This report introduces the concept of "Highly Autonomous Cyber-Capable Agents" (HACCAs), AI systems capable of autonomously conducting multi-stage cyber campaigns at a level comparable to today's top criminal hacking groups or state-affiliated threat actors, and analyzes the security implications of their emergence. The report: (1) Defines what HACCAs are and forecasts when they might arrive, establishing a clear framework for an autonomous cyber agent that can operate across the full attack lifecycle without meaningful human direction; (2) Identifies five core operational tactics, detailing how HACCAs could sustain themselves in the wild, from autonomous infrastructure setup and credential harvesting to detection evasion and adaptive shutdown avoidance; (3) Analyzes the strategic implications, including how HACCAs could intensify interstate cyber competition, lower the barrier to entry for sophisticated operations, and proliferate advanced offensive capabilities to criminal groups and less-resourced state actors; (4) Flags two tail risks that deserve serious attention: the potential for autonomous cyber operations to trigger inadvertent cyber-nuclear escalation, and the possibility of sustained loss of control over rogue HACCA deployments; (5) Proposes seven policy recommendations across three goals: understanding the emerging threat, defending against HACCAs, and ensuring their responsible development and deployment.

翻译：本报告提出了“高度自主网络能力体”（HACCAs）的概念，即能够自主执行多阶段网络攻击活动、其水平可与当今顶级犯罪黑客组织或国家关联威胁行为者相媲美的人工智能系统，并分析了其出现所带来的安全影响。报告内容如下：(1) 定义了HACCAs的概念并预测其可能问世的时间，为能够在无需人类实质性指导的情况下跨越完整攻击生命周期运作的自主网络智能体建立了清晰框架；(2) 识别了五种核心作战战术，详细阐述了HACCAs如何在实战中维持自身运作，包括自主基础设施搭建、凭证窃取、检测规避以及自适应关闭规避；(3) 分析了其战略影响，包括HACCAs可能如何加剧国家间网络竞争、降低开展复杂网络行动的门槛，以及将先进攻击能力扩散至犯罪组织和资源匮乏的国家行为体；(4) 指出了两个值得严重关切的尾部风险：自主网络行动可能引发意外的网络-核升级，以及对失控HACCA部署可能出现的持续失控状态；(5) 围绕三大目标提出了七项政策建议：理解新兴威胁、防御HACCAs攻击，以及确保其负责任的发展与部署。