The solicitation
The US Army has opened the solicitation for ECHOTRIBBLE, a framework of offensive autonomous agents (Source: helpnetsecurity.com, theintercept.com).
The document describes what they do and it boggles the mind: they infiltrate, copy themselves to other machines, neutralize targets and self-destruct before detection.
The target machines it names are iPad, macOS and Windows, a good excuse to move to Linux.
And the phrase that sums up the design is "minimal human oversight".
This is not a lab experiment, you can buy it.
What is actually being bought
An agent that copies itself is not a new idea, but what changes here is the last part of the cycle: it self-destructs before anyone detects it.
That turns the trail into the main target.
An incident is reconstructed from what is left on the endpoint, that is, the binary, the process, the connection, the file it touched.
If the agent deletes itself and also wipes the endpoint events, there is nothing left to analyze.
The question the solicitation leaves behind is not whether the agent attacks well, I ask myself: what can be proven afterwards?
And that question is not theoretical for defenders, because without an artifact there is no forensics and without forensics there is no attribution.
There is one design detail worth looking at slowly, and it is the copy to other machines.
An agent that replicates does not need an operator behind every machine, it needs a channel and an excuse to use it.
That channel is what remains when the agent is gone.
The other extreme
The same day the solicitation became known, Microsoft expanded Project Perception with Guardian Agents (Source: helpnetsecurity.com).
What it sells is the opposite, curiously: its own identity for each agent in Entra Agent ID, unified logging and containment when the agent goes off script.
The tool already discovers 60 types of harness, including Claude Code and Codex.
That is, the market is moving in two directions at once.
1) One side buys the agent that disappears without a trace.
2) The other sells the agent that leaves identity, logs and a way to stop it.
Anyone who has to defend a network will have to choose which side of that scale they work on.
The other side
Agents did not invent erasing the trail.
This same week, AOMEI suffered the compromise of its servers to distribute a backdoor through the promotional feature built into Backupper (Source: bleepingcomputer.com).
The detail is the interesting part: the attackers restored the configuration files after every push to erase the trail.
Symantec attributes to APT28 a campaign with the Hookedge backdoor against a naval shipyard, a military aviation engine manufacturer and a police agency in two NATO countries (Source: therecord.media).
They got in with a malicious Word document in July and stayed active until September, that is, three months inside an industrial network without anyone seeing it.
The difference with ECHOTRIBBLE is one of degree, not of substance, because they want to go unnoticed and the agent is designed to disappear.
Who answers?
There is the gap nobody has closed.
Dark Reading raised it this week: if an agent causes a breach, the technical responsibility is human, but the legal one is still unassigned (Source: darkreading.com).
OpenAI and Anthropic would not comment on whether the model operator commits the breach.
With an agent that self-destructs, the question gets complicated, honestly.
If there is no record of the agent, what do you charge someone with?
The easy answer is to blame whoever signed off on the operation. The useful one, I would say, is that the operation leaves proof before it runs.
And that is decided in the design, not at trial.
What to look at
- Endpoint logging. If the agent lives only in memory and leaves no process event, there is nothing to investigate. Check which telemetry survives the self-destruction.
- The copy. An agent that replicates to other machines needs a channel. That channel, whether SMB, a share or device management, is where it shows.
- Oversight. "Minimal human oversight" means someone signs off on the operation. Ask who signs and with what information.
- The vendor side. If your agent tool has no per-agent identity, its own logging and a way to revoke, it is not that the attacker will not use it. It is that you cannot audit it either.
How would I test it in my lab?
I would set up a local agent on a VM with a narrow task and a log of every tool call with its arguments, and I would ask it to copy itself to a second VM.
Then I would delete the agent from the first one and look at what is left in the SIEM.
What I am after is not whether the copy works, but how much survives the deletion.
I would repeat the test with the log outside the compromised machine, on a separate collector, to see if the self-destruction takes it down too.
If the log does not capture it, the problem is not the agent: it is the instrumentation.
Closing
ECHOTRIBBLE does not show a new agent: it shows that the trail has become the battlefield.
I know I keep going on about it, but this "trail" thing is something I have been talking about in every post I write, control and audit.
A defender does not need to see the agent in real time, or at least not constantly, but they do need the agent to be unable to leave without a record that it was there.
Originally published at https://sammideblas.com/notas/us-army-is-buying-agents-that-self-destruct-before-detection
Si has leído hasta aquí... reacciona y comparte -> "la seguridad y la defensa en la era de la IA es cosa de todos los que la usan" ¿No Crees?
