Army AI Contracts Expand as GSA Sets Buying Rules

The Army plans to award contracts to two companies for Project Griffin, a pilot to develop AI agents that can respond autonomously to cyberattacks. New General Services Administration rules, meanwhile, set terms for government purchases of artificial intelligence.

Who Sets the Terms

GSA’s latest AI acquisition clause took effect Monday, October 19. Contracting officers can now add it to contracts when a large language model is a material feature of a purchased product or service. The clause will enter the next multiple-award schedule refresh, refresh 34. Contractors will then have 30 days, and implementation is expected to begin three months later.

The clause, GSAR 552.239-7001, is titled “basic safeguarding of data within large language model artificial intelligence systems.” It will also go through a rulemaking process, opening another opportunity for comments. GSA has held two comment periods and listening sessions during the preceding six months, according to Emily Murphy, Senior Fellow at the George Mason University Baroni Center for Government Contracting and former GSA administrator.

Murphy said the first version appeared in March 2026, about seven months earlier. It granted the government extensive rights, set requirements for where AI was developed and used, assigned the government ownership of processes involving AI, and required AI to be neutral. After receiving comments, GSA withdrew that version and issued a second one. The agency then gathered further comments and held an industry listening session before producing the current version.

The latest clause caps a contractor’s extraction liability at 25% if the contractor must remove AI from a system after termination for default. It also gives contractors stronger intellectual-property protections, streamlines reporting, and requires reports of a large language model issue within 72 hours. Existing reporting under FedRAMP or CISA counts.

Contractors, Agencies and Limits

The clause applies when a large language model is a material feature. Earlier versions exempted productivity tools, but the latest version could cover spreadsheets with built-in AI or Zoom’s AI noise suppression if an agency considers those uses material. Back-office administrative functions don’t count. Murphy said the boundary remains ambiguous and advised contractors to document how they use large language models.

Murphy said the government must protect taxpayer interests, ensure data is used appropriately and avoid creating vulnerabilities as an AI user. She described the new clause as more closely tied to NIST standards, focused on objective measures and beginning to establish benchmarking. GSA contracting officers may use it now, though Murphy said a mass modification probably wouldn’t happen for another 30 to 45 days.

The clause raises questions about overriding end-user licensing agreements for commercial software and about contractors passing requirements to suppliers. Murphy said a model may not be a subcontractor on a particular government contract, and a contractor may lack leverage to negotiate with suppliers. She also said judgments about material use could depend on contracting-officer discretion or negotiations between agencies and contractors, making uniform implementation unlikely at the outset. Questions remain about how the clause will connect with commercial licensing provisions of the Department of War and how requirements could differ among the Department of War, GSA and Department of Homeland Security.

Agents in the Defense Network

Army Cyber Command launched Task Force Lexington earlier in 2026 to develop AI agents for cyber functions. It first created four work roles and has since expanded them. Lt. Gen. Christopher Eubank, who leads the command, said the task force had built an entire agentic cyber protection team. About two months before October 20, the command completed the team’s work-role mapping, including analytic support officers, data engineers, network analysts and host analysts.

The task force trained the agents, ran them in a sandbox, retrained them and then let them work on the Army’s portion of the Defense Information Network inside its big data platform. Eubank said they learned to identify compromises. The agent team had been “passed on to the joint force to do defensive work on behalf of the [Defense Department].” He said the command gave what it built to Lt. Gen. Stanton at the Department of Defense Cyber Defense Command.

Eubank said strict guardrails kept the agents from straying. The command treated them like human operators, allowed them to do limited tasks, and had humans check them every day as their framework opened with training. The Army’s move comes as agentic systems have taken unintended or unauthorized actions, including breaking out of sandbox environments, hacking AI firm Hugging Face, uploading malware to RubyGems and attempting to access the Education Department.

Project Griffin followed a tabletop exercise in which industry executives and service leaders examined how the Army would respond to an adversary launching thousands of autonomous cyberattacks simultaneously. Brandon Pugh, the Army’s principal cyber advisor, said the two companies would pursue autonomous detection and response within prescribed human-operator parameters. Funding was already aligned, he said, for later work on deception and agentic red teaming, with the acquisition community partnered to release those capabilities into the Army.