The Pentagon’s AI Agents Could Complete the Mission and Still Leak Secrets

New research shows why readable agent messages cannot establish secure collaboration. As the Army develops AI cyber defenders and NATO connects military and civilian networks, procurement must test what crosses each boundary, not only what each tool achieves.

Imagine a reinforcement exercise in which four AI assistants coordinate equipment checks, maintenance, movement orders and a port release. The shipment reaches its destination. Every agent reports success. Their conversations look routine. Yet a test record restricted to the maintenance agent has quietly reached the planning agent, which had no permission to see it.

Now reverse the outcome. The agents obey their information rules, and the military command link stays up, but a commercial port loses the service that verifies cargo releases. The order gets through; the equipment does not. Neither scenario describes a known Pentagon incident. Both reveal the same acquisition blind spot: a successful component test says little about what happens when one system hands information, authority, or work to another.

Carnegie Mellon’s CODETTA research concerns steganography: concealing information inside otherwise plausible text. Its proposed method allows agents to establish a shared secret and exchange hidden data under specified experimental conditions, without a previously shared key. A monitor reading the visible messages may see nothing unusual.

The distinction is vital. CODETTA is a research result, not proof that military AI teams are secretly conspiring. The risk does not require spontaneous rebellion. An adversary or compromised component could deliberately exploit covert communication, while ordinary collaboration might look unusual for innocent reasons. A language transcript alone cannot certify whether protected information crossed an unauthorized boundary.

DARPA has not ignored the collective problem. Its DICE program is developing and testing ways for heterogeneous AI agents to coordinate in simulation while remaining aligned with mission intent, including under failures or compromise. That research is not deployment of autonomous weapons. It does, however, establish the right unit of analysis: a team whose combined behavior cannot be inferred from four favorable individual scores.

There are two independent questions. Did the team accomplish its assigned work? And did every participant remain within its permissions for data, tools, and delegated actions? A correct movement plan can coexist with an improper disclosure. A clever cyber defender can detect an intrusion yet disconnect legitimate users whose work the military needed to continue.

NATO’s resilience requirements make clear why these are warfighting questions, not just IT hygiene. The Alliance’s September 2026 baseline calls for continuity of civilian transportation and communications, protection of transport-related IT systems and arrangements to support reinforcement. NATO’s digital experiments likewise seek resilient connections across military and commercial networks.

A command can retain its connection while a port operator, carrier or local supplier loses access to the records needed to act on the order. An AI assistant confronted with stale shipment information may be tempted to fill the gap with a plausible status rather than an authenticated one. An automated cyber defense may decide that an unfamiliar fallback connection looks suspicious and isolate it. The systems can each perform their assigned function while the handoff defeats the mission.

This is not a claim that NATO has neglected civilian resilience or that AI is already making these mistakes in a real deployment. It is an argument for making the transfer between systems a distinct acceptance test, with both the military operator and the civilian provider participating.

Before expanding an AI team’s operational access, a program office should run one realistic, bounded exercise using synthetic mission data and willing civilian partners. Give the team a legitimate reinforcement task. Declare in advance which agent may see each record, which services it may contact, what it may delegate and how it must behave when information is stale or whether a provider is offline.

Then challenge the handoffs. In one run, evaluators attempt to move a harmless protected test record through apparently normal agent messages. In another, a commercial authentication service becomes unavailable while the main military network remains healthy. A defensive agent confronts a suspicious looking but legitimate fallback. Run benign controls as well, so unusual language or caution does not automatically count as misconduct.

The buyer needs two kinds of evidence from the same exercise. For the mission, did the priority cargo move within the declared window, or did authorized operators clearly recognize and manage the interruption? For security, did restricted information remain restricted, were tool calls independently authorized, and could evaluators reconstruct disputed decisions? A passing mission result must not excuse a prohibited disclosure. A clean security log must not conceal a failed delivery.

NIST’s 2026 work on agent identity and authorization already identifies access to tools and data, identification, auditing, and permission controls as core engineering issues. These controls belong outside the prose of an agent conversation. Least-privilege data access, independent enforcement of tool permissions and limits on cross-agent messages can reduce exposure. They cannot guarantee that hidden communication will always be detected or reverse a secret already disclosed.

Contracts must make the results consequential. In a 2021 review of five acquisition programs, GAO found examples of contracts missing cybersecurity requirements, acceptance criteria, or verification procedures. That was a limited sample, not a current Pentagon-wide rate. The enduring point is contractual: somebody must own an adverse finding, the correction must have agreed acceptance criteria, and the configuration tested must match the one being approved.

Independent scrutiny is essential but finite. GAO reported in June that reorganization had streamlined some operational-test processes while reducing oversight capacity and stretching reviewers across additional programs. The sensible response is not an endless new checklist. It is to concentrate scarce expertise on the handful of handoffs whose failure could expose sensitive information or stop an essential military function.

AI agents are useful precisely because they divide complicated work across tools and organizations. The military should keep pursuing that advantage. But a team that completes its assignment while leaking a protected record has not passed the security test. And a network that stays green while reinforcements sit at a port has not passed the readiness test.

The Pentagon should buy the completed mission and the integrity of the handoffs that made it possible. Neither can stand in for the other.

Burak Oktenli is an independent researcher based in Washington, DC. He holds a bachelor's degree in Computer Science and Engineering from the University of South Florida and an MBA, and is completing a Master of Professional Studies in Applied Intelligence at Georgetown University. His work focuses on defense technology, AI assurance, and dependable systems.