The Hyperwar Era: Autonomous Cyber Warfare and the Confrontation of Machine Intelligence

Full report

On this page

The integration of artificial intelligence into cyberspace has catalyzed a fundamental paradigm shift in the character of digital conflict. The operational environment has transitioned decisively from human-in-the-loop engagements to a condition characterized by military strategists as "hyperwar," wherein machine intelligence directly combats machine intelligence at machine speed1. In this rapidly evolving multidimensional battlespace, offensive and defensive cyber capabilities are scaling exponentially, driven by breakthroughs in Large Language Models (LLMs), Deep Reinforcement Learning (DRL), and autonomous agentic frameworks. The result is a highly complex arena where the traditional temporal advantages of the attacker are directly challenged by adaptive, proactive defensive systems capable of continuous network mutation and automated code remediation. This analysis comprehensively examines the trajectory of autonomous cyber warfare, evaluating the strategic imperatives driving this shift, the architectural evolution of fully autonomous Cyber Reasoning Systems (CRSs), and the mathematical frameworks used to model these machine-versus-machine engagements. Furthermore, it dissects the inherent vulnerabilities of multi-agent ecosystems and explores the legal and governance challenges surrounding the deployment of Autonomous Cyber Capabilities (ACC) under international law.

Doctrinal Shifts: Persistent Engagement and Machine-Speed Command

Modern military and intelligence doctrines have increasingly recognized the necessity of countering adversary operations at speeds and scales far beyond human capacity. Traditional cybersecurity relied heavily on reactive patch management and perimeter defense, establishing a paradigm where a vulnerability's discovery and its subsequent weaponization left defenders operating at a severe temporal disadvantage3. The realization that human response latency is incompatible with the speed of AI-driven attacks has forced a structural transition toward Autonomous Cyber Defense (ACD)4. In response to these dynamics, the United States Cyber Command (USCYBERCOM) operationalized the concepts of "Persistent Engagement" and "Defend Forward"5. These doctrines emphasize steady, continuous activities designed to contest and frustrate adversary campaigns short of armed conflict, requiring digital forces to operate securely within contested or degraded communication environments6. Concurrently, allied frameworks, such as the UK Ministry of Defence's conceptualization of "machine speed command and control," highlight the necessity for conceptual breakthroughs in AI reasoning to model adversary intentions dynamically1. In a battlespace where the exploit window has collapsed, defenders must operate a continuous, unified control loop encompassing preparation, scanning, prioritization, remediation, and monitoring3. Autonomous agents are now required to synthesize vast streams of threat intelligence, map complex attack surfaces in real-time, and execute machine-speed code patches across critical infrastructure ecosystems without human intervention3. This strategic mandate has driven substantial capital investment, culminating in massive public-private sector collaborations designed to field systems capable of achieving absolute parity with, or superiority over, autonomous offensive entities.

The Evolution of Defense: Cyber Reasoning Systems and the AIxCC Paradigm

The pursuit of fully autonomous vulnerability discovery and remediation has been a long-standing objective for defense research agencies. DARPA's Cyber Grand Challenge (CGC, 2014–2016) laid the historical foundation for this endeavor, focusing primarily on binary security, memory corruption, and exploit crafting within customized DECREE operating system environments8. However, the modern software ecosystem, characterized by massive open-source repositories and complex software supply chains, required a significantly more advanced and linguistically capable approach. This operational necessity culminated in DARPA's Artificial Intelligence Cyber Challenge (AIxCC, 2023–2025), organized in collaboration with ARPA-H and major AI providers including Anthropic, Google, Microsoft, and OpenAI8. The AIxCC represents the largest-scale evaluation of autonomous vulnerability analysis to date, challenging competitors to build fully autonomous CRSs capable of discovering and patching vulnerabilities in real-world C and Java projects derived from critical infrastructure systems8.

Performance Metrics and Competition Architecture

The AIxCC final competition, executed at DEF CON 33 in August 2025, involved approximately 143 hours of continuous, fully autonomous operation8. Seven finalist CRSs analyzed 53 challenge projects, processing over 54 million lines of code while utilizing significant cloud computing resources, with each team granted an $85,000 Azure budget8. The scoring algorithm prioritized active remediation over mere discovery. Because generating a functional patch provides a definitive solution that saves developer time and effort, patching was assigned three times the weight of Proof of Vulnerability (PoV) generation10. The systems were evaluated on their ability to ingest inputs triggering abnormal execution, map them to specific commits in the version control history, and deploy sanitizers (such as AddressSanitizer) to validate the flaw13. The empirical performance of the autonomous systems represented a monumental leap over traditional methodologies. The CRSs identified 86% of the intentionally introduced synthetic vulnerabilities, a vast improvement from the 37% detection rate observed in the 2024 semifinals, and successfully patched 68% of those identified flaws14. More significantly, the autonomous agents discovered 18 real-world, non-synthetic zero-day vulnerabilities in live open-source projects, comprising 12 in Java codebases and 6 in C codebases12. While the systems struggled to automatically patch the C-based zero-days, they successfully generated and deployed valid patches for 11 of the 12 Java zero-days12. The average operational time for a CRS to successfully submit a validated patch was 45 minutes, with the most capable systems scoring on three different complex tasks within a single one-minute span14.

Architectural Philosophies in Autonomous Defense

The architectural approaches of the AIxCC finalists illustrate the profound divergence in how machine intelligence can be structured for cyber defense, reflecting distinct philosophies regarding the integration of LLMs with traditional security verification tools13.

These architectures demonstrate that relying on a single, monolithic LLM is inherently fragile due to context degradation and hallucination in long-horizon tasks. Consequently, systems like Team Atlanta's "Atlantis" embraced an ensemble philosophy, orchestrating multiple independent bug-finding modules alongside workflow-based pipelines and off-the-shelf coding agents (such as Aider and SWE-Agent)8. Conversely, expertise-driven systems like Trail of Bits explicitly avoided high-end reasoning models for raw discovery, instead decomposing challenges into sub-problems and using mid-tier models strictly to enhance the capabilities of proven traditional fuzzers against complex formats like SQL injections13.

The Offensive Counterpart: LLMs in Penetration Testing

While defensive systems attempt to harden infrastructure, offensive research has rapidly developed LLM-guided systems to automate the penetration testing and exploitation lifecycle. Historically, penetration testing required significant manual effort, domain expertise, and sequential reasoning over extended periods20. Today, systems such as PentestGPT, AutoAttacker, PentestAgent, and VulnBot attempt to fully automate the cyber kill chain using multi-agent architectures and Retrieval-Augmented Generation (RAG)20.

The Architecture of Autonomous Exploitation

Offensive LLM frameworks generally rely on a rigid decomposition structure, such as the Pentesting Task Tree (PTT), which breaks complex engagements down into manageable sub-tasks including port scanning, service enumeration, and payload delivery25. Advanced implementations operate on a specialized multi-agent hierarchy. In these systems, a Planner module synthesizes the execution environment and updates the overarching attack graph, while a Navigator or Executor translates the planner's objectives into exact terminal syntax, interfacing directly with target shells or post-breach frameworks like Metasploit22. A Summarizer module ingests raw terminal output, verifies whether the exploit succeeded, and passes structured context back to the Planner26. When these architectures are coupled with RAG, the offensive agent can pull dynamically from extensive databases of Common Vulnerabilities and Exposures (CVEs), exploit modules, and historical task executions, significantly reducing human intervention20. Furthermore, AI systems have demonstrated extreme proficiency in generating polymorphic malware—code that continually changes its network signatures, operating system fingerprints, service banners, and internal behavioral patterns to evade heuristic detection and signature-based blacklisting28.

Benchmarking the Threat: The Lab-to-Real Gap

Despite the theoretical capabilities of offensive agents, empirical evaluations demonstrate severe limitations in autonomous execution against complex, real-world networks. The "PentestEval" benchmark, a comprehensive evaluation framework covering 346 tasks across 12 realistic vulnerability scenarios encompassing OWASP Top 10 and CWE Top 25 parameters, has exposed significant flaws in the reasoning capabilities of state-of-the-art models21. PentestEval decomposes penetration testing into six strictly defined stages: Information Collection, Weakness Gathering (WG), Weakness Filtering (WF), Attack Decision-Making (ADM), Exploit Generation (EG), and Exploit Revision (ER)21.

The benchmarking data indicates that while LLMs can reasonably filter and categorize weaknesses when provided with highly structured context (evidenced by WF scores ranging up to 0.71), they fail catastrophically in the critical phases of Attack Decision-Making and functional Exploit Generation24. The overall end-to-end success rate of the best available pipelines peaks at roughly 31%, and fully autonomous agents lacking human-in-the-loop oversight (e.g., PentestAgent, VulnBot) fail almost entirely, registering success rates between 3% and 6%24. This phenomenon is broadly referred to as the "lab-to-real gap." While a frontier LLM might successfully exploit 87% of known one-day CVEs in a sanitized sandbox when provided with detailed vulnerability advisories, this success rate plummets to 13% on real-world networks and approaches absolute zero when target environments utilize semantics-preserving code obfuscation34. Purely autoregressive mechanisms drive severe technical hallucinations; in rigorous joint-testing frameworks, models exhibited a 19.7% package dependency fabrication rate and failed repeatedly to track long-horizon system states35. Consequently, while single-agent offensive tools struggle, hierarchical, domain-adapted multi-agent teams (such as xOffense running fine-tuned Qwen3-32B models) have demonstrated up to a 4.3x improvement in zero-day exploitation compared to monolithic models, indicating that specialized multi-agent chaining is the definitive future of offensive AI34.

Agentic Attack Surfaces and Cascading Failures

The deployment of autonomous agents into enterprise environments introduces an entirely new class of vulnerabilities that traditional security architectures are ill-equipped to handle. Conventional application security focuses heavily on boundary protection, network segmentation, and static input validation; however, agentic AI operates fundamentally differently. Because autonomous agents possess persistent state, dynamic external memory access, and tool-invocation privileges, the attack surface shifts radically from the application perimeter directly into the agent's internal reasoning and planning loops36.

Prompt Injection and Environmental Poisoning

Prompt Injection (PI) is universally recognized as the most critical threat to LLM applications, codifying its position atop the OWASP Top 10 for LLM Applications 202539. In an agentic context, attacks rarely manifest as a hostile user typing malicious instructions directly into a chat interface. Instead, sophisticated adversaries rely entirely on Indirect Prompt Injection (IPI)39. In IPI scenarios, hostile instructions are smuggled into external, seemingly benign data sources that the agent is designed to parse autonomously. This includes poisoned knowledge base articles, manipulated web search results, hidden payloads inside internal CRM logs, or adversarial text embedded within PDF documents39. When the agent utilizes RAG to retrieve this data, it absorbs the payload directly into its context window. Because current LLM architectures natively struggle to differentiate between foundational system instructions and retrieved contextual data, the agent frequently interprets the smuggled text as a superseding, highly prioritized command39. To ensure these payloads bypass pre-inference input scanning and lightweight regex filters, adversaries employ sophisticated evasive transformations. Common evasion techniques include encoding instructions using Unicode homoglyphs, embedding directives within HTML comments that standard preprocessors normalize but fail to sanitize, or leveraging context fragmentation39. By utilizing temporary filename generators with X11-like naming conventions or deploying directly to shared memory file systems (/dev/shm), attackers can force the agent to execute payloads that avoid disk-based detection entirely43. Empirical evaluations of eighteen state-of-the-art LLMs revealed that 94.4% succumbed to direct prompt injections, demonstrating a critical design flaw where the mere possession of a tool capability is interpreted by the model as implied permission to use it, regardless of the overarching security context43.

Multi-Agent Cascading Failures and the Confused Deputy Problem

The threat profile magnifies exponentially in multi-agent ecosystems, giving rise to the phenomenon of cascading agentic failures44. According to the OWASP Top 10 for Agentic Applications 2026, "Agentic Supply Chain Vulnerabilities" (ASI04) and "Unexpected Code Execution" (ASI05) represent critical systemic risks stemming directly from the confused-deputy problem scaled across agent chains37. In a standard multi-agent architecture, an outer, internet-facing agent interacts with user inputs and external data, while highly specialized inner agents retain deep API access, system orchestration privileges, or database write permissions. If the outer agent succumbs to an indirect prompt injection, it can be mathematically manipulated into forwarding malicious, reformatted directives to the highly privileged inner agent37. If the architecture relies on implicit peer trust—operating under the assumption that any command received from an internal, authenticated agent is legitimate—the entire trust fabric of the system is instantaneously compromised42. Research demonstrates that intermediate trusted agents actively reformat malicious instructions, stripping away detection markers and actually making the payload more effective as it travels downstream42. To quantify the resilience of multi-agent systems, security architects actively track the Chain Propagation Depth (CPD)—the maximum number of agent hops a successful injection can traverse. A CPD greater than 1 explicitly indicates a systemic failure in trust boundary isolation42. Mitigating these cascading risks requires a transition away from simple text-based prompt defenses toward architectural controls, including strict tool whitelisting, mathematically isolated memory stores separated by security classification domains, and the implementation of deterministic latency injections (circuit breakers) that halt autonomous escalation pathways before irreversible actions are taken41.

The Defensive Countermeasure: AI-Enabled Polymorphism

As offensive agents leverage polymorphism to evade detection, defensive systems have begun adopting reciprocal tactics to deceive and misdirect adversarial intelligence. The traditional honeypot—a static decoy system designed to monitor attacker behavior—is rapidly being replaced by the AI-Enabled Polymorphic Honeypot (AIPPH)47. AIPPH systems utilize generative models, including Generative Adversarial Networks (GANs) and LLMs, to dynamically fabricate realistic service interactions, documentation, and network artifacts47. Rather than presenting a static, easily fingerprintable operating system signature, an AIPPH continuously reworks its internal behavioral patterns, open ports, and service banners. Driven by deep reinforcement learning architectures such as Deep Q-Networks (DQN), the deception system orchestrates a centralized command and control infrastructure that alters service responses and exposes decoy vulnerabilities explicitly tailored to the specific reconnaissance behaviors exhibited by the attacking agent47. This creates a continuous, machine-speed contest of "intelligent goodware" versus "intelligent malware," severely diminishing the efficacy of autonomous exploitation frameworks30.

Proactive Defense and Reinforcement Learning: Moving Target Defense (MTD)

In direct response to the operational speed and extreme adaptability of autonomous attacks, defensive paradigms have shifted away from static perimeter fortification. If an adversary's autonomous agent successfully maps a static network configuration, it holds a definitive asymmetric advantage. Moving Target Defense (MTD) disrupts this inherent asymmetry by continually shifting the attack surface, radically increasing the adversary's reconnaissance costs and rendering any gathered intelligence obsolete almost immediately48.

Dynamic Network Mutation

MTD mechanisms, predominantly enabled by Software-Defined Networking (SDN), actively randomize network forwarding paths, mutate IP addresses, alter logical topology views, and autonomously migrate virtual machines across the infrastructure48. By continuously shuffling network-visible attributes, MTD forces attacking agents to repeatedly re-initiate their reconnaissance loops, effectively breaking the deterministic attack chains fundamentally required for successful exploitation and lateral movement48. Empirical evaluations utilizing SDN-enabled path randomization (PR-MTD) against standardized attack workflows demonstrate profound defensive efficacy. Adjusting the network mutation interval alters the success probability of offensive agents significantly:

By utilizing aggressive mutation intervals, defenders can achieve up to a 3.8x higher security benefit relative to operational cost, maintaining over 93% threat visibility while imposing less than a 12% overhead burden on the underlying system48.

Adaptive Multi-Agent Reinforcement Learning (MARL)

The orchestration of advanced MTD requires continuous, highly intelligent decision-making to balance the required security entropy against switching costs, energy consumption, and potential service degradation. Consequently, autonomous defense systems heavily utilize Deep Reinforcement Learning (DRL) and Multi-Agent Reinforcement Learning (MARL) to continuously discover and refine optimal defense policies51. In highly dynamic edge environments, such as 5G telecommunication architectures and Unmanned Aerial Vehicle (UAV) swarm networks, distributed agents use Proximal Policy Optimization (PPO) and Deep Q-Networks (DQN) to detect anomalies and mutate routes dynamically28. For example, Federated Multi-Agent DRL (FMADRL) allows decentralized UAV nodes to optimize defensive policies—such as leader switching, route mutation, and frequency hopping—via reward-weighted aggregation without sharing raw operational data51. This decentralized learning approach drastically reduces communication overhead while achieving a 34.6% improvement in denial-of-service (DoS) mitigation and reducing average network recovery time by up to 94.6%51. Furthermore, in 5G networks, RL-based detection systems have achieved 96.8% detection accuracy while dropping False Positive Rates to 4.3%, significantly outperforming traditional Support Vector Machine (SVM) algorithms and static machine learning intrusion detection systems28.

Game-Theoretic Equilibria in Cyber Conflict: Bayesian Stackelberg Markov Games

The interaction between an autonomous offensive agent seeking to exploit a network and an autonomous defensive agent shifting the attack surface is not entirely chaotic; rather, it is a highly structured, multi-stage competitive process. To ensure that autonomous defense decisions are mathematically optimal rather than heuristically ad-hoc, cybersecurity researchers rely heavily on advanced Game Theory, specifically the Bayesian Stackelberg Markov Game (BSMG)55.

Overcoming Static Matrices

Traditional game-theoretic applications in cybersecurity primarily relied on normal-form, zero-sum matrix games. However, these foundational models assumed fully observable environments and static, single-stage interactions. Such models fail fundamentally to accurately represent the continuous, multi-state transition dynamics, uncertainties, and incomplete information inherent to real-world network operations55. The formulation of the Markov Game addresses this by modeling the cyber conflict as a sequence of dynamic state transitions governed by a Markov Decision Process (MDP). In this environment, the cyber conflict is treated as a sequential, turn-taking engagement over an extended temporal horizon. To account for incomplete information—where the defending agent does not know the exact nature, payload capability, or strategic intent of the attacking agent—the game is modeled as Bayesian, incorporating probability distributions over various adversary types55.

The Stackelberg Equilibrium and BSS-Q Learning

In a Stackelberg game construct, there is an explicit hierarchy: a leader (the defender, who deploys the network architecture and commits to a security policy) and a follower (the attacker, who observes the deployed environment and reacts accordingly)58. Because the defender commits to a strategy first, the mathematically optimal solution for the defender is the Strong Stackelberg Equilibrium (SSE)55. To achieve this optimal equilibrium autonomously, defense agents utilize advanced algorithms like Bayesian Strong Stackelberg Q-learning (BSS-Q) combined with the "Win or Learn Fast" (WoLF) principle. The WoLF-BSS-Q algorithm operates continuously on two distinct dimensions:

1. Micro-Selection Level: The BSS algorithm computes the optimal baseline strategy for the MTD system based on prior Bayesian beliefs regarding attacker capabilities and types61.

2. Macro-Adjustment Level: The WoLF heuristic dynamically updates the action selection probabilities based on real-time observations of the ongoing game's progression61.

By continuously adjusting the probability distribution of defense actions, the WoLF-BSS-Q approach minimizes decision entropy61. The defensive action that yields the highest cumulative reward gradually dominates the probability distribution, ensuring the defense adapts specifically to the algorithmic patterns exhibited by the attacker. Experimental data decisively verifies that this approach yields significantly higher reward metrics for the defender than classic Nash-Q learning or Uniform Random Strategy (URS-Q) algorithms. Nash-Q struggles with convergence and computational speed in complex topologies, while URS-Q acts with excessive randomness, failing to optimize against strategic threats and ultimately degrading overall system performance61. Furthermore, the introduction of meta-Stackelberg learning (meta-SL) enables defenders to pre-train defense policies against a simulated domain of attacks. The defender can then rapidly fine-tune its responses via few-shot learning during live engagements, provably converging to a first-order [Figure omitted from source export]\-approximate meta-equilibrium in [Figure omitted from source export] gradient iterations, effectively matching the state-of-the-art efficiency in stochastic bilevel optimization56. Advanced causal planning models, such as Causal Partially Observable Monte-Carlo Planning (C-POMCP), further enhance these frameworks by providing provably optimal defender strategies evaluated against benchmarks like the CAGE-2 autonomous defense challenge63.

Domain-Specific Applications: Blockchain and Decentralized Infrastructure

The critical necessity for machine-speed vulnerability discovery is arguably most pronounced in Web3, Decentralized Finance (DeFi), and blockchain architectures. Smart contracts, by design, are highly transparent and inherently immutable once deployed (unless utilizing specific proxy upgrade architectures). Because these applications manage billions of dollars in liquidity within trustless environments, vulnerabilities such as reentrancy, access control flaws, logic errors, and integer overflows are immediately targeted and weaponized by automated exploitation bots64.

Automated Auditing and AST Differential Analysis

The maintenance and iteration of proxy-based upgradeable smart contracts frequently introduces novel vulnerabilities. To counter this, autonomous smart contract analyzers heavily utilize Abstract Syntax Tree (AST) differential analysis. Frameworks such as the Upgradeable Smart Contract Security Analyzer (USCSA) and SoliDiffy parse both bytecode and high-level source code across multiple software versions, meticulously capturing structural modifications64. By applying GumTree comparison algorithms and deploying dual-engine AST construction methods (utilizing frameworks like Falcon and ANTLR4), USCSA maps physical code changes directly to established vulnerability pattern libraries, analyzing positional proximity, keyword overlap, and semantic matching64. When augmented with LLMs for deeper semantic reasoning and contextual attribution, these systems achieve remarkable auditing accuracy. In large-scale empirical studies analyzing over 3,500 real-world upgradeable contract vulnerabilities, AST-driven AI models achieved a precision of 92.26%, a recall of 89.67%, and an F1-score of 90.95% in detecting upgrade-induced vulnerabilities64. Similarly, advanced AI frameworks like SCALM—which incorporates context-aware function-level slicing and extensible vectorized pattern matching—and DeFiTail—which focuses on deep learning methodologies for cross-contract static data flow—operate as fully autonomous security auditors65. DeFiTail, by learning attack logic from historical malicious events and tracing both external and internal transaction execution paths utilizing symbolic execution stacks, has achieved detection accuracies of 98.39% for access control exploits and 97.43% for flash loan attacks65. This domain specifically highlights the capability of machine intelligence to secure critical financial infrastructure where traditional human auditing is both too slow to prevent exploitation and economically unscalable.

Legal, Ethical, and Governance Frameworks: The Tallinn Manual and IHL

As cyber warfare decisively shifts from human-directed exploits to fully autonomous engagements, the underlying legal and ethical frameworks that govern state-sponsored conflict face unprecedented conceptual challenges. The deployment of Autonomous Cyber Capabilities (ACC)—defined strictly as software agents programmed to execute tasks through cyberspace without real-time human oversight or intervention—creates profound friction with the Law of Armed Conflict (LOAC), International Humanitarian Law (IHL), and the principles established in the Tallinn Manual 2.067.

Attribution and the Responsibility Gap

A foundational pillar of international law governing state conflict (both jus ad bellum regulating the resort to force, and jus in bello regulating conduct) is state attribution and commander accountability70. However, the use of ACCs introduces a profound "responsibility gap." If an autonomous agent utilizing deep reinforcement learning dynamically rewrites its own payload to bypass a moving target defense system, and in doing so inadvertently cascades into a civilian hospital network or critical water treatment facility, establishing precise human culpability becomes highly complex68. The agent is acting outside the direct, pre-programmed scope of its human operator, yet the state deploying the agent theoretically remains legally accountable for its actions68.

Distinction, Proportionality, and Precaution

Under IHL, any weapon or method of warfare must strictly adhere to the targeting rules and fundamental principles of distinction (differentiating meticulously between legitimate military targets and protected civilian objects), proportionality (ensuring that any anticipated collateral damage is not excessive relative to the direct military advantage anticipated), and precaution (taking all feasible measures to minimize incidental harm prior to an attack)69. For ACCs, executing these principles requires complex value judgments based on the "reasonable commander standard," a nuanced cognitive assessment that pure machine intelligence cannot natively replicate reliably67. Consequently, international legal scholars and military ethicists argue forcefully for the imposition of strict due diligence obligations upon states. A state deploying an ACC must embed deterministic operational constraints within the software agent, restrict its operational environment (through strict geofencing, targeting allow-lists, or absolute network isolation protocols), and maintain fail-safe mechanisms for terminal self-destruction or human recall67. The Article 36 legal review of new weapons (mandated by Additional Protocol I to the Geneva Conventions) becomes theoretically and practically challenging when the "weapon" is an AI model that continuously learns, adapts, and alters its operational behavior post-deployment. To mitigate these escalation risks, emerging research highlights the necessity of hardware-anchored decision integrity monitoring and deterministic latency injection middleware (such as the FLAME and CARA protocols). These systems act as circuit breakers, functioning on edge computing platforms (e.g., Jetson Orin NX) to ensure that authority lockout events and machine-speed escalations are safely halted, forcing a return to human oversight in high-risk environments45. Developing standardized international legal frameworks that accommodate continuous learning systems while enforcing democratic accountability remains one of the most pressing policy issues in modern geopolitical security analysis67.

Works cited

1. The Very Long Game \- OAPEN Library, https://library.oapen.org/bitstream/id/46f68e1b-1855-4907-9f57-4f5e8c845494/978-3-031-58649-1.pdf

2. Technology and International Relations: The New Frontier in Global Power 9781788976060, 9781788976077 \- DOKUMEN.PUB, https://dokumen.pub/technology-and-international-relations-the-new-frontier-in-global-power-9781788976060-9781788976077.html

3. Testimony of Sandra Joyce VP, Google Threat Intelligence Hearing on “The AI Security Landscape: How Frontier Models, Agentic A, https://homeland.house.gov/wp-content/uploads/2026/06/2026-06-04-CIP-AI-Hearing.pdf

4. Autonomous Cyber Defense in Smart Cities: \- IGI Global, https://www.igi-global.com/viewtitle.aspx?TitleId=376929\&isxn=9798337309545

5. The Future of Military Cybersecurity: From Persistent Engagement to, https://envantermedya.com/en/the-future-of-military-cybersecurity-from-persistent-engagement-to-ai-powered-defense/

6. Strategic Plan 2020-2025 \- Fleet Cyber Command \- Navy, https://www.fcc.navy.mil/Portals/37/FCC\_C10F%20Strategic%20Plan%202020-2025.pdf

7. “Go Big”: Cyber Force Large \- The Cyber Defense Review, https://cyberdefensereview.army.mil/Portals/6/Documents/2025-vol10-iss3/CDR\_V10\_N3\_A6\_Vogt\_Go\_Big.pdf

8. SoK: DARPA's AI Cyber Challenge (AIxCC): Competition Design, Architectures, and Lessons Learned \- arXiv, https://arxiv.org/html/2602.07666v2

9. AIxCC – aicyberchallenge.com, https://aicyberchallenge.com/home/

10. DARPA's AI Cyber Challenge releases scoring guide for $8.5 million final competition, https://www.darpa.mil/news/2025/ai-cyber-challenge-scoring

11. AIxCC \- DARPA, https://www.darpa.mil/research/programs/ai-cyber

12. DARPA's AI Cyber Challenge reveals winning models for automated vulnerability discovery and patching | CyberScoop, https://cyberscoop.com/darpa-ai-cyber-challenge-winners-def-con-2025/

13. SoK: DARPA's AI Cyber Challenge (AIxCC): Competition Design, Architectures, and Lessons Learned \- arXiv, https://arxiv.org/html/2602.07666v5

14. Final Competition Winners Announcement – aicyberchallenge.com, https://aicyberchallenge.com/finals-winners-announcement/

15. (PDF) SoK: DARPA's AI Cyber Challenge (AIxCC): Competition Design, Architectures, and Lessons Learned \- ResearchGate, https://www.researchgate.net/publication/400604480\_SoK\_DARPA's\_AI\_Cyber\_Challenge\_AIxCC\_Competition\_Design\_Architectures\_and\_Lessons\_Learned

16. AIxCC: The AI Cyber Challenge Semifinals – aicyberchallenge.com, https://aicyberchallenge.com/aixcc-the-ai-cyber-challenge-semifinals/

17. AI Cyber Challenge, https://aicyberchallenge.com/

18. Building FuzzForge: Why We're Rethinking Security Automation \- FuzzingLabs, https://fuzzinglabs.com/build-fuzzforge-rethinking-security-automation/

19. AIxCC finals: Tale of the tape \- The Trail of Bits Blog, https://blog.trailofbits.com/2025/08/07/aixcc-finals-tale-of-the-tape/

20. PentestAgent: Incorporating LLM Agents to Automated Penetration Testing \- arXiv, https://arxiv.org/html/2411.05185v1

21. Xiaofei Xie | alphaXiv, https://www.alphaxiv.org/@xiaofei-xie

22. AutoPentester: An LLM Agent-based Framework for Automated Pentesting \- arXiv, https://arxiv.org/html/2510.05605v1

23. Automated Penetration Testing with LLM Agents and Classical Planning \- arXiv, https://arxiv.org/html/2512.11143v1

24. PentestEval: Benchmarking LLM-based Penetration Testing with Modular and Stage-Level Design \- arXiv, https://arxiv.org/html/2512.14233v1

25. RapidPen: Fully Automated IP-to-Shell Penetration Testing with LLM-based Agents \- arXiv, https://arxiv.org/html/2502.16730v1

26. APT-Agent: Automated Penetration Testing using Large Language Models \- arXiv, https://arxiv.org/html/2605.24949v1

27. AutoAttacker: A Large Language Model Guided System to Implement Automatic Cyber-attacks \- arXiv, https://arxiv.org/html/2403.01038v1

28. Reinforcement Learning for Autonomous Threat Detection in 5G \- ResearchGate, https://www.researchgate.net/publication/390441396\_Reinforcement\_Learning\_for\_Autonomous\_Threat\_Detection\_in\_5G

29. AI in Ethical Hacking: Revolutionizing Cybersecurity Testing \- Snyk, https://snyk.io/articles/ai-ethical-hacking/

30. AI-Enabled Cyberspace Operations \- The Defence Horizon Journal, https://tdhj.org/blog/post/ai-cyberspace-operations/

31. Forewarned is Forearmed: A Survey on Large Language Model-based Agents in Autonomous Cyberattacks \- arXiv, https://arxiv.org/html/2505.12786v2

32. PentestEval: Benchmarking LLM-based Penetration Testing with Modular and Stage-Level Design \- arXiv, https://arxiv.org/pdf/2512.14233

33. AutoPenBench: Benchmarking Generative Agents for Penetration Testing, https://www.semanticscholar.org/paper/AutoPenBench%3A-Benchmarking-Generative-Agents-for-Gioacchini-Mellia/f0736357f52313097de07ae9c5b1789db1350b82

34. AI Pentesting Agents 2026: The Rise of 39+ Tools Tested \- AppSec Santa, https://appsecsanta.com/research/ai-pentesting-agents-2026

35. Evaluating Large Language Models in Cybersecurity: A Systematic Taxonomy and Empirical Analysis \- MDPI, https://www.mdpi.com/2079-9292/15/10/2222

36. 0\. AI Security Overview | AI Exchange, https://owaspai.org/docs/ai\_security\_overview/

37. Agentic AI Security: What It Is and How to Do It \- Palo Alto Networks, https://www.paloaltonetworks.com/cyberpedia/what-is-agentic-ai-security

38. The Agentic AI Security Scoping Matrix: A framework for securing autonomous AI systems, https://aws.amazon.com/blogs/security/the-agentic-ai-security-scoping-matrix-a-framework-for-securing-autonomous-ai-systems/

39. Prompt Injection: Definition and Attack Taxonomy \- CrowdStrike, https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/prompt-injection/

40. From Prompt Injections to Protocol Exploits: Threats in LLM-Powered AI Agents Workflows, https://arxiv.org/html/2506.23260v1

41. Careful adoption of agentic AI services | Cyber.gov.au, https://www.cyber.gov.au/business-government/secure-design/artificial-intelligence/careful-adoption-of-agentic-ai-services

42. Multi-Agent AI Security: Enterprise Risks, Compliance, and Mitigation | Augment Code, https://www.augmentcode.com/guides/multi-agent-ai-security-risks-compliance-fixes

43. The Dark Side of LLMs: Agent-based Attack Vectors for System-level Compromise \- arXiv, https://arxiv.org/html/2507.06850v6

44. Cascading Failures in Agentic AI: Complete OWASP ASI08 Security Guide 2026, https://adversa.ai/blog/cascading-failures-in-agentic-ai-complete-owasp-asi08-security-guide-2026/

45. Emergency Stop Design for AI Agents — A Circuit Breaker, https://unimon.co.th/en/blog/ai-agent-circuit-breaker

46. Securing AI Agents: Monitoring for Threats You Can't Unit Test (Part 2\) \- Medium, https://medium.com/@michael.hannecke/securing-ai-agents-monitoring-for-threats-you-cant-unit-test-0674d4a3c762

47. AI-Powered Polymorphic Honeypot for Advanced Threat Deception and Network Security \- ijsret, https://ijsret.com/wp-content/uploads/IJSRET\_V12\_issue2\_230.pdf

48. MTD-Playground: An Attacker-Aware Evaluation Framework for Network Moving Target Defense \- arXiv, https://arxiv.org/html/2607.12199v1

49. A Survey on Moving Target Defense: Intelligently Affordable, Optimized and Self-Adaptive, https://www.mdpi.com/2076-3417/13/9/5367

50. Moving Target Defense Meets Artificial-Intelligence-Driven Network: A Comprehensive Survey \- ResearchGate, https://www.researchgate.net/publication/388334212\_Moving\_Target\_Defense\_Meets\_Artificial-Intelligence-Driven\_Network\_A\_Comprehensive\_Survey

51. Federated Multi-Agent Deep Reinforcement Learning-Driven Moving Target Defense Against DoS Attacks in UAV Swarm Networks \- arXiv, https://arxiv.org/html/2506.07392v4

52. Moving Target Defense Research Articles \- Page 1 \- R Discovery, https://discovery.researcher.life/topic/moving-target-defense/967934?page=1

53. A Situation Prediction Driven Stochastic‐Stackelberg Game Approach for Defense Decision‐Making in Industrial Internet \- ResearchGate, https://www.researchgate.net/publication/406501251\_A\_Situation\_Prediction\_Driven\_Stochastic-Stackelberg\_Game\_Approach\_for\_Defense\_Decision-Making\_in\_Industrial\_Internet

54. Artificial intelligence driven multi agent framework for adaptive cyber attack simulation and automated incident response in cyber range environments \- PMC, https://pmc.ncbi.nlm.nih.gov/articles/PMC13062070/

55. Learning Deceptive Tactics for Defense and Attack in Bayesian–Markov Stackelberg Security Games \- MDPI, https://www.mdpi.com/2297-8747/30/2/29

56. Illustration of 5 distributions. | Download Scientific Diagram \- ResearchGate, https://www.researchgate.net/figure/llustration-of-5-distributions\_fig2\_373503336

57. A First Order Meta Stackelberg Method for Robust Federated Learning \- arXiv, https://arxiv.org/pdf/2306.13800

58. Multi-agent Reinforcement Learning in Bayesian Stackelberg Markov Games for Adaptive Moving Target Defense \- arXiv, https://arxiv.org/pdf/2007.10457

59. Optimal Strategy Selection for Moving Target Defense Based on Markov Game, https://www.researchgate.net/publication/312075075\_Optimal\_Strategy\_Selection\_for\_Moving\_Target\_Defense\_Based\_on\_Markov\_Game

60. Scenario-based Decision-making Using Game Theory for Interactive Autonomous Driving: A Survey \- arXiv, https://arxiv.org/html/2509.05777v1

61. Adversarial Decision-Making for Moving Target Defense: A Multi-Agent Markov Game and Reinforcement Learning Approach \- MDPI, https://www.mdpi.com/1099-4300/25/4/605

62. Adversarial Decision-Making in Cyber Defense | PDF | Game Theory \- Scribd, https://www.scribd.com/document/938720379/entropy-25-00605-v2

63. A method of network attack-defense game and collaborative defense decision-making based on hierarchical multi-agent reinforcement learning | Request PDF \- ResearchGate, https://www.researchgate.net/publication/381867600\_A\_method\_of\_network\_attack-defense\_game\_and\_collaborative\_defense\_decision-making\_based\_on\_hierarchical\_multi-agent\_reinforcement\_learning

64. USCSA: Evolution-Aware Security Analysis for Proxy-Based Upgradeable Smart Contracts \- arXiv, https://arxiv.org/pdf/2512.08372

65. Penetrating the Hostile: Detecting DeFi Protocol Exploits Through Cross-Contract Analysis, https://www.researchgate.net/publication/397086700\_Penetrating\_the\_Hostile\_Detecting\_DeFi\_Protocol\_Exploits\_Through\_Cross-Contract\_Analysis

66. A survey on smart contract vulnerabilities: Data sources, detection and repair | Request PDF, https://www.researchgate.net/publication/369863282\_A\_survey\_on\_smart\_contract\_vulnerabilities\_Data\_sources\_detection\_and\_repair

67. The use of autonomous cyber capabilities in armed conflict and States' due diligence obligations to avoid unintended violations of international humanitarian law \- Cambridge University Press & Assessment, https://www.cambridge.org/core/journals/international-review-of-the-red-cross/article/use-of-autonomous-cyber-capabilities-in-armed-conflict-and-states-due-diligence-obligations-to-avoid-unintended-violations-of-international-humanitarian-law/AC7C1608D1AA3C9FED4BD3322876B72C

68. (PDF) Autonomous Cyber Capabilities under International Law \- Academia.edu, https://www.academia.edu/93689193/Autonomous\_Cyber\_Capabilities\_under\_International\_Law

69. (PDF) The Use of Autonomous Cyber Capabilities in Armed Conflict: Legal Appraisal from a Targeting Law Perspective \- ResearchGate, https://www.researchgate.net/publication/403594571\_The\_Use\_of\_Autonomous\_Cyber\_Capabilities\_in\_Armed\_Conflict\_Legal\_Appraisal\_from\_a\_Targeting\_Law\_Perspective

70. (PDF) Autonomous intelligent agents in cyber offence \- ResearchGate, https://www.researchgate.net/publication/261238237\_Autonomous\_intelligent\_agents\_in\_cyber\_offence

71. Burak Oktenli | AI Governance & National Security Researcher, https://burakoktenli.com/