An AI attacker just demolished the AI systems built to stop it.
Researchers built Trident, an agentic red-teaming framework that trains a compact 7-billion-parameter "Planner" language model to invent cyberattacks against reinforcement-learning-based network defenders, using sandbox environments from CybORG CAGE 4 and CyberWheel plus a dataset of more than 13,000 recorded red-blue interactions. A separate, frozen "Coder" model turns the Planner's strategies into working Python scripts that run against live defenders. With just that one trainable planner, Trident cut blue-team defensive performance by an average of 522 percent versus static, scripted red-agent baselines. That figure is not a bounded win rate: it tracks cumulative episode reward, a score that can swing well past zero into negative territory once an AI attacker forces a defender into actively harmful moves, so a decline north of 100 percent simply means the defender ended up far worse off than where it started.
That matters because almost every DRL cyber-defense system to date has been graded against fixed, predictable attackers, the security equivalent of grading a student on a test they have already seen. Trident's planner invented its own tactics, like dodging decoy systems and reprioritizing which network state to target, tricks no static red team had used. That gap between benchmark scores and real adaptive pressure suggests published defenses may be far less robust than their leaderboard numbers imply.
The uncomfortable takeaway is not that Trident is an unusually clever attacker, but that the field has mostly been testing itself against opponents too weak to notice the difference.