US Army Cyber Command Trains AI Agents for High-Speed Cyber Operations

"Every agent we create is trained in a work role inside the cyber force," Lt. Gen. Christopher Eubank, commander of ARCYBER, said on Tuesday at the TechNet Augusta conference.

Task Force Lexington: the clearing house for AI work in ARCYBER

Army Cyber Command (ARCYBER) has consolidated its AI efforts under Task Force Lexington, a unit described by Lt. Gen. Eubank as the command’s clearing house for all its AI activity. The task force is "led by a soon-to-be colonel with a team of around 10 'high-speed folks,'" he said, and has been sent as a unit to the Defense Innovation Unit to meet senior engineers and sharpen their technical skills.

AI agents trained to perform specific cyber “work roles”

Eubank laid out a systematic approach: agents are not generic tools but are trained to do named jobs inside the force. "We’ve created developers, data engineers, host analysts, exploitation analysts. You name the work role, we’re creating those," he said. The command treats agents much like human specialists — training them "to the same standard that humans get trained to" and approving them through Job Qualification Readiness (JQR) processes. Once assigned to a mission, an agent operates with a human watching and is expected to "deliver results."

When agents make mistakes, Eubank said, they are taught the correction and then the agent "goes back in and retrains itself," indicating a closed loop of supervised learning and task refinement inside these defined work roles.

Where agents are being applied: hunting, risk management, and red teaming

ARCYBER is already deploying these agentic systems in operational tasks. Eubank said agents are "performing critical work such as hunting on the network for cyber threat and intrusions" and are involved in cybersecurity processes including the service provider risk management framework and Enterprise Mission Assurance Support Service. The command has also fielded an "agentic red team" and 17 cyber protection team mission elements that focus on the network daily.

Human oversight, guardrails, and the question of risk

Despite the speed and autonomy of the agents, commanders emphasized a strict boundary on risk assumption. "We have not turned any agents loose to assume risk on their own behalf," Eubank said, and described a daily group process to decide the guardrails applied to each agent. He explained the decision in operational terms: "Is it risk that a human should be answering, or is it risk that an agent can answer?"

Lt. Gen. Jeth Rey, Deputy Chief of Staff, G‑6, framed the rationale for moving to agentic AI in blunt operational language: adversaries operate at machine speed, and the network is central to operations. "Defending and operating the network is definitely a thing that humans are doing right now. We’re doing it at human speed … But our adversaries are doing it at machine speed and we must catch up and we must get ahead," Rey said. He further stressed the network’s foundational role: "we can’t fire rounds without it, we can’t move people without it, we can’t operate on a daily basis without it."

In practice this manifests as a fast feedback loop: agents "check in" with human counterparts; humans check the work and then send the analytic support officer agent back on task — a description that underscores a supervised, iterative workflow rather than full autonomy.

How technologists, policymakers, and network defenders are likely to respond

• Technologists and security teams will be watching integration and training practices: the command’s emphasis on JQR-like standards, supervised retraining after errors, and the Task Force Lexington engagement with the Defense Innovation Unit are concrete signals that ARCYBER is investing in engineering rigor and continuous learning.
• Policymakers and risk managers will focus on guardrails and the operational rule that "agents" do not yet assume risk: Eubank’s statement that the daily process explicitly segregates risks for human versus agent decision-making frames a governance challenge that leadership is already addressing.
• Network defenders and mission owners must reconcile speed and safety: with 17 cyber protection team mission elements and an agentic red team operating daily, defenders will need to incorporate agent outputs into oversight processes so that machine-speed activity still aligns with human risk tolerance.

ARCYBER has moved from experimentation to operational employment of agentic AI in clearly defined roles, while keeping humans as the final arbiter of risk. The command’s next practical steps — hardening training standards, refining guardrails, and maintaining the human-in-the-loop checks it described — will determine whether the rapid, agentic pace it seeks becomes a durable advantage or a management challenge. Read the original account at Breaking Defense: https://breakingdefense.com/2026/08/army-cyber-training-ai-agents-in-cyber-work-roles-alongside-human-counterparts/