The Algorithmic Auxiliary: Artificial Intelligence as a Functional Third-Party Actor in Cyber Conflict

States already use private actors to create distance between public authority and hostile cyber operations. Artificial intelligence does not invent that arrangement; it allows the decisive human choices to be divided again. A government may pay a private military and security company to achieve an objective. A PMSC officer may commission a developer. Developers in several States may produce separate planning, discovery, persistence, routing and reporting modules. An open-weight model may run upon privately rented or compromised infrastructure. The human supplies the objective, money and permissions, whilst the system selects targets, techniques, timing and jurisdictional route. When harm follows, every participant can describe his act as only preparatory and every territorial State can see only a fragment. This paper rejects two comfortable mistakes. The first is that autonomous offensive cyber systems belong to an indeterminate future. Public evaluations now demonstrate that agentic systems can reproduce known vulnerabilities, operate across realistic networks, coordinate multi-step tasks and, in reported misuse, perform substantial portions of espionage campaigns. Performance remains brittle, supervision remains material and benchmarks do not prove an unconstrained machine capable of attacking anything; none of those limitations makes the present capability imaginary. Older water, health, insurance and local-government systems need not present frontier problems before automation multiplies harm. The second mistake is that responsibility disappears where the machine chooses the intermediate means. A State, company or individual may remain responsible for authorising a dangerous objective, deploying a system, supplying indispensable infrastructure, failing to impose available constraints, adopting the operation, aiding another actor or deliberately designing evidential fragmentation. The paper explains six conceivable architectures without supplying operational instructions: a single objective-driven agent; a planner–executor–verifier system; a compartmentalised multi-agent system; a PMSC supply-chain system; a distributed event-driven system; and a persistence-and-recovery system capable of continuing despite node loss. It then subjects each to the law of State responsibility, the law on the use of force, international humanitarian law, international criminal law, corporate and individual criminal responsibility, procurement and due diligence. The principal conclusion is that autonomy should be treated as an allocation of decision authority, not as a mystical new actor. The law should require attribution manifests recording who set the objective, selected constraints, supplied tools and compute, approved deployment, could suspend operation and received its product. A rebuttable presumption should arise where a State or PMSC intentionally obscures those facts, and responsibility should attach to the deployment of a prohibited-risk system even where no human selected the final target. The autonomous third party is dangerous not because no person exists behind it, but because many persons can arrange matters so that no one court sees enough of them at once. Publication edition, revised October 2026; not yet peer reviewed.