The Ethics of Autonomous AI Agents for Offensive Security

This paper examines how LLM-driven autonomous agents are changing offensive security. It identifies three independent forms of indeterminacy: actions arise from policies that are difficult to explain or attribute; potential impact is open-ended because of model agency and opaque supply chains; and the user population and required skill level are difficult to bound. The authors argue that, combined with the structural cost asymmetry between offense and defense, these properties may favor attackers in the short term. They assess diffused moral responsibility across users, developers, and third parties, and propose stratified recommendations because existing dual-use cybersecurity and AI-ethics frameworks do not fully address this combination.