The U.S. government is quietly funding a secretive startup, Twenty, to pioneer AI automation in offensive cyber warfare. This initiative aims to transform weeks of manual effort into continuous, AI-driven operations targeting hundreds of adversaries simultaneously, raising profound ethical and operational questions about the future of conflict.
In the hushed corridors where national security meets cutting-edge technology, a new and potentially unsettling chapter in cyber warfare is being written.
Far from the public eye, the U.S. government is quietly pouring millions into a secretive startup, Twenty, that promises to revolutionize offensive cyberattacks, not with human ingenuity alone, but with the relentless, scalable power of artificial intelligence.
This isn’t just about faster hacking; it’s about automating conflict on a scale previously unimaginable, transforming weeks of manual effort into continuous, AI-driven operations targeting hundreds of adversaries simultaneously.
The very existence of Twenty, a stealthy Arlington, Virginia-based firm, marks a significant departure from the norm in defense contracting.
Federal records reveal a substantial $12.6 million contract with U.S. Cyber Command this summer, alongside a smaller $240,000 research deal with the Navy.
What makes Twenty stand out isn’t just the money, but its unique blend of venture capital backing—including from In-Q-Tel, the non-profit VC arm founded by the CIA—and its focus on offensive AI.
Traditionally, such contracts have gone to either niche bespoke firms or established giants like Booz Allen Hamilton.
Twenty, with its dual identity as a VC-backed tech darling and a crucial government contractor, represents a new breed of player in the shadows of cyber conflict.
The company’s public face is minimal, but its aspirations are anything but.
Its website declares a mission to “fundamentally reshape how the U.S. and its allies engage in cyber conflict,” aiming to automate workflows that once consumed weeks of human labor.
A deeper dive into its job postings paints a more vivid picture of this ambition.
Twenty is seeking specialists in “advanced offensive cyber capabilities,” including “AI-powered automation tools” and “attack path frameworks.” The mention of deploying open-source tools like CrewAI, designed to manage multiple autonomous AI agents, suggests a future where digital operatives collaborate without direct human oversight, executing complex campaigns with chilling efficiency.
Perhaps most disquieting is the firm’s work on “persona development.” This refers to the creation of convincing fake online accounts, often used in social engineering to infiltrate enemy communities and networks.
While human-driven social engineering is a well-worn tactic, the prospect of AI-generated, continuously evolving personas deployed at scale raises profound ethical and operational questions. Imagine an army of AI-crafted digital ghosts, seamlessly blending into adversary networks, gathering intelligence, and sowing discord without a human hand guiding each interaction.
The implications for espionage, disinformation, and the very fabric of trust in digital spaces are immense.
The executive team at Twenty reads like a who’s who of former military and intelligence experts.
CEO Joe Lin, a former U.S. Navy Reserve officer, brings experience from Palo Alto Networks and Expanse, where he helped identify network vulnerabilities for national security clients.
CTO Leo Olson also hails from Expanse and served as a signals intelligence officer in the U.S. Army.
VP of Engineering Skyler Onken boasts over a decade with U.S. Cyber Command and the Army, while Head of Government Relations Adam Howard’s pedigree includes years on Capitol Hill and the National Security Council transition team.
This formidable blend of deep state experience and cutting-edge tech acumen underscores the seriousness and strategic intent behind Twenty’s mission.
This aggressive push into AI-driven offensive cyber capabilities isn’t happening in a vacuum.
It’s part of a global, escalating digital arms race. Just last week, AI giant Anthropic revealed that Chinese hackers were leveraging its Claude AI to automate up to 90% of their target scouting and attack ideation.
The U.S. itself has reportedly contracted OpenAI, Anthropic, and xAI for unspecified “frontier AI” projects, with contracts potentially worth up to $200 million each. While the specific nature of these collaborations remains under wraps, the message is clear: major powers are investing heavily in AI as the next frontier of conflict.
Compared to existing contractors, Twenty appears to be charting a course toward unprecedented levels of automation.
For instance, Two Six Technologies, another Beltway contractor, has worked on a $190 million project called IKE, aimed at assisting human cyber operators and developing strategies. While IKE’s AI could reportedly proceed with attacks if success probabilities were high, there’s no indication it operates at the “hundreds of targets simultaneously” scale that Twenty claims.
This suggests a qualitative leap from AI as an assistant to AI as an autonomous, mass-scale operator.
The dominant application of AI in cybersecurity to date has been on the defensive side, with companies like Tenzai using AI to find vulnerabilities in customer software for “red teaming” purposes.
This contrast highlights the ethical tightrope the world is now walking.
While AI can bolster defenses, its deployment in offensive operations, particularly with the stated goal of “automated, continuous operations across hundreds of targets,” introduces a new layer of complexity and risk.
The rise of Twenty, a secretive, VC-backed startup staffed by former intelligence operatives, developing AI to hack foreign targets at massive scale, is more than just a technological advancement.
It’s a profound shift in the very nature of warfare. It raises critical questions about accountability, control, and the potential for unintended escalation in a domain where the lines of conflict are already blurred.
As these AI agents become more autonomous, more pervasive, and more lethal, the global community must grapple with the implications of a future where cyber wars are fought not just by humans, but by intelligent machines unleashed across the digital battleground.
The silence surrounding Twenty is deafening, perhaps because the future it heralds is still too unsettling to articulate fully.
New research highlights how opportunistic infostealer malware is exploiting browser-based password managers to compromise corporate credentials at an unprecedented scale.
The expansion introduces agentic decision flows to bolster investigative capabilities for a national security agency in the EMEA region.
Zoho founder Sridhar Vembu warns that companies must prioritize data sovereignty by building internal AI models to protect sensitive intellectual property.
