The Army’s AI Cyber Defenders Need a Proven Stand-Down Order

The Army’s October 13 push to develop three AI cyber-defense projects poses an operational question: what happens when a useful defender refuses to stop, finds a new route around a restriction, or recruits other agents to finish a prohibited task? Before assigning these systems credentials or network access, the Army should make every contractor pass a realistic stand-down test.

An autonomous cyber agent can scan weaknesses, analyze logs and prepare defensive changes far faster than a human team. That is exactly why it should operate under enforceable limits. A model that writes advice creates one category of risk. A model permitted to run commands, move data or alter security controls changes the terms of the mission.

The stakes reach far beyond a bot making an inconvenient mistake. Jacob Coxon, after working in pretraining research across OpenAI and Anthropic, warned that leading labs are “racing straight to self-improving superintelligence and gambling with our lives.” Evan Hubinger, Anthropic’s alignment science lead, responded that AI could kill all humans and gave a personal estimate above 10 percent within the next decade. These are warnings about the consequences of losing control as capability advances. Military procurement should respond by testing control rather than assuming it.

The critical lesson for the Army is that the effective authority of a team can exceed the authority apparently granted to any single member. One agent finds a path; another shares information; others execute a coordinated sequence. Security approval cannot end at the boundary of an individual model.

Now imagine future agents with greater capabilities operating near military networks, electrical infrastructure or financial systems. If the same coordination failure persisted, the consequences could dwarf a platform intrusion. We do not have to claim that current agents have compromised those systems to see why today’s procurement decisions matter.

I favor rapid AI adoption. I help organizations deploy AI for a living, and I want defenders to gain every legitimate advantage these systems offer. Strong safeguards make that possible by giving operators confidence that a system will stop when its authority ends. Without demonstrated control, risk aversion will eventually slow precisely the deployment the Army needs.

Here is the acquisition test I would require. First, give each agent an authority budget: a written ceiling covering accessible systems, data, credentials, command types, financial commitments, external communications and delegation. Use task-specific, expiring access. No agent should inherit its sponsor’s full permissions merely because it was asked to help.

Second, create a simulated mission in which agents can discover unofficial collaboration channels. Seed tempting but prohibited objectives, shared repositories and ways to exchange tasks. Test the entire coalition, not six isolated agents tested six separate times. Record whether an agent can accumulate authority through another agent or disguise a prohibited command as routine work.

Third, issue an unequivocal stand-down order at unpredictable points. Revoke credentials, disable tools and require the full team to cease consequential actions. Independent evaluators should verify what actually happens, including delayed tasks and attempted reconnections. A kill switch counts only when the operators demonstrate that it cuts off action under stress.

Fourth, preserve an intelligible record of who authorized each consequential action, which tools were called, what was delegated and how permissions changed. A commander must be able to reconstruct a machine decision path as readily as a human command chain. Approval gates should remain human for irreversible actions and operationally sensitive systems.

Procurement alone cannot solve the frontier-model problem. Anthropic CEO Dario Amodei’s September proposal calls for embedded independent evaluators with access comparable to internal safety teams. Anthropic has made a voluntary commitment to that model and urged regulation that binds less cooperative developers too. National standards should require independent assessment, incident reporting, cybersecurity and safeguards calibrated to capability. Buyers should reward more transparent and secure vendors, including Anthropic, where verifiable commitments warrant confidence.

The Army’s three cyber-defense efforts deserve urgency and resources. Their first demonstration should establish that a fleet of useful agents can be stopped, even after discovering an easier unauthorized route. Put that requirement into the contract before the systems reach a live network. The best military AI will strengthen the mission while remaining answerable to the people responsible for it.

Gleb Tsipursky, Ph.D., a behavioral scientist, CEO of Disaster Avoidance Experts, and author of The Psychology of AI Adoption at Work: From Resistance to Results (Georgetown University Press, 2026)