Loading story…
U.S. Army Cyber Command has disclosed Task Force Lexington, a unit created in April to operationalize artificial intelligence across cyber operations. Army cyber chief Lt. Gen. Christopher Eubank said the task force is building AI agents that mirror human roles including developers, data engineers, host analysts, exploitation analysts, and red team personnel, with uses spanning staff work and active threat hunting.
Eubank said 17 agentic mission and cyber protection elements are already scanning the Department of Defense Information Network daily, but human operators still make risk decisions and no AI agent is allowed to assume risk autonomously. Army officials said the effort is deliberately avoiding commercial frontier models because of token-cost and governance concerns, while emphasizing internally built capabilities supported by collaboration with the Defense Innovation Unit and industry engineers.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
The U.S. Army established Task Force Lexington in April to explore and operationalize artificial intelligence across cyber command functions. The unit was formed as a small dedicated group after studying industry best practices for integrating AI into cyber operations.
The U.S. Army is pursuing Project Griffin, a pilot effort to build AI-driven cyber defense agents that ingest network sensor data and autonomously execute defensive actions through tools such as Tychon and Microsoft Defender. The planned IRON capability is designed to operate with human oversight and safeguards including confidence thresholds, audit trails, a kill switch, and an undo function.
Army Cyber Command disclosed the existence of Task Force Lexington and described its work building AI agents for developers, data engineers, analysts, and red team roles. Officials also said the effort avoids commercial frontier models because of token-cost and governance concerns.
Lt. Gen. Christopher Eubank said Army Cyber Command now has 17 agentic mission and cyber protection elements scouring the Department of Defense Information Network every day. He said the agents support roles including threat hunting and red team functions, while humans retain responsibility for risk decisions.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcedefensescoop.com
Open sourcescworld.com
Open sourcedefensescoop.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Amazon has developed an internal system called Autonomous Threat Analysis (ATA), which leverages multiple specialized AI agents to proactively identify vulnerabilities, perform variant analysis, and propose remediations for its platforms. ATA, originating from an internal hackathon, operates by having AI agents compete in teams to investigate real attack techniques and suggest security controls, with all recommendations subject to human review. This approach aims to address the challenge of keeping detection capabilities current in a rapidly evolving threat landscape, enhancing the speed and coverage of security testing without removing human oversight from critical decision-making. Separately, research from Anthropic highlights that while AI attack agents can automate and accelerate many tactical aspects of cyberattacks—such as generating scripts, testing exploits, and scanning configurations—they do not operate as fully autonomous weapons. Human operators remain responsible for strategic decisions, campaign design, and risk assessment, with AI serving as an accelerator rather than a replacement. Both cases underscore that current AI systems in cybersecurity amplify human expertise and efficiency but do not independently conduct or direct cyber operations.
Jun 29, 2026
Artificial intelligence is rapidly reshaping the cybersecurity landscape, with industry analysts and experts predicting that AI agents will soon handle the majority of security operations tasks. According to a recent IDC report, by 2028, AI will process 80% of security alerts in most security operations centers, dramatically reducing the need for manual intervention by human analysts. The report also forecasts that AI will not only bolster defense but also empower attackers, with 80% of organizations expected to face AI-driven phishing attacks using synthetic identities by 2027. Additional trends include the quantification of cyber threats in financial terms, the rise of sovereign AI mandates, and the widespread adoption of AI-powered risk quantification and dynamic playbooks. At the 2025 OWASP Global AppSec conference, cybersecurity veteran Daniel Miessler emphasized that AI agents are breaking down security work into discrete, automatable tasks, fundamentally changing the nature of cybersecurity jobs. Miessler highlighted the potential for organizations to significantly boost productivity by training staff to leverage AI agents, such as Anthropic's Claude Code and its Agent Skills toolkit, which can automate a wide range of specialized tasks. While the shift to AI-driven operations presents opportunities for efficiency, it also raises concerns about workforce displacement and the need for upskilling to remain relevant in an AI-augmented security environment.
Jul 12, 2026
An expert-authored **International AI Safety** report says AI agents are increasingly being used to support multiple stages of cyberattacks, with notable gains over the past year in vulnerability discovery and malicious code generation. The report cites results from DARPA’s AI Cyber Challenge where finalist systems autonomously identified **77% of synthetic vulnerabilities**, and notes criminal use of AI tooling (e.g., *HexStrike AI*) to accelerate exploitation soon after public vulnerability disclosures; it also describes a growing market for “weaponized” models that can generate ransomware and data-stealing code at low monthly cost. Despite these advances, the report assesses that **fully autonomous, end-to-end, multi-stage attacks** are not yet commonly observed because current AI systems struggle to reliably execute long, complex sequences without human oversight, including poor error recovery and irrelevant command execution. Separately, CSO Online highlights risk-management concerns that large numbers of deployed **AI agents** could “go rogue,” underscoring governance and control challenges as organizations operationalize agentic AI at scale.
Jun 29, 2026