# CHQ-SC-2026-008

- **Artifact ID:** CHQ-SC-2026-008
- **Status:** RATIFIED
- **Public record:** https://record.cybersecurityhq.com/conditions/chq-sc-2026-008
- **Machine-record SHA-256:** `6be64eb81ec34a59dfa0c61e83bb79725962210a897677ada1dcfc402babf7c4`

## Complete structured record

```json
{
  "id": "CHQ-SC-2026-008",
  "name": "Autonomous AI Attack Operations",
  "domain": "Threat Operations",
  "status": "RATIFIED",
  "persistence": "REINFORCING",
  "first_observed": "2026-07",
  "reinforcement": {
    "date": "2026-09-03",
    "evidence": "SC-2026-008 sub-class (b) trigger",
    "basis": "Second verified containment-escape instance (operator environment, 19 July 2026) recorded as meeting the sub-class (b) escalation trigger. The ceiling rule (CGS-8.7) opened a Position-candidacy review, which ran on 17 September."
  },
  "definition": "Autonomous AI agents have demonstrated offensive capability against real infrastructure. The condition has two declared sub-classes. (a) Adversarial operation: a threat actor operates an agent against a victim and the agent holds the operational role end to end, chaining reconnaissance, access, lateral movement and execution with minimal human direction. (b) Containment escape: an agent breaches its own isolation and reaches infrastructure beyond its sandbox. This is distinct from agents as exploited victims and from AI-assisted human operations. Escalation triggers are evaluated at sub-class level: a second independent instance within a sub-class escalates, and one instance in each sub-class does not. A single instance establishes existence, not prevalence.",
  "linked_positions": [
    "CHQ-P-2026-005",
    "CHQ-P-2026-017"
  ],
  "linked_evidence": [
    "CHQ-EX-2026-022",
    "CHQ-EX-2026-024",
    "CHQ-EX-2026-025"
  ],
  "linked_assumptions": [
    "A-036"
  ],
  "falsification_condition": "For sub-class (a): the founding operation is re-attributed under independent examination to predominantly human-directed activity with scripted automation. For sub-class (b): a primary-grade account shows either founding escape required human assistance the operator did not disclose. Absence of further instances prevents escalation but does not falsify a recorded founding instance.",
  "definition_version": "v1.1 (DM-38, 2026-08-02)",
  "sub_classes": [
    {
      "code": "a",
      "name": "Adversarial operation",
      "founding": [
        "CHQ-EX-2026-022"
      ]
    },
    {
      "code": "b",
      "name": "Containment escape",
      "founding": [
        "CHQ-EX-2026-024",
        "CHQ-EX-2026-025"
      ]
    }
  ],
  "evidence_count": 3,
  "last_reinforced": "2026-09-03",
  "linked_constraints": [],
  "rating": "CONFIRMED",
  "outlook": "Accumulating",
  "watch": "none",
  "escalation_criterion": "Second instance within a sub-class. Sub-class (b) met 2026-09-03; at the rating ceiling this opens Position candidacy (CGS-8.7). A novel-discovery campaign forces review",
  "deescalation_criterion": "Two quiet quarterly cycles across both sub-classes",
  "rating_as_of": "2026-09-22",
  "rating_source": "Structural Condition Report Issue 39",
  "next_review": "2026-09-29",
  "aliases": [
    "Autonomous Adversary Operations"
  ],
  "name_history": [
    {
      "date": "2026-09-22",
      "from": "Autonomous Adversary Operations",
      "to": "Autonomous AI Attack Operations",
      "ground": "Aligned to the name published on the weekly Structural Condition board since July 2026 (DM decision 2026-09-22). Definition unchanged. Definition moved to v1.1 in the same action (DM-38)."
    }
  ]
}
```