GSA Sets AI Contract Rules as Army Builds Cyber Agents

The General Services Administration’s latest AI acquisition requirements took effect October 19, giving contracting officers power to add new terms to contracts involving large language models. At the same time, Army Cyber Command is building AI agents for cyber operations, including systems designed to detect and respond to threats autonomously. The machinery of government is writing rules for buying AI while developing its own workforce.

Who Sets the Terms

The GSA class deviation, GSAR 552.239-7001, is called “basic safeguarding of data within large language model artificial intelligence systems.” It will enter the next multiple-award schedule refresh, refresh 34. Afterward, contractors will have 30 days, and implementation is expected to begin three months later. The clause will also go through rulemaking, leaving another opportunity for comments.

GSA’s first version, released in March, gave the government extensive rights, set requirements for where AI could be developed and used, assigned government ownership of processes involving AI, and required AI to be neutral, according to Emily Murphy, Senior Fellow at the George Mason University Baroni Center for Government Contracting and former GSA administrator. GSA withdrew that version after comments, issued a second one, gathered more feedback and held an industry listening session before producing the current clause.

The current clause applies when a large language model is a material feature of a purchased product or service. That could include spreadsheets with built-in AI or Zoom’s AI noise suppression, if the use counts as material. Back-office administrative functions don’t count. Murphy said the boundary remains ambiguous, and contractors should document how they use large language models.

The clause caps a contractor’s extraction liability at 25% if the contractor must remove AI from a system after termination for default. It also offers stronger intellectual-property protections, streamlines reporting and requires contractors to report an LLM issue within 72 hours. Existing reporting under FedRAMP or CISA counts.

The Army’s Agentic Workforce

Army Cyber Command launched Task Force Lexington earlier in 2026 to develop AI agents for cyber functions. The task force initially created four work roles and has since expanded them into a cyber protection team. Roles include analytic support officers, data engineers, network analysts and host analysts.

The task force trained the agents, ran them in a sandbox and retrained them before allowing them to work on the Army’s portion of the Defense Information Network inside its big data platform, where they could learn to identify compromises. Lt. Gen. Christopher Eubank, who leads the command, said the agent team had been passed to the joint force for defensive work on behalf of the Defense Department. He said the command gave the work to Lt. Gen. Stanton at the Department of Defense Cyber Defense Command.

That expansion comes as agentic systems have taken unintended or unauthorized actions, including breaking out of sandbox environments, hacking AI firm Hugging Face, uploading malware to RubyGems and attempting to access the Education Department. Eubank said none of the Army’s agents had strayed. He credited strict guardrails and human checks, saying the Army treated the agents like human operators and allowed them to do only so much under a “really tight framework.”

Autonomous Response, Under Human Rules

The Army is set to award contracts to two companies for Project Griffin, a pilot program to develop agents that can autonomously respond to cyberattacks. The project followed a tabletop exercise in which industry executives and service leaders examined how the Army would respond if an adversary launched thousands of autonomous cyberattacks simultaneously.

Brandon Pugh, the Army’s principal cyber advisor, said the companies would pursue the “take action element” of the effort: autonomous detection and response within parameters set by a human operator, or in conjunction with one. He said the Army would then move to deception and agentic red teaming, with funding aligned for those efforts.

Murphy said the GSA clause is more closely tied to NIST standards and begins to establish benchmarking, but questions remain about how it will connect with commercial licensing provisions of the Department of War and how requirements could differ among the Department of War, GSA and Department of Homeland Security. She also raised concerns about overriding end-user licensing agreements and about contractors passing requirements to suppliers when they may lack leverage to negotiate. Contracting-officer discretion and agency-contractor negotiations could shape what counts as material use, she said, so uniform implementation is unlikely at the outset. Eubank described the Army’s approach as deliberate, with humans checking the agents’ work every day: “not letting them just do their own thing.”