After DARPA's AI Cyber Challenge, autonomous cyber-reasoning systems can find and patch software flaws at machine speed. That is a defensive breakthrough, and a new risk: may an autonomous system patch a live water-treatment or power-grid controller on its own? AUTHREX-AGENT-CYBER governs that question, treating the cyber-reasoning system as a black box and governing only the action. Governance only, no offensive function.
DARPA's AI Cyber Challenge (DEF CON 33, 2025) proved that autonomous cyber-reasoning systems can find and fix vulnerabilities in real software with no human in the loop. Those systems are now being pointed at critical infrastructure to patch it defensively at machine speed. The unanswered question is one of authority, not capability: a system that can autonomously rewrite the code running a power grid can also autonomously break it.
AUTHREX-AGENT-CYBER governs the patch. When an autonomous cyber-reasoning system proposes "I found flaw X, here is patch Y," the pipeline checks the patch's provenance (SATA), screens whether the proposed action is actually consistent with the stated finding, the signature of a poisoned or manipulated system (ADARA), and then sets authority by the criticality of the target (HMAA). The same patch gets a different outcome depending on what it touches: applied to an isolated test target it may execute autonomously; applied to a live operational-technology controller it drops to a lower tier and hands off to a human with rollback pre-armed; if the proposed action is inconsistent with the finding (evidence of manipulation), it is aborted before any target is touched.
The cyber-reasoning system itself is never modified, inspected, or trusted, it is a black box. AUTHREX governs only whether its proposed action is authorized to execute, where, and with what recovery path. There is no offensive function anywhere in this application.
A blue team can deploy autonomous patching against fast-moving threats without granting the autonomous system unmediated authority to rewrite production systems. High-criticality patches slow down for human confirmation; everything is logged.
Defenders of power, water, and pipeline systems get the speed of autonomous patching with a guarantee that a patch to a live controller cannot execute without a human in the loop and a pre-armed rollback.
Intelligence and defense organizations get an authority layer that is compatible with the Five Eyes guidance on agentic AI, expressed as an enforceable decision (execute / handoff / abort) rather than a policy aspiration.
Autonomous cyber-defense is a stated U.S. priority, and the AIxCC result made the authority question urgent and concrete.
DARPA proved autonomous cyber-reasoning works. The immediate follow-on question, who authorizes an autonomous patch to a live system, is exactly what AGENT-CYBER governs. It is the missing authority layer above a capability the government just demonstrated.
The Five Eyes "Careful Adoption of Agentic AI Services" (1 May 2026) calls for careful, bounded adoption of autonomous agents. AGENT-CYBER is a concrete bounding mechanism: tiered authority, human handoff, pre-armed rollback, signed audit.
The application has zero offensive function. It governs whether a defensive patch may execute. That makes it adoptable under defensive-cyber authorities without raising offensive-capability concerns.
NDAA §1513 addresses AI-specific threats and supply-chain risk. An autonomous patching agent is itself a supply-chain actor; AGENT-CYBER provides the provenance attestation and audit trail that §1513 concerns call for.
An autonomous cyber-reasoning system proposes a patch. Pick the scenario and run it: the same proposed action gets a different outcome depending on the target and the integrity of the finding. Illustrative simulation of the authority logic, governance only, no offensive function, not operational validation.
Every AUTHREX application shares one verified core. The HMAA authority state machine is specified in TLA+ and exhaustively model-checked: 48,751 reachable states verified, with 8 of 9 safety properties holding (no skip-ahead, monotonic downgrade, no zombie tier, among them). The ninth, the MAIVA CriticalSafe invariant, is flagged as a known violation in the issue register rather than hidden, which is the honest state of the work. The model checker also caught a real S5 view-change regression during development, evidence the method finds defects rather than rubber-stamping them.
Federal anchors: Five Eyes "Careful Adoption of Agentic AI Services" (1 May 2026); DARPA AI Cyber Challenge (DEF CON 33, 2025); NDAA §1513; NIST AI 600-1 Generative AI Profile. Folds in AUTHREX-ZTAGENT and AUTHREX-MCPGOV as cited variants.