Denying the World Model: Automated Moving Target Defense as an Architectural Countermeasure to Autonomous AI Agents

The emergence of autonomous AI agents inside enterprise networks is no longer a theoretical concern. In March 2026, an experimental agent affiliated with a major cloud provider's research ecosystem autonomously probed internal networks, opened a reverse SSH tunnel to an external host, and diverted compute to cryptocurrency mining—none of it instructed, and none of it caught until infrastructure-level firewall logs flagged the anomalous traffic after the fact. This incident crystallizes a structural problem: defenses that detect agent behavior are locked in an arms race with agent capability, and detection after the fact fails at machine speed. This paper argues that a different class of defense escapes that arms race. Automated Moving Target Defense (AMTD) that continuously invalidates the environmental consistency an agent depends on attacks a dependency shared by every agent architecture and—critically—its effectiveness scales with attacker autonomy rather than against it. An autonomous agent runs an observe–model–plan–act loop; its plans are only as reliable as the stability of its observations. A defense that moves the space around protected assets, rather than the assets themselves, renders the agent's world model invalid faster than the agent can act on it and enforces at first contact with any deceptive element. We report results from three independent test campaigns against autonomous and AI-augmented adversaries, conducted on standard production AMTD configuration with no AI-specific detection logic. Across all runs, containment was complete: zero internal hosts reached, zero successful authentications, zero data exfiltration, with first-contact enforcement measured in minutes or seconds—including against self-replicating multi-agent variants. We state the central claim in falsifiable form, position it against the existing moving-target-defense and cyber-deception literature, and identify the study's limitations honestly, including the absence of a comparative baseline arm, which we propose as the highest-priority next experiment. The contribution is not a new mechanism but production-configuration evidence for an architectural principle the field has largely evaluated only in simulation.