What Task Force Lexington Built—and What It Deliberately Avoided
Task Force Lexington was established in April 2026 and charged with creating AI agents for specific cyber work roles, including developers, data engineers, host analysts and exploitation analysts, according to ARCYBER commander Lt. Gen. Christopher Eubank (DefenseScoop, Aug. 19, 2026. Breaking Defense describes the task force as the command's clearing house for all its AI efforts. "Every agent we create is trained in a work role inside the cyber force," he said in August, adding that agents are trained to the same standard as human operators and set on missions "with a human watching" (Breaking Defense. By October, he said, the task force had completed the cyber protection team: "We now have all the work roles inside of a cyber protection team mapped out at this point, and learning their trade" (Federal News Network. In August, DefenseScoop reported that the command employed 17 agentic mission elements and cyber protection mission elements that scour the DODIN every day (DefenseScoop, Aug. 19; that figure is an August snapshot, and the October reporting did not update it.
The architecture choice that matters most to contractors: Eubank said the command "purposely" avoided commercial frontier models for this work, citing the cost of tokens and a broader concern about the lack of AI governance—without that discipline, he said, "we're going to price ourselves out of business" (DefenseScoop, Aug. 19. That was the task force's in-house choice, not a published Griffin requirement. But Griffin's program office voiced the same cost concern: Wayne Sok, product manager for the Army's defensive cyber warfare arm, told industry that a pilot that "looks great" but carries inflated token costs at the end would be "a problem" (DefenseScoop, Aug. 21, 2026. Our reading: proposals that lead with frontier-model capability and treat cost and governance as appendices are poorly matched to what both the operators and the buyer have said they want.
Eubank has also been explicit about where risk sits. "Right now, today, humans are all responsible for risk. We have not turned any agents loose to assume risk on their own behalf," he said in August (DefenseScoop, Aug. 19. In October he said "no agents have strayed to this point," attributing that to a "really tight framework" in which each agent is treated "just like a human operator" and humans check its work every day (Federal News Network. The framing telegraphs a design requirement: the guardrails are part of the product. ARCYBER is building an agentic workforce with a governance model, not just an automation capability—and Eubank said the agent team has been passed to the Defense Cyber Defense Command for defensive work on behalf of the department, which means the model is already traveling beyond the Army (Federal News Network.
Project Griffin: The "Take Action" Contract
Project Griffin is a pilot, not a production program, and it is distinct from Task Force Lexington. It is one of three lines of effort under the Army Rapid Development of Cyber Defense Systems program, which grew out of a tabletop exercise in which industry executives and Army leaders examined how the service would respond to an adversary launching thousands of autonomous cyber attacks simultaneously (National Defense Magazine, Oct. 12, 2026; Federal News Network. The Army posted the call for solutions for Project Griffin: Intelligent Response and Orchestration Node (IRON) on Aug. 20, 2026, with solution briefs due Aug. 27 (SAM.gov. Eubank said the resulting capability will be run by ARCYBER's Task Force Secure (DefenseScoop, Oct. 12.
The program's aim is an ecosystem of agents that ingest feeds from the Army's network sensors and automatically execute defensive actions against malicious cyber actors (DefenseScoop, Aug. 21. Brandon Pugh, the Army's principal cyber advisor, described the goal as letting detection agents "autonomously respond in conjunction with a human operator, or perhaps in the future, even autonomously" (DefenseScoop, Aug. 21. In October he said the two selected companies will go after the "take action element," with "an autonomous response within prescribed parameters of a human operator, or even in conjunction with that" (Federal News Network. Pugh also said the Army might "start small," with only a couple of take-action elements tested in its own environment before expanding (National Defense Magazine.
Status as of this writing: the Army said it would announce the two awardees on Oct. 16, but we did not find a public announcement naming them, and the SAM.gov notice showed no award notice when we checked on Oct. 22. Treat the award as planned until the Army names the companies.
Reporting on the solicitation gives contractors a more concrete picture than the speeches do. According to DefenseScoop's account of the call for solutions, IRON must distinguish actual threats from false positives, keep a "complete and automated audit trail" for every action, execute responses through existing policy enforcement points such as endpoint management tools, and give administrators adjustable "confidence thresholds," a "master kill switch" for pending autonomous actions at higher tiers, and an "undo" function to reverse commands the agents trigger. The response commands initially span seven functions, from temporary firewall blocks to patching vulnerabilities (DefenseScoop, Aug. 21.
From that structure, the take-action element plausibly needs an agent that can:
- Receive a sensor-detected indicator of compromise at machine speed
- Query context such as asset criticality, current mission and connected systems
- Select a defensive action from a constrained set of permitted responses
- Execute it within thresholds human administrators set, without waiting for sign-off only where those thresholds allow
- Log every decision and action, and support reversal, for human review
This list is our inference from the reported solicitation and officials' statements, not a published specification. The technical difficulty is not detection or even selection—it is defining what the agent may do on its own versus what requires escalation, and proving that boundary holds under adversarial pressure. Sok made the security point directly: "If we have a bunch of agents roaming around, and they're vulnerable, that just made it worse because if the adversaries attack our agents, now we're exposed" (DefenseScoop, Aug. 21. A capable attacker will probe the boundary, so a competitive offering has to show that it is enforced architecturally, not just declared in documentation.
What the Governance Architecture Actually Requires
Three design choices, in our assessment, separate a Griffin-competitive offering from a general-purpose agentic tool. These are Spartan X recommendations drawn from the program's stated priorities, not Army requirements.
Action authority scoping. The agent's permitted action set must be bounded, enumerable and independently verifiable. "The agent will use good judgment" is not a guardrail; it is an undefined action space. ARCYBER's work-role framing suggests the approach: define what a host analyst agent may do and what it may not, and make that boundary hard-coded and testable rather than set by prompt. Note that the reported IRON command set already includes temporary firewall blocks and patching, so the line will not be "network changes forbidden"; it will be which specific changes, under which thresholds, with which rollback.
Reversibility tiers. Defensive actions differ in how easily they can be undone, and the reported "undo" and tiered kill-switch requirements show the Army is already thinking this way. An action taxonomy should make reversibility explicit. As an illustrative scheme: an agent may execute Tier 1 (readily reversible) actions within its thresholds, requires human confirmation for Tier 2, and may only recommend Tier 3 actions for a human to carry out. The exact recovery time of any action depends on the environment and should be measured, not assumed. The point of tiering follows from the tabletop premise: at high attack volume, scarce human attention should go to consequential decisions, not routine ones.
Cost-constrained operation. Token cost is a stated concern of both the operators and the program office. A defensive system that runs a large-model inference chain on every sensor event is unlikely to scale to operational tempo at acceptable cost. A sensible design uses small, fast inference—fine-tuned specialized models or rule-engine hybrids—for the decision layer, and reserves larger models for analysis where latency is acceptable. Pugh has also said he wants to take existing commercial solutions and "perhaps fine-tune" them rather than start from scratch (National Defense Magazine, which favors this pattern over bespoke frontier-scale builds.
A hypothetical proposal that passes all three tests might describe a two-tier architecture: a fine-tuned classification model that categorizes sensor events and selects an action tier within a latency budget the program sets, paired with a verification layer that checks the selected action against the defined authority boundary before execution, and a larger reasoning model invoked only to assemble Tier 2 escalation packages when a human operator needs context. (This is an illustrative design pattern, not a specification derived from Griffin's solicitation.)
The credible alternative is to keep agents in a recommend-only role, with humans executing every response. That makes sense where the network segment is mission-critical and poorly instrumented, where rollback has not been tested, or where the agent's false-positive rate on that segment is not yet known. Its cost is speed: it does not answer the Griffin premise of thousands of simultaneous autonomous attacks. Evidence that would justify widening an agent's authority includes a measured false-positive rate on the target network, a demonstrated undo for each permitted action, and a record of no out-of-scope actions over a defined trial period.
The ECHOTRIBBLE Problem
Task Force Lexington and Project Griffin are defensive. On Oct. 19, 2026, The Intercept reported on a separate ARCYBER effort codenamed ECHOTRIBBLE, based on documents it obtained. We have not reviewed the underlying Q&A document or presentation, so the descriptions below are The Intercept's account; ARCYBER did not respond to The Intercept's questions, including about measures to prevent inadvertent damage (The Intercept. According to The Intercept, a Q&A document answering contractor questions says ECHOTRIBBLE is "primarily focused" on offensive missions and that "neutralizing" a target could include "disabling the threat completely or temporarily, deleting the threat from the target." The outlet also described a presentation to interested vendors at a June 24 ARCYBER event that offered a hypothetical example: once uploaded to a laptop, the software "identifies other potential targets" on the same network and "produces a replica of itself tailored specifically" for other devices.
Part of this is on the public record. The Cyber Fusion Innovation Center, working with ARCYBER, describes the Agentic C2 Framework Tool (ECHOTRIBBLE) as a tool "designed to autonomously navigate infrastructures, identifying and neutralizing identified threats/targets" that "must operate with minimal human oversight," and reports that one company was selected for award on Oct. 8, 2026, with a statement of work and contract actions forthcoming (CFIC. The program's operational scope and its relationship to Task Force Lexington remain unclear from public sources.
The signal for contractors is not the specific program but the governance gap it illustrates. Offensive autonomous action at machine speed can produce irreversible effects in networks where the blast radius is hard to bound in advance, and the experts The Intercept interviewed focused on exactly that risk. Pugh himself has acknowledged "different levels of policy and legal questions" around autonomous agents in cyberspace (DefenseScoop, Aug. 21. In our assessment, contractors contributing to agentic offensive capability carry real program and reputational risk until those questions are settled in policy, regardless of the technical quality of their contribution.
What ARCYBER's Design Pattern Means Operationally
The task force model—narrowly scoped agents trained to specific work roles, governed by explicit action boundaries, checked daily by human counterparts, and given more latitude only as they prove themselves—is replicable. Eubank described exactly that progression: "As they get trained and learn, we open the framework up" (DefenseScoop, Oct. 12. We expect the same pattern to appear in other mission areas such as logistics automation and intelligence analysis, each with its own version of the action authority and reversibility questions. That is a forecast, not an announced DoD policy.
The operational judgment that matters for contractors: the governance model is the moat, not the model. A firm that can show a repeatable engineering process for defining action authority, enforcing it in the architecture, and keeping audit trails sufficient for after-action review is positioned for repeat work. A firm that delivers capable agents with soft governance risks incidents that end programs.
For program offices receiving Griffin-style tools, a useful acceptance test is the question Task Force Lexington's daily human checks are meant to answer: did any agent exceed its permitted action scope? If answering requires manual log review after the fact, the governance is thin. If it can be answered quickly from an automated audit trail, it is on firmer ground.
The Army has said Griffin will be followed by efforts on agentic deception and agentic red or purple teaming, with funding already aligned (Federal News Network. Before those solicitations open, teams positioning for this work should answer three questions:
- Does your action authority model have a written specification, or is it implied by training data and prompts?
- Can your guardrail enforcement be independently tested without access to the model weights?
- What is your recovery procedure if an agent exceeds its scope boundary during an active attack, and have you exercised the undo path for every permitted action?
The firms with defensible answers to all three are the ones most likely to be taken seriously.
Spartan X's Arbiter platform includes an agent-governance capability aimed at this layer. Its agent arbitration function intercepts an autonomous agent's proposed actions, evaluates them against a policy engine before they execute, and records each decision in a tamper-evident audit trail, with an air-gapped deployment option for defense users. Checking an agent's action against a defined authority boundary before it runs is the same control problem Griffin-class systems must solve, and it is where we would start with a program office deciding how much latitude a defensive agent should earn.
Sources and further reading
- Army Cyber Command builds agentic workforce to support cyber operations — Federal News Network (October 2026)
- ARCYBER expanding use of AI agents for network operations — DefenseScoop (October 12, 2026)
- AUSA News: Army Sprinting to Field AI Agents to Counter Autonomous Cyberattacks — National Defense Magazine (October 12, 2026)
- Army cyber chief reveals AI task force building agents to 'hunt' in the DOD network — DefenseScoop (August 19, 2026)
- Army Cyber training AI agents in cyber 'work roles' alongside human counterparts — Breaking Defense (August 20, 2026)
- Army wants fast AI cybersecurity agents that won't run up token costs or create new vulnerabilities — DefenseScoop (August 21, 2026)
- Project Griffin: Intelligent Response and Orchestration Node — SAM.gov call for solutions (August 20, 2026)
- The Army Wants to Sic AI Agents on Its Enemies. What Could Go Wrong? — The Intercept (October 19, 2026)
- Agentic C2 Framework Tool (ECHOTRIBBLE) Assessment Event — Cyber Fusion Innovation Center
