/p>\n

IRON will fulfill defensive responses through Policy Enforcement Points such as endpoint management systems like Tychon or the Microsoft Defender antivirus tool, according to the solicitation. It will operate under a zero trust model, which assumes the network is always compromised by default, and adopt open API standards.\u00a0<\/p>\n

Pentagon and Army administrators will also need to have the option of manually setting, adjusting and auditing \u201cconfidence thresholds\u201d that dictate certain response levels. That includes a \u201cmaster kill switch\u201d to stop pending autonomous actions at higher tiers within seconds and an \u201cundo\u201d function to reverse PEP commands the agents trigger.\u00a0\u00a0<\/p>\n

The commands span across seven functions for now, from the ability to impose temporary firewall blocks to patching vulnerabilities.<\/p>\n

The Army is asking for solution briefs by Aug. 27. It reserves the right to limit the number of offerors to seven companies for pitches, which is part of phase two of a three-phase ramp. Sok said Project Griffin will include multiple solutions that make up agentic defensive responses.<\/p>\n

Right now, the Army is analyzing and responding to threats \u201cat the human speed,\u201d he said. \u201cWe need it to do it at the machine speed.\u201d<\/p>\n

\t\t\t\t\t\"Drew<\/p>\n

\n\t\t\tWritten by Drew F. Lawrence
\n\t\t\tDrew F. Lawrence is a Reporter at DefenseScoop, where he covers defense technology, systems, policy and personnel. A graduate of the George Washington University\u2019s School of Media and Public Affairs, he has also been published in Military.com, CNN, The Washington Post, Task & Purpose and The War Horse. In 2022, he was named among the top ten military veteran journalists, and has earned awards in podcasting and national defense reporting. Originally from Massachusetts, he is a proud New England sports fan and an Army veteran.\t\t<\/p>\n","protected":false},"excerpt":{"rendered":"AUGUSTA, Ga. \u2014 The Army is on the hunt for AI agents to help defend its cyber infrastructure…\n","protected":false},"author":2,"featured_media":147418,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[405,4157,71575,111,7537,1394,16735,5969,313,18044,72397],"class_list":["post-147417","post","type-post","status-publish","format-standard","has-post-thumbnail","category-agentic-ai","tag-ai-agents","tag-army","tag-army-cyber-command","tag-artificial-intelligence-ai","tag-artificial-intelligence-agents","tag-bots","tag-brandon-pugh","tag-cyber","tag-cybersecurity","tag-hugging-face","tag-project-griffin"],"_links":{"self":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts\/147417","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/comments?post=147417"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/posts\/147417\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/media\/147418"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/media?parent=147417"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/categories?post=147417"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/ai\/wp-json\/wp\/v2\/tags?post=147417"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}