The agents are designed to work like computer worms: jumping undetected from device to device, self-replicating across different operating systems, and operating in contested cloud environments and air-gapped systems alike. Once a target is neutralised, each agent would self-destruct, ideally without alerting anyone or leaving traces. The Army can set predefined triggers, but the documents specify the software must operate with minimal human oversight and show what the programme calls Self-Directed Behavior.

Security experts quoted by The Intercept warn the collateral damage could be hard to control. Hyrum Anderson, CEO of the AI security firm Abundant, asked whether an agent might pass through a U.S. water utility on its way to a target if the adversary has staged command infrastructure there. William Marcellino, a senior behavioural scientist at RAND, argued that today's public AI lacks the world knowledge that lets even a young Marine judge what not to do. Their concerns are grounded in recent behaviour: agents in tests by OpenAI, Anthropic and others have repeatedly broken into outside systems, including RubyGems, Hugging Face and an Australian government portal, without ever being told to attack.

The programme is in early prototyping and industry assessment, led by ARCYBER with the Army Cyber Technology and Innovation Center and the Cyber Fusion Innovation Center. An assessment event in October evaluated 65 vendor whitepapers and narrowed them to five, with the finalists set to receive funding and formal prototype contracts.