On October 23, Russia's deputy prime minister said three tankers were at sea, that supply contracts were being finalized, and that volumes would rise to 1 million tons in December and could reach 3 million a month. A week earlier, the United States had waived, by executive order, the duties Congress had required to punish Russia's energy customers. Within a week, the waiver became a contract.

Azura's cargo is about 40 minutes of American diesel demand; 3 million tons a month would be a fifth of it, and roughly four times what Russia exported in the third quarter. To deliver that, Russia must repair the refineries Ukraine has spent a year destroying, which Rosneft now says it cannot afford. The contract's first effect is to give Washington an interest in Russian refineries running, even as Ukraine's president says the interceptors it has already paid for "are still not coming."

Diesel is one of four things the arsenal took this autumn from parties it does not control. The second is magnets: China exported 6,165 tons in September, its largest month this year, and they are the magnets in the motors of the drones the new Autonomous Warfare Command is to buy by the hundreds of thousands; Beijing's pause on its licensing rules lapses on November 10, with no notice published. The third is a room: the President said on October 19 that he would meet Vladimir Putin and Xi Jinping in China next month, after the Wall Street Journal reported that Putin had proposed a three-way meeting in Shenzhen to settle the war in Ukraine, without Ukraine. The fourth is money: on October 21, the Treasury sold 20-year bonds at a record 5.469 percent with foreign demand well below its average, and the 10-year fell below 5 percent the next day only because investors fled artificial-intelligence debt for the government's.

The one adversary with nothing to sell was squeezed: a third carrier group was ordered toward Iran on October 21, and Brent settled Friday at $116.72, its highest since April, which raised the price of everything the arsenal buys from the adversaries that do sell.

A sanction is the instrument of the party that sells. This autumn, the United States is the party that needs, and each supplier holds a date on which it can change the terms: October 31, when Russia's own fuel-export ban lapses; November 10 for Beijing's licenses; early November for the Treasury's refunding; November 18 for the summit. In economic warfare, the buyer takes the terms.

I write this from the Cipher Brief's Threat Conference at Sea Island, where General Bryan Fenton and I addressed the question of what the Department of War has to do with economic warfare. The week answered it before we spoke: the Department is now, by available reports, a customer of one adversary's refineries, a buyer of another's magnets, the holder of an ally's interceptors, and the owner of the carriers that set the price of oil. No office weighed those instruments against one another; the suppliers did.

For nine weeks in these pages, I have written about what the United States cannot do, from the army it cannot command to the day it cannot choose, and each piece ended at the same place: a decision no one was assigned to make. The diagnosis is complete, and the series turns here from what we cannot do to what we must. The place to start is the Autonomous Warfare Command: its plan is due on October 30, and it will be the government's largest buyer of the parts this piece is about.

Three things must be in that plan, and none of them is money.

First, the authority to decide. The Secretary's memorandum settles who buys. It has not settled who decides: one command-and-control architecture across every Service and domain, including space; who allocates among theaters when two ask for the same drones on the same day; who overrides at tempo; and whether the answer binds the Services. Congress granted those authorities to Special Operations Command in 1986, with its own budget line and acquisition power. The plan should name the same for this command, and add the paragraph Congress left out in 1986: command and control.

Second, the edge. Ukraine computes on the aircraft; we compute in Virginia and wait, and the Pacific cannot fight on a round trip. The plan must put the computing on the platform and the communications on a layer the force controls, so that no one else sets its speed.

Third, supply before the ban. The command's motors turn on Chinese magnets until American plants deliver, and the Pentagon's own ban takes effect on January 1. A Defense Production Act priority rating and a drawdown from the National Defense Stockpile, issued before November 10, stock what we need before we forbid what we depend on. The same plan is the demand signal industry has asked for: an architecture and a date.

The economic front needs the same discipline before the summit. The diesel contract Moscow is drafting can carry an American sunset and condition, or Moscow's; the choice closes when it is signed. The Shenzhen agenda can be published by Washington before Beijing publishes its own. An office beneath the President must hold those terms once set, because the next price of fuel will argue for changing them. A buyer who does these things is still a buyer, but no longer a price-taker. Set the terms before the supplier does. In this war, the suppliers are the parties we set out to pressure, and they hold the dates.

—

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

On the morning of October 23, the cargo ship Khoryv sent a distress call 13 nautical miles off Constanța, Romania. Territorial waters end at twelve. Whoever flew the drone that sank her knew where the line was, and chose to stand one mile outside it.

That mile is the story. It is the difference between an attack on a NATO member and an incident in a NATO member's exclusive economic zone. It is the difference between Article 5 and a press release. The London insurance market understood this before most capitals did. When the Joint War Committee extended its Black Sea listed area on September 16, it covered the entire sea except the territorial waters of Bulgaria, Georgia, Romania and Turkey. The underwriters drew the same line the drone operators did. Nobody should find that comforting.

This is what gray zone conflict looks like. Freighters burning off the coasts of two NATO allies, sailors lost in cold water, and attacks clustered around the Sulina Channel, which became the main outlet for Ukrainian grain after Russia hammered Ukraine's own ports. It is war at a time and place of the attacker's choosing, priced just below the point where anyone is obliged to do anything about it.

"The problem is that we cannot prove it"

Bulgaria's prime minister, Rumen Radev, is nobody's idea of a Russia hawk. He told his parliament the logic of the attacks points to Moscow, and then said the quiet part out loud: "The problem is that we cannot prove it."

NATO's response has been built to solve Radev's problem. After the North Atlantic Council met on October 20, the Alliance announced it would send maritime patrol aircraft, radar, drones, intelligence personnel and forensic teams to examine the explosives. A U.S. Navy P-8 Poseidon is already flying the Black Sea. These are sensible deployments. They are also answers to the wrong question.

Play the scenario out. Grant NATO perfect attribution. The forensic teams recover a guidance board with Russian markings. The P-8 tracks a launch back to a known site. The Alliance announces, with high confidence, that the Russian Federation sank the ship. Now make it worse: the next drone hits a tanker alongside the pier at Constanța, the fire spreads, and thousands of civilians are dead.

The Kremlin denies it. Within the hour, Russian state media points at Kyiv, and it doesn't have to work hard to sell the story. Ukraine has been running its own maritime drone campaign since July, so the Black Sea is full of Ukrainian drones, and everyone knows it. A few Western commentators find the denial "plausible enough to warrant caution." Allies invoke Article 4 and consult. Statements are issued. Sanctions, already near their ceiling, are tightened at the margins. Then nothing happens, because every capital in the room is doing the same arithmetic: Russia has nuclear weapons, the Black Sea is not worth a war, and the dead are already dead.

You don't have to imagine that sequence. We ran it on July 17, 2014, when a Buk missile destroyed Malaysia Airlines Flight 17 over eastern Ukraine and killed everyone aboard. A Dutch-led investigation established in 2016 that the launcher had been delivered from Russia, and by 2018 that it came from a Russian army unit. The ICAO Council found Russia responsible in May 2025. The European Court of Human Rights did the same that July. Moscow denied all of it, spent years promoting theories that blamed Ukraine, and in 2022 invaded the country the missile had been fired over. Attribution was as good as attribution gets. The consequence, eleven years later, was an order to enter into good-faith negotiations on reparations.

That is the lesson Moscow took from MH17, and it is the one we refuse to learn. Deniability is not a shield for the attacker. It is a gift to the defender who would rather not act. Russia doesn't need us to believe its denials. It only needs us to want to.

Operational freedom is the target

The point of these strikes isn't the ships. It's the water around them. Every hull that burns off Sulina raises the premium on the next one, pushes a charterer toward a different route, and teaches a shipowner that a NATO coastline offers no protection. The attacker never has to declare a blockade. The market imposes it for him. Freedom of action shrinks by increments, each too small to justify a response, until the defender wakes up to find that the sea he was sure he controlled has a new landlord.

This is how Russia and China will impose costs on the West for the foreseeable future. Not with the decisive battle our doctrine, our budgets, and our military exercises are built around, but with a steady accumulation of incidents chosen for their deniability, timed to our distractions, and calibrated to our fear of escalation. Salami slicing is not a new idea; Beijing has practiced it in the South China Sea for more than a decade. What's new is the drone, which makes the slicing cheap, precise and anonymous.

The honest complication

The Black Sea gray zone is not one-sided, and pretending otherwise hands Moscow its talking points. Ukraine's Operation Molochka, launched in July, claims to have disabled 300 Russian-linked vessels in the Black and Azov Seas. Turkey's foreign minister says both sides are mounting heavy attacks to establish superiority before winter.

The distinction holds. Ukraine is striking the logistics of the country that invaded it, mostly sanctioned tankers serving Russian ports and occupied Crimea. Russia is striking grain ships in the economic zones of two NATO members that are not party to the war, with the apparent aim of making Ukraine's last reliable export route uninsurable. One is a belligerent waging war at sea. The other is exporting that war to the Alliance's doorstep and daring it to notice.

Taiwan won't look like Hellscape

If you want to know what a Taiwan conflict will look like, watch the Black Sea.

In 2024, Adm. Samuel Paparo said he wanted to "turn the Taiwan Strait into an unmanned hellscape" to defeat what he described as Beijing's likely plan: a massive attack with little warning. It's a sound concept, and the CNAS work that fleshed it out this year is serious. Hellscape is built to break an amphibious assault at the water's edge.

Beijing is rehearsing something else. The PLA's Justice Mission 2025 drills in December, run alongside the China Coast Guard, simulated a blockade of Taiwan's main ports and control of the waterways that carry its energy imports. This year the China Coast Guard and Maritime Safety Administration have run what the Jamestown Foundation calls a "quasi-quarantine" east of the island, creating the appearance of administrative control without declaring a blockade. Taiwan has already prosecuted a Chinese captain for severing an undersea cable. Each step is a law enforcement action, an inspection, an accident. None of them is an invasion.

A drone swarm waiting in the Strait for a landing force has nothing to shoot at when the adversary is a coast guard cutter boarding a container ship for a "safety inspection." The first Taiwanese or American drone to fire makes Taipei the aggressor. So Beijing won't cross the Strait. It will tighten the noose: a quarantine, a severed cable, an insurance listing, a shipping line that quietly decides Kaohsiung isn't worth the premium. It will bank on the world's risk aversion. It’s already working. After the May summit in Beijing, Washington paused a record $14 billion arms package for Taiwan, and the President described those sales as a "very good negotiating chip". Taiwan will not be conquered. It will be persuaded, one closed option at a time, that there is nothing left to defend.

Answering below the threshold

You cannot deter gray zone coercion with a capability designed for the war the adversary is careful never to start. The answer has to live in the same band the attacker does: below the threshold of general war, above the threshold of pain. Three steps would help in the Black Sea, and each has a Pacific twin.

Presence that denies, not presence that watches. Turkey, Romania and Bulgaria already run a Mine Countermeasures Task Group whose mandate was widened in July to cover undersea infrastructure. Montreux restricts warships of non-Black Sea states, not the littoral navies. Widen the mandate once more, to counter-drone escort of merchant traffic through allied economic zones, and buy the equipment from the Ukrainians who have kept their own grain corridor open under fire. In the Pacific, the equivalent is a convoy and escort plan for a quarantine, not only a kill chain for an invasion.

Decide the response before the incident. The moment of decision is where risk aversion wins, because it is always easier to wait for one more forensic report. Allies should agree in advance, and say publicly, what a verified strike on shipping in their waters will cost Moscow: a pre-approved tranche of capability released to Ukraine, a pre-agreed number of shadow fleet hulls detained. Attribution should trigger an equivalent consequence, not another discussion. Taipei and Washington need the same menu for a quarantine, written now, while no one is under pressure.

Take the market off the adversary's side. When insurers and charterers do the attacker's work, governments need a sovereign war-risk backstop for vessels trading to allied ports, so the next listed-area extension doesn't function as a blockade by spreadsheet. Taiwan will need that backstop on the first day of a quarantine, not the ninetieth.

None of this is escalation. It is the minimum required to make the gray zone cost something.

The Thirteenth Mile

The Khoryv went down one mile outside a line we drew. The adversary picked the mile. Next time it will pick the hour, the cargo, the flag and the ocean. The question for the Alliance isn't whether we can prove who did it. It's whether, once we prove it, we will do anything.

———

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Economic statecraft has become a primary instrument of US national security, deployed with a frequency and ambition that outpaces the intelligence architecture built to support it. For sanctions, tariffs, investment screening, export controls, and development finance to succeed, the United States must fully leverage the data and intelligence available to it. Now is the time for the IC to organize itself around the discipline of economic and financial intelligence.

The IC has long struggled to prove its value to economic customers: the Secretaries of Treasury, Commerce, Defense, and State, as well as the US Trade Representative and financial regulators. One frequent explanation is the IC’s historic orientation toward military and diplomatic support. Another is the perception that classified economic analysis lacks distinctive value. I spent most of a twenty-three-year intelligence career inside the economic discipline, ultimately leading Treasury’s Office of Intelligence and Analysis (OIA). While this may once have been true, the IC is doing better than ever to meet growing demand.

The problem is no longer the quality of the analysis—which has matured immensely—but the IC’s decentralized approach to serving its economic customers. No IC agency is specifically responsible for the discipline of economic and financial intelligence. The closest is OIA.

Congress created OIA in statute in 2004 with an eye toward sanctions support and countering terrorism finance. Its role has since expanded across economic, financial, and cyber issues for customers across government and industry. However, OIA is not the designated IC lead for US economic statecraft—no IC agency is. One consequence is that the Office of the Director of National Intelligence (ODNI) remains the statutory lead for analytic support to the Treasury-led Committee on Foreign Investment in the United States (CFIUS). That made sense in 2007, when the Foreign Investment and National Security Act codified CFIUS and assigned the Director of National Intelligence that role. At the time, OIA was in its infancy and consumed by counterterrorism. That is no longer the case.

The instinct in Washington is to solve a challenge like this by first creating a new organization, then fixing the functions. Congress should start with the functions instead, then address where the discipline sits. To improve IC support to economic statecraft, Congress must first act on six fronts.

Designate a functional manager. One IC element must own economic and financial intelligence as a discipline: collection priorities, analytic standards, a hiring and training pipeline, and a framework for systematic engagement with allies and industry. Nothing about that role requires a new agency.

Clarify authorities. Explicitly authorize collaboration between the designated lead and both its government customers and the private sector, including exchange of expertise and data.

Supercharge private sector engagement. Many of the best national security solutions in economics and finance will come from industry. Create a permanent path for its ideas, expertise, and capabilities.

Work with what exists. Use OIA as the foundation and keep the number of IC agencies flat, but cap its size so it stays nimble as economic statecraft evolves.

Revisit ODNI’s CFIUS role. IC support to CFIUS sits with ODNI because in 2007 no one else could carry it. Whether it should move depends on where the discipline lands, but Congress should not view the 2007 answer as permanent.

Fund it as a national mission. Economic intelligence should not have to compete for a share of a domestic department’s topline. Give the discipline a dedicated budget line, with the investment in people and AI that exploiting economic data at scale requires.

That leaves where the discipline sits—and there are three answers, not one.

The easiest first step is a designation: name OIA the functional manager, leave it in Treasury, and make clear in statute and to policy customers that OIA is the center of gravity for economic and financial intelligence. That is available now and beats the status quo. Nevertheless, an IC office answering to the Secretary of the Treasury will always be seen—correctly—as Treasury’s first. This is why Commerce and others periodically press for shops of their own, an outcome that grows the IC rather than optimizing it.

The achievable reform is bureau status. Treasury did this with FinCEN in 2002, and FinCEN is now treated as a government-wide and international resource rather than Treasury’s alone. Done properly it means a separate appropriation, a director accountable to both the Secretary and the DNI, and a statutory mission naming service to the whole government, the private sector, and our allies.

The stretch option is to elevate OIA to become an independent National Geo-Economic Intelligence Agency—still my own preference, because only independence settles the question of whose intelligence office it is. But where the discipline sits is the last decision, not the first. Under any of the three, the proximity OIA has built with Treasury policymakers is a design problem with a known solution: dedicated, co-located teams at each major customer department.

Economic intelligence is a core national security capability and should be organized and resourced like one: purpose-built to track, anticipate, and disrupt adversary financial and commercial threats in real time. The playbook has changed. Our competitors are more agile, emboldened, and shaping markets and supply chains to their advantage while we debate whether the threat qualifies as strategic.

All statements of fact, opinion, or analysis expressed are those of the author and do not reflect the official positions or views of the U.S. Government. Nothing in the contents should be construed as asserting or implying U.S. Government authentication of information or endorsement of the author's views.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Over the last century, modern medicine achieved a historic feat. We increased the human lifespan by 33%. But at the same time, we completely failed to defend our brain healthspan. Today, a silent gap of 15 to 30 years exists between the time our bodies survive and the time our brains remain vibrant, innovative, and fully functional. It is a terrifying paradox. Medical science has advanced so much that a newborn today can realistically expect to live to 100, if not 120 years old. Yet, we passively accept that their cognitive engine will begin an irreversible, downhill slide in their thirties with the likelihood of dementia reaching almost 100% by the age of 110. What good is an extra three decades of biological existence if our brains lack the strength and resilience to enjoy it? This is no longer just a localized healthcare crisis; it is an imminent national security threat to our competitive edge.

Look at where our national focus and funding are directed. America is focused on investing billions of dollars into artificial intelligence and hypersonic defense systems. However, we are systematically ignoring the ultimate computing engine that builds the technology, commands our military, drives our economy, and stabilizes our communities: the human brain.

Our global competitors are not making this mistake. Most notably, China understands that future geopolitical dominance will not be won simply by hoarding raw technology. It will be won by the cognitive longevity, relentless innovation, and emotional resilience of their population. They are playing the long game and investing in their brain economy; We are falling behind.

In the military, we use a concept called staying "left of boom." It means executing proactive, aggressive conditioning and preventative strategies to stop a catastrophe before it happens, rather than digging through the wreckage after an explosion.

Right now, America’s approach to brain health is reactive. Our public policy treats brain aging as an inevitable, downhill slide into deficit. We pour billions of dollars into solving brain health collapse, like dementia and visible cognitive breakdown, before we actively intervene. But that approach is a losing strategy. We must shift from a reactive, disease-focused model to a proactive era of precision brain health in order to finally maximize American brainpower. If we do not actively optimize our collective intelligence and mental endurance, we will fall behind not only in defense readiness but also in scientific advancement and workforce productivity.

Fortunately, building a sharper, more resilient nation has never been easier or more measurable.

A landmark, three-year longitudinal study of 4,000 adults recently published in Nature Portfolio’s Scientific Reports completely dismantles the myth of inevitable cognitive decline. The data proves that the human brain possesses a no-ceiling capability. From ages 19 to 94, the brain retains a profound capacity to continually rewire, adapt, and improve its performance over time.

The key to unlocking this potential is a newly validated, multidimensional metric called the BrainHealth Index. For the first time, we can treat the brain exactly like physical fitness. We don't guess if our hearts are healthy; we measure blood pressure. The BrainHealth Index finally gives us a credible benchmark to track and measure holistic brain improvement across three critical pillars:

• Clarity: Our raw capacity to solve complex, novel problems and drive deep technological innovation.
• Connectedness: Our capacity for social purpose and communication, which serves as the bedrock for stable families and strong communities.
• Emotional Balance: The mental resilience required to perform under extreme pressure, from corporate boardrooms to tactical defense environments.

When we actively invest in and train our cognitive micro-skills, the positive implications ripple across society. Every day, citizens become better in their personal relationships, more productive at their jobs, and significantly more resilient against modern burnout and life stressors. Scaled nationally, this collective mental fitness becomes the invisible armor required for our national defense and technological endurance.

As a neurologist, a retired U.S. Army Colonel, and the former founding director of DARPA’s Biological Technologies Office, I have spent my entire career protecting and restoring the brains of our service members. I know what the human mind is capable of achieving when it is pushed to optimize, rather than just manage decline.

Our federal agencies, including the Department of Health and Human Services, the NIH, and the Department of Veterans Affairs, must immediately work to adopt scalable, digital health initiatives that democratize these brain optimization tools nationwide. But executive action is only half the battle. Congress must step up and introduce a unified, bipartisan National Brain Capital Act. Just as lawmakers realized we could not secure our future without a CHIPS and Science Act to defend our artificial intelligence hardware, they must recognize that we cannot protect our nation without a legislative framework to maximize our human brainpower. We must empower every single citizen with the self-agency to improve their own cognitive capacity. It is time for Congress to stop treating brain performance as a passive medical luxury for the few. It is a national imperative to keep America leading the world.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

A7’s OpenAI prompt was six words long: "Translate [name] to [language]. Answer only translated text."

Developer code leaked in 2025 from A7—the Kremlin-linked payment network designated by Treasury on October 1 as “a significant transnational criminal organization”—shows A7 used this prompt with OpenAI's API to create fake invoices, fake stamps, and a complex ledger that made Russian procurement look like ordinary trade.

Our investigative work, as featured originally in the “Big Shor” investigation and in subsequently featured in the New York Times and Financial Times, reveals that between January 2025 and June 2026, A7 laundered over $80 billion through the international financial system and continues to do so today. Zach was the principal researcher and Dawson peer reviewed the report and mentored the research team.

The common story is that sanctions cut Russia off from SWIFT and dollar clearing. In reality, Russia never left the Western financial system; A7 is how it re-entered at state scale. It still needs dollars and euros to buy components, sell oil, and pay intermediaries; China’s CIPS, yuan, crypto, and barter cannot replace them.

How the scheme works

A7 acts for Promsvyazbank, the state bank serving Russia's defense sector. A7 has laundered over $80 billion through roughly 435 financial institutions in at least 83 countries, funding Russia’s war in Ukraine, intelligence operations, election interference, and trade. Its clients have included Iranian oil sellers, which is why Treasury rolled the designation into Operation Economic Outcast.

A7’s shell companies, often run from Russia over VPNs, open accounts at local banks in Bishkek or Dubai’s free trade zones. Those banks rely on larger regional banks, which clear dollars through correspondents in New York or Hong Kong. Each sees only the customer in front of it. Card programs issued under sponsor banks give front companies and Russians access to payment rails without a direct banking relationship.

Fundamental to the scheme were fake invoices, produced at scale using OpenAI’s ChatGPT. A7 also used ChatGPT to forge stamps and automate intake of SWIFT payment confirmations from scanned receipts. Because A7 broke the operation into steps that each looked legitimate, OpenAI’s screening was unlikely to flag it—a gap AI companies must close.

This is where the burden falls on banks, and where the anti-money laundering (AML) framework fails. It was built to catch criminals hiding proceeds, not a state-backed service with intelligence-grade tradecraft. A7’s disposable shell companies are replaced faster than any sanctions list can be updated. To Western correspondent banks, its flows look like normal bilateral trade.

Banks can catch A7 only by tracking behavior over time: new free-zone trading companies moving outsized volumes, product descriptions that do not match the counterparty, and payment routes with no commercial logic. However, banks can only go so far on their own.

The deeper problem is permissive jurisdictions—UAE free zones, Hong Kong, Kyrgyzstan, and Türkiye—that offer fast incorporation, light ownership checks, and access to dollars and euros. Intermediating Russian trade is profitable, and many of these governments frame it as “neutrality” rather than evasion. In Kyrgyzstan, A7 relied on relationships reaching the highest levels of government and the banking sector.

The Macro Threat: Sanctions, SWIFT, and China

As former U.S. Treasury and intelligence officials, we see A7 as a sobering reminder that the first wave of financial sanctions on Russia fell short. The international banking system remains the indispensable engine of Russia’s war effort.

This exposes a broader geopolitical failure: adversary coordination. Russia, Iran, the DPRK, and China increasingly share intermediaries and methods to exploit Western finance rather than build their own. Yet the allied response remains fragmented, targeting networks like A7 one at a time.

This forces hard choices about dollar access. Washington could strip correspondent access from the Chinese and regional banks moving billions for U.S. adversaries. That might disrupt A7, but it raises the question of whether weaponizing dollar access compels compliance or accelerates Beijing and Moscow's push for a closed-loop financial system.

Changing the Equation: Government Actions

Allied governments must close systemic loopholes. Diplomacy with third countries has largely run its course; the leverage now lies in their banks’ access to Western finance. Tools like FinCEN’s Section 311 can force regional banks to choose between servicing networks like A7 and keeping their Western correspondent accounts. Regulators must treat nested correspondent relationships (banks clearing payments for other banks’ customers) and sponsored credit card programs (cards issued by smaller banks and fintechs under a bank’s license) as direct compliance liabilities.

Exams that test only static list-screening teach banks to build to that baseline. Exams should require network analysis, and governments should help scale these costly tools for vulnerable institutions in developing countries. This must be paired with mandatory information sharing: secure channels for client exit data and real-time international exchange of typologies.

Finally, authorities must treat AI and cloud infrastructure with the same scrutiny as traditional finance. Finalizing know-your-customer rules for cloud providers and requiring AI companies to flag behavioral anomalies would deny illicit actors the cheap infrastructure they need to scale.

A7 still moves billions every month. A week after Treasury acted, A7 announced a stablecoin USDT-SWIFT product; the timing was not a coincidence. Even if A7 is degraded, its model is highly portable, and Iran and North Korea are watching. The question for Washington, London, and Brussels is whether they can help industry disrupt these networks through a compliance culture that prioritizes real impact over list-based box-checking.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

The United States is racing to field AI and autonomous systems. It is not racing to figure out how to fight with them. This imbalance between technology and concepts is widening a gap the U.S. is ill prepared to close. Ukraine has shown us why this gap is a threat: every new capability breeds a countermeasure, and technological advantage now spoils in months. The answer is not just faster innovation. It is making concept development a continuous military function, one that ties new technology to experimentation, validation, and adoption at the speed the fight demands. Not just a function of schoolhouses and Headquarters.

Russia’s full-scale invasion of Ukraine began in 2022 as a war of armored columns and maneuver. Today, trenches and minefields stretch for hundreds of miles, reminiscent of World War I; while drones, unmanned ground vehicles, precision munitions, and persistent surveillance hunt anything that moves.

The United States has poured considerable energy into buying and fielding new technologies faster, and has shown how we are endeavoring to learn from Ukraine. But the U.S. has put far less energy into the institutional processes we need to determine how we fight as technology and adversary behavior changes. This creates a consequential gap between what we build and how we fight.

This growing gap has two parts. The first is substance: technology and concepts need each other. A concept that ignores new technology will overlook new operational possibilities, while a new technology without a concept is a demonstration… not a warfighting capability.

The second is tempo: technology moves in weeks and months, while the processes that decide how formations should use it operate in years. Our fastest-ever concept cycle, from counterinsurgency doctrine to the Iraq Surge, took eighteen months. Most move slower still: gradual, methodical, and caked in decades of calcified bureaucracy.

The problem isn’t just that doctrine changes more slowly than technology. Units in combat adapt fast. The greater challenge is translating those adaptations into concepts that can be tested, refined, integrated into combined-arms operations, and adopted across the force.

That doesn’t mean rewriting concepts every time a new drone appears. It means recognizing when a change in technology (or in the enemy) breaks assumptions behind how we fight, then testing and spreading the fix before it goes stale.

Concept development must become a continuous military function, not a periodic publication. The winner won’t be the side that buys technology fastest, but the side that turns it into battlefield advantage before the enemy adapts. Today, the U.S. is not built to do that quickly.

Ukraine: Adaptation as Necessity

Ukraine illustrates the increasingly reciprocal nature of battlefield adaptation. To date, every advantage has invited an answer. Both sides have changed their technology and tactics again and again in response to each other, and neither has held an edge for long.

Consider the first-person-view (FPV) drone. Cheap, attritable, and easy to build, FPVs turned every squad into a precision strike force. Electronic jamming became its counterpoint. Fiber-optic drones, immune to jamming, then entered the field. Each move created new openings and new limits, and forced changes in both the technology and how it was used.

The operational consequences extend well beyond FPV drones. Persistent surveillance paired with cheap precision strike has changed where and how formations can move, mass, resupply, and survive. Concealment, dispersion, and deception matter more than ever. A unit that concentrates in a location, moves in the open, or runs a predictable supply route becomes a target.

This is the more consequential lesson from Ukraine: a technological innovation may initially improve the effectiveness of a particular weapon or unit, but its broader significance emerges when it changes the conditions under which formations operate. Then the enemy adapts, and the cycle starts again. And again.

In Ukraine, technological advantage is perishable. The hard part isn’t fielding new capabilities. It’s recognizing when they, or the enemy’s countermeasures, demand a different way of fighting.

The American Challenge: From Innovation to Institutional Learning

For the United States, Ukraine demonstrates why concept development cannot remain an episodic activity conducted in schoolhouses and periodically revisited. The lesson is not that Ukrainian solutions are universally applicable. It’s that new technology and countermeasures can break operational assumptions faster than our institutions are built to respond.

The United States cannot just replicate Ukraine’s approach. U.S. forces fight expeditionary campaigns, integrate across joint and coalition formations, and answer to policy, legal, and safety requirements that a nation like Ukraine, fighting for its survival and territorial integrity, does not. The goal is Ukraine’s capacity to adapt, built to American requirements.

Our gap isn’t a shortage of experiments or innovation offices; efforts like the Army’s “Transformation in Contact” are putting new capabilities into units and learning from them. Our gap is having a pathway from what one unit learns, to what the whole force learns. A concept that works in one brigade may fail against a different enemy, in different terrain, or at a higher echelon. And a successful experiment rarely changes training, force design, or acquisition on its own.

Autonomy has raised the stakes and made our pathway to institutional learning an even greater necessity. A software update, a retrained model, or a new way of employing a system can change how technology behaves, and can quietly invalidate the conditions under which it was tested and fielded.

That is the problem assured autonomy is meant to solve. Assured autonomy is justified confidence that an autonomous system will do what it is supposed to do. It must therefore account for the whole relationship: the technology, how it is employed, and the environment it operates in. Continuous, evidence-based assessments can tell commanders when a change requires fresh evaluation and where the boundaries of responsible use lie. Built into the adaptation process, assurance can support speed without abandoning safety, reliability, accountability, or established approval authorities.

Building an Adaptive Concept-Development Enterprise

The United States needs a repeatable process that links new technology, operational concepts, experimentation against a thinking enemy, validation, and adoption across the force.

We are suggesting neither a prototype nor a concept paper. It’s a validated, revisable concept of employment, backed by operational evidence: how a formation can fight differently, under what conditions that works, and what it takes to make it happen. Four functions are needed to get us there:

First, connect concept and technology development directly to operational formations.

Operators, technologists, testers, and concept developers should work alongside commanders. Their job goes beyond improving systems or inventing tactics: they should identify which operational assumptions a new capability breaks, and draft concepts to test.

Not every improvement demands a new concept. A better jammer may only need a new tactic; a capability that changes how a brigade moves, masses, or resupplies demands a new way of fighting. The force needs people close enough to the fight to tell the difference.

In Ukraine, operational units have designated innovation officers liaising directly with industry; industry partners provide prototypes, receive feedback on battlefield experimentation and adaptation. Through this relationship, operators, technologists, and testers converge on a specific requirement, and battalion-level Commanders have the authority to acquire the necessary prototypes to integrate into their formations.

Second, establish a persistent cycle of adversarial operational experimentation.

The question isn’t whether the technology works as designed. It’s whether the formation using it accomplishes the mission better against an opponent who adapts. Experiments should also find where a concept fails: what works against one threat may fail against another, and a promising system may impose unacceptable costs elsewhere in the formation.

Combat training centers, experimentation units, and operational formations already provide the foundation. The task is to link them into a persistent learning loop, fed by operational evidence and intelligence.

Ukraine offers a cautionary tale. For nearly three years, intelligence indicated Russia was developing jet-powered Shahed variants, by most accounts ample time to prepare countermeasures. But when Russia began launching these faster one-way attack systems, Ukraine had too few interceptors capable of that speed, and their previous interception tactics were insufficient to stop them. The warning did not sufficiently feed a cycle of experimentation before the threat was fielded. That gap cost lives.

Third, connect operational validation to adaptive fielding.

Today, a system is typically tested, approved, and fielded as a finished product. But in a fight like Ukraine’s, nothing stays finished: software is updated, models are retrained, and units find new ways to employ what they have. Each change can quietly invalidate the evidence behind the original fielding decision. Adaptive fielding treats validation as continuous, asking what has changed and whether the earlier evidence still holds.

For autonomous systems, this is where assured autonomy matters most, and where scrutiny should match the modification. A minor software patch for a drone flying the same mission in the same conditions may need only a quick check. Retraining its targeting model, sending it into a new environment, or reducing human supervision demands full re-evaluation. This doesn’t bypass approval authorities or testing requirements. It gives them a faster, evidence-based way to decide when more evaluation is needed.

Fourth, institutionalize validated concepts across the force.

This is the decisive step. Experimentation produces evidence; learning happens only when that evidence changes how the force trains, organizes, equips, and fights.

A counter-drone tactic proven in one division should appear in the next combat training center rotation, the next force design update, and the next acquisition…not in an after-action report on a shelf.

This change requires a defined pathway and clear authorities. Commanders, testers, capability developers, and acquisition officials each own different decisions, but those decisions must draw on a common body of operational evidence, with clear decision points for when the evidence is strong enough to act. The result is a continuous cycle: develop, experiment, validate, field, learn, institutionalize, adapt. Then repeat, as the technology and the enemy change.

In Ukraine, Aerorozvidka, a non-governmental organization, plays this role: not a think tank but an empowered change agent -- capturing evidence from the field and shepherding it through commanders, technologists, and acquisition officials until new tech is deployed or new concepts (like deep strike) are fielded.

Operational Advantage Depends on the Capacity to Learn

The United States possesses substantial technological, industrial, and innovative capacity to compete in AI and autonomous warfare. But technological leadership alone will not produce operational advantage. Adapting a system isn’t the same as adapting a force, and a better-performing unit doesn’t change the course of a campaign.

Four questions will dictate our capacity to learn: The technical question is what a system can do. The tactical question is how formations should employ it. The operational question is how it changes the way maneuver, fires, intelligence, protection, sustainment, and command combine to win. The strategic question is whether the institution can answer all three, again and again, faster than the enemy.

The race isn’t to build the best autonomous systems or to field them first. It’s to turn technological change into operational advantage, faster than the enemy can take it away. In the age of AI and autonomy, the force that learns fastest wins.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Every October, Cybersecurity Awareness Month puts practical security measures in the spotlight. Can an employee recognize a phishing email? Will someone pause before clicking a suspicious link? Are passwords and access credentials being protected? These are important questions; individual behaviors are crucial to maintaining cybersecurity.

But awareness is so laser focused on preventing and mitigating the malicious cyberattack, it’s easy to lose sight of the bigger picture: the cyberattack in front of you may be only one piece of the threat.

In the era of hybrid threats, a cyberattack could be part of a broader campaign in which digital activity intersects with cognitive warfare, sabotage, unusual drone activity, disruptions to communications and navigation systems, and much more. State and state-linked networks might use online fraud or scams to generate revenue for operations, launder funds and undermine confidence in financial and/or government institutions.

The challenge for security and law enforcement agencies transcends detecting and responding to one cyber incident at a time. They must also determine whether events that appear separate may be connected.

That distinction changes what it means to be aware, and the urgency is intensifying. Recent research and reporting shows Russian cyber activity directed at European targets is likely intended to enable intelligence collection, operational reach and long-term access rather than immediate disruption. In parallel, the Iranian government is believed to be relying on a longstanding hybrid warfare model combining cyber operations, asymmetric military operations, information warfare, proxy attacks and coercive state activity, with AI increasingly acting as a force multiplier.

Expect to see more of this going forward, not less.

CONNECTING THE DOTS

Consider the signals individually: a government agency experiences a cyberattack. Unusual drone activity is reported over critical infrastructure. GPS service is disrupted. False or misleading information is deliberately spread. Viewed on their own, these events may have different causes, and each can appear to be a separate incident.

Yet hybrid campaigns often depend on individual activities initially looking ambiguous or unrelated. If each signal is treated only as a self-contained incident, relevant connections may be missed – and when the connections are missed, so is the broader pattern they could form.

This does not make traditional cybersecurity awareness less important. It makes awareness more demanding. The familiar focus on individual judgment must be matched by institutional awareness: the ability of government agencies, armed forces, critical infrastructure operators, and other relevant organizations to recognize which signals may matter beyond the immediate event.

That begins before advanced analysis enters the picture. An organization cannot share information it did not capture, and it cannot capture information it did not recognize as potentially relevant. The first requirement is therefore a common understanding of what may be security-relevant and what information is needed to contribute to a broader situational picture.

This shift is central to the awareness challenge. A suspicious link has a clear place in the traditional conversation. A weak signal in a hybrid environment may not have the same clarity. Its significance may emerge only when it is considered alongside other information. Awareness, in this context, means looking beyond the apparent boundaries of a single incident without assuming that any one event tells the entire story.

The sequence matters: recognize, capture, share, assess. If a potentially relevant signal drops out at any stage, it cannot inform the larger picture. If it moves through that sequence, it becomes one piece of information that can be examined in relation to others.

The next task is to bring those fragmented pieces together. Threat intelligence, decision intelligence and artificial intelligence can help teams work across large volumes of data, correlate information, reveal connections, and alert analysts to anomalies. Their value is especially clear when no single signal is decisive. Several weak and seemingly unrelated signals may form a pattern that supports a more informed assessment of the security situation.

The point is not simply to accumulate more data. It is to make relevant information usable as part of a coherent view. A list of isolated incidents still leaves decision-makers looking at fragments. A situational picture asks a different set of questions: What may connect these events? What does the combined pattern suggest? Which developments deserve closer attention? And what might happen next?

That last question is essential. The goal is not limited to identifying a cyberattack or another security-relevant event after it occurs. It is to understand the relationships among relevant signals well enough to identify potential future developments at an early stage. Detection remains necessary, but detection without connection can leave the larger threat out of view.

For Cybersecurity Awareness Month, this broader perspective offers a useful way to expand the conversation. At the individual level, awareness still means recognizing the suspicious email, protecting credentials, avoiding scams and frauds and thinking before clicking. At the national level, it also means making sure the right organizations know what to notice, what to record, what to share, and how to place that information in context.

The difference is one of scale. An individual may be watching for a malicious link. Government agencies, armed forces, critical infrastructure operators, and other relevant organizations must also be watching for relationships among cyber activity, disinformation, sabotage, drone activity and communications interference.

That is the blind spot Cybersecurity Awareness Month should help bring into focus. There’s more to awareness than paying attention before clicking a link. Awareness means we know which signals deserve attention, whether we can bring them together, and whether we can see the threat they may form before the pattern becomes unmistakable.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Here is a number worth sitting with: federal teams seized roughly 700 drones around World Cup venues this summer. Seven hundred — at one tournament, in one season, with the best-resourced counter-drone units in the world on the field. That figure is a success story and a warning in the same breath: the threat volume is enormous, and the federal government cannot be the only team suiting up for it.

Until this year, it legally had to be. The power to disable a hostile drone belonged to a short list of federal agencies, which left a state trooper at a stadium gate or a corrections captain watching an aircraft hover over his yard with nothing but binoculars and a report form. Congress ended that with the SAFER SKIES Act in December's defense bill, and the DHS-Justice framework implementing it has been in force since July 1: state, local, tribal, and territorial police and corrections agencies that complete federal training and certification, on approved equipment, can now track a threatening drone and — against a credible threat — take it out of the sky above major venues, critical infrastructure, and prisons.

And in the past week, Washington has shown it means to deliver. The Justice Department announced that the FBI's counter-drone training center in Huntsville will double its capacity. DHS's Science and Technology Directorate put commercial counter-drone systems through operational testing alongside state and local officers. The Pentagon selected four directed-energy systems for a homeland counter-drone pilot. This is what implementation momentum looks like, and the departments deserve real credit for it.

Now the hard truth: doubling a small number produces a small number. The Huntsville center's first class, last fall, held twelve officers, and it remains the only place in America where a state or local officer can earn the legal right to bring down a drone. More than 18,500 agencies are now eligible for these authorities. Against that denominator, even a doubled schoolhouse leaves the vast majority of American communities exactly where they were — watching — while the Super Bowl arrives in four months and the Los Angeles Olympics in under two years. Our prisons cannot wait either: drone incidents at federal correctional facilities rose twentyfold in six years, and state systems from South Carolina to Georgia are logging airborne contraband runs by the hundreds.

What turns momentum into coverage is money, sustained past the current news cycle. Congress should fund training at the scale of the authority it created: regional and satellite course delivery so a deputy in Phoenix is not waiting on a classroom seat in Alabama, instructor pipelines that multiply the schoolhouse instead of merely enlarging it, and a certification target tied to the event calendar that oversight committees actually track. Just as important, the FEMA counter-UAS grant program — $500 million across 2026 and 2027, built around the World Cup — should not sunset with the tournament that inspired it. The threat is not leaving when the fans do.

Governors have their own homework, and fewer excuses than ever: the grant rules push at least 97 percent of awarded funds down to local and tribal agencies within 45 days. The money is designed to reach the street. States should name a lead agency, compete for those dollars this cycle, and put their corrections systems and stadium districts first in line for certified teams.

Over more than twenty years in federal homeland security — the last of them leading U.S. Immigration and Customs Enforcement — I watched threats outrun statutes again and again. This time the statute arrived first, and this past week proved the executive branch intends to use it. The remaining question belongs to Congress and fifty governors: whether a nation that just confiscated 700 drones at a single sporting event will fund protection for everyone else. Authority without capacity is a promise. Appropriations are how promises get kept.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Picture an intelligent analyst's screen. Data about troop movements, a port closure, a terrorist attack, or a weapons transfer sits at the center of a clean interface, with a confidence indicator glowing green. Two hundred outlets are carrying it, and the platform has counted every one. It looks like a corroboration. In many cases, it is a single Telegram post, copied, translated, summarized, and republished until its origin disappeared behind its own echo.

Nobody must be negligent for this to happen. It is what you get when a product or platform is built to measure volume and the user is tempted to read volume as truth.

I say this as someone who works with open-source material and believes in it. Commercial imagery, ship-tracking data, procurement records, leaked databases, and social media have changed what is knowable about conflicts and illicit networks; but the market that has grown up around these sources is selling something different from the discipline that makes them valuable, and governments and companies are buying it without noticing the difference.

A Crowded Market and a Thin Product

Open-source intelligence platforms are multiplying quickly. Walk through the company stands at any security conference and you will find dozens of them, each promising to fuse, monitor, and surface threats across the open internet, now almost always with an AI layer that summarizes, ranks, and alerts.

Strip away the interface and most of them offer little that a competent analyst couldn't already do with a search engine, a handful of specialist tools, and some patience. Reverse image searching, scraping social platforms, pulling corporate registry data, and geolocating an image are all learnable skills, and many of the best practitioners picked them up in public, often as volunteers. What the platforms add is convenience and scale, which is genuinely useful, but convenience is not analysis. The real product, in most cases, is the dashboard.

Dashboards are persuasive by design. They squeeze a messy information environment into something that looks like a picture of the world, with counts, trend lines, heat maps, and sentiment scores. Each of those findings implies that someone has already done the hard work of deciding what matters and what is true. Usually, no one has. The system has counted things, and counting is the easy part.

Counting Sources Is Not Testing Them

The core flaw is in what these systems reward. They tend to measure the number of sources behind a claim, not the independence of those sources. The two are very different things.

Independence is the foundation of corroboration. Two witnesses who saw an event separately make a claim stronger. Two witnesses who heard about it from the same third person do not. The same logic applies to reporting. A claim that traces back to a single channel but appears in two hundred outlets has one source and two hundred echoes.

Intelligence tradecraft has a name for this: circular reporting. It is among the oldest and best-documented ways analysts go wrong. The failures that most damaged the credibility of Western intelligence in the past generation involved, among other things, uncorroborated claims that were repeated, cross-referenced, and eventually treated as established because they seemed to come from many places. The lesson drawn at the time was that provenance matters more than prevalence. An aggregator that treats prevalence as confirmation is rebuilding the vulnerability that analysts spent years learning to guard against.

AI makes this problem fourfold. First, language models summarize and synthesize, and in doing so they take away the provenance trail that an analyst needs. A fluent paragraph that blends fifteen sources does not tell you that twelve of them are derivative. Second, the cost of generating plausible content has collapsed. Fabricated articles, cloned news sites, and coordinated amplification networks can now create the appearance of breadth cheaply, which is exactly the signal these platforms are built to count. Third, as more web content is produced or recycled by automated systems, the pool that analytics tools draw from becomes more self-referential. The echo chamber is increasingly populated by machines quoting each other. Lastly, AI can make uncertainty harder to see. Language models are designed to produce coherent answers, not to preserve the ambiguity of the evidence on which those answers are based. Contradictory sources can be reconciled into a smooth narrative, gaps can disappear beneath plausible inference, and tentative conclusions can acquire the tone of established fact. The danger is therefore not simply that an analyst receives false information, but that the uncertainty surrounding otherwise legitimate information becomes less visible.

None of this means the technology is useless. Entity extraction, translation, deduplication, and pattern detection across large data sets are real contributions. But the same tools that can help trace a claim to its origin are too often deployed to certify it instead.

Information Is Not Intelligence

The deeper problem is what happens after the dashboard produces its output. Companies market it as intelligence, and buyers, including government agencies, intelligence firms, financial institutions, and corporate security teams, purchase it as intelligence, then act on it.

However, open-source material is raw information. It becomes intelligence only after a process that no interface can fully automate. Someone has to establish where the material came from, grade how reliable the source has been, assess how credible the specific claim is, and test it against other collection. Established standards exist for this. Grading systems that rate source reliability separately from information credibility have been used for decades, and analytic standards require analysts to describe the quality and credibility of their sources, to distinguish between underlying evidence and judgment, and to account for alternative explanations. These are not bureaucratic formalities. They are the mechanism by which an organization knows how much weight a conclusion can bear.

When that step is skipped, the result is aggregated internet content with a confident interface. The output reads like a finished product, but the epistemic work behind it is missing, and the person reading it often can't see that. A decisionmaker shown a green indicator does not know whether it reflects three independent confirmations or one rumor with good distribution.

The consequences are practical. A government that bases sanctions designations, force posture, or diplomatic messaging on an unverified claim risks embarrassment at best and escalation at worst. A company that reroutes shipments or exits a market because a risk platform flagged a rumor can lose real money; and an agency that comes to rely on commercial feeds may quietly stop investing in the capabilities that would let it check them.

What Should Change

I would offer the following two principles.

One, to treat provenance and independence as essential to intelligence. Open-source material should be treated as a cue and a corroborator, not a conclusion. Open sources are at their best when they point collection in a useful direction or when they test and strengthen what other sources have suggested. A satellite image that shows construction at a site tells analysts where to look and what to ask. A procurement database entry might confirm a pattern already suspected. Neither is a finding on its own. The workflow should run from open-source lead to targeted collection to assessment, not from dashboard alert to briefing slide. As AI makes it easier to summarize, reproduce and generate information, analysts need to know not only what a source says, but where the information originated and whether apparently separate sources are actually independent. A fluent paragraph that blends fifteen sources does not tell an analyst that twelve of them are derivative. Likewise, a cluster of articles, websites or database entries may create the appearance of broad corroboration while ultimately tracing back to a single underlying claim. Platforms should therefore preserve provenance wherever possible and make the distinction between original reporting, derivative content and AI-generated material visible to the user. The workflow should run from open-source lead to targeted collection to assessment, not from dashboard alert to briefing slide.

Two, protect human assessment and the collection that supports it. AI can make uncertainty harder to see. Language models are designed to produce coherent answers, not to preserve the ambiguity of the evidence on which those answers are based. Contradictory sources can be reconciled into a smooth narrative, gaps can disappear beneath plausible inference, and tentative conclusions can acquire the tone of established fact. Human analysts therefore need both the time and the authority to question what automated systems produce rather than simply validate it. That also means protecting the collection capabilities that AI cannot replace. As open-source material becomes more abundant, the value of what cannot be found online rises. Human sources, financial intelligence, law enforcement access and legal process take years to cultivate and moments to lose. A budget cycle that trims them in favor of subscriptions is trading durable capability for a license that expires. The objective should not be to remove automation from intelligence work, but to ensure that automation remains subordinate to collection, verification and human judgment.

What Open Sources Cannot Close

I learned the limits of open-source work firsthand while researching foreign components in Russian strike drones. Open sources got me a long way. Recovered wreckage data, teardown imagery, part markings, and manufacturer documentation could establish what was inside these systems and who made it. That is valuable, and it was achievable by skilled analysts working in public.

But the questions that mattered most were different. Who actually bought a given part? Through which intermediaries did it move? Who paid for it, and through which accounts? Those gaps could not be closed by any amount of scraping. They required the tools that sit behind a legal threshold or inside a trusted relationship: law enforcement access to shipping and customs records, financial intelligence on transactions, and human sources with knowledge of how the networks operate. A dashboard could tell us a component existed. Only that other collection could tell us how it got there and who was responsible, which is the information policymakers need if they want to disrupt the supply chain rather than simply describe it.

That experience shaped how I think about the current issue. Open sources and closed collection are not competitors. The first made the second more efficient, because it let investigators ask better questions. The second made the first more meaningful, because it turned an interesting observation into an attributable finding. Treating either as a substitute for the other would have left us with a weaker product.

Defending the Analytical Craft

None of this is an argument against open-source intelligence. It is an argument for it, properly understood.

The practitioners who built the field's reputation, whether in newsrooms, nonprofits, academia, or government, are rigorous precisely because they distrust easy answers. They document their methods, show their chains of evidence, and say so when something can't be confirmed. That culture is the real asset. It is also what the commercial market is most at risk of undermining, because rigor is slow and expensive to sell, while a dashboard can be demoed in ten minutes.

The test I would offer any buyer, policymaker, or analyst is simple. When you are shown a claim, ask where it began, who else has independent knowledge of it, and what other collection could confirm or contradict it. If the system in front of you cannot answer those questions, it hasn't given you intelligence. It has given you a well-organized rumor.

The volume of open information will keep growing, and the tools to process it will keep improving. The scarce resource will not be data. It will be judgment, along with the access and tradecraft that make judgment possible. Agencies and firms that remember that, and invest accordingly, will see more clearly than those who confuse a full screen with a full picture.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Washington made three decisions this week, and none of them has an end date. On the night of October 14, Ukrainian units in the field found that their Starshield terminals had been capped at a speed, 160 kilometers an hour by the published figure, 70 by President Zelensky's account two days later, which cuts off any strike drone that flies faster than the cap. Reuters reported, citing American and Western officials, that the order came from inside the White House; a senior official said the President had made no such request. Service was reported partly restored by October 15. No terms were ever published. The restriction followed a week in which American negotiators had warned Kyiv that intelligence sharing could be suspended if strikes on Russian energy targets continued, and in which the President announced an "energy ceasefire," which President Zelensky said was "news for me." Ukraine paused its refinery campaign for three days. On October 15, Zelensky told the Financial Times, "We're done," and that morning Rosneft's Ryazan refinery burned. The same day, CNN reported that Ukraine had run out of Patriot interceptors.

Two days later, on Friday afternoon, the President signed an executive order implementing the sanctions act passed by Congress in September. Its second section imposes what the law required by October 18: a 500 percent duty on Russian goods and a 100 percent duty on goods from any country that continues buying Russian crude or gas. Its fourth section waives both, along with eleven other sections of the act, until the President or the Secretary of State decides otherwise. The order names no country, mentions no fuel, and sets no date. The White House said enforcement now "would impede" the search for peace. Diesel in the United States stood at $6.33 a gallon on Saturday, higher than on the day the Russian diesel license was issued.

Last week, in these pages, I argued that no single authority in Washington was charged with weighing the sanctions against the price of fuel, and that whichever claim had the nearest deadline would win. This week, the President himself weighed the claims, and the ranking is visible in the two documents: the diesel license and the peace track outranked the statute, and the ally's campaign was slowed to protect them. Washington gave the peace track as its reason for the first and denied ordering the second. Whatever each was meant to do, both eased the pressure on Moscow in the weeks before November 3. That is a decision, and it bound the only party it could reach, the ally. It is also the week's lesson, because of what it did not contain.

It contained no horizon. The waiver has no end date. The throttle has no published terms. The diesel license runs through April. Each can be reversed by the same hand on any morning, which means none of them bind the party across the table; they inform him. Moscow learned that a license and a telephone call can buy a pause in the campaign against its refineries. Beijing, which must decide by November 10 whether to extend the suspension of its rare-earth licensing rules for American buyers, learned the price at which American pressure lifts, a month before the President arrives in Shenzhen. New Delhi, the act's principal target, received a waiver that asks nothing of it. And every ally that fights on an American-controlled communications or targeting layer learned that the layer can be set to a speed, without announcement, and that the setting is deniable. The European Union's foreign policy chief said the following day that Europe cannot replace Starshield in the short term.

The parties for whom the pressure was built spent the week waiting. Russia's first licensed diesel cargo, 40,000 tons loaded at Primorsk, sailed for Morocco. The volumes could not have moved the American price in any case: the 300,000 tons promised "immediately" are less than a day of American consumption. Tehran kept the American counterproposal under review and held to its sequence, the strait first and enrichment after, while flows through Hormuz ran at 11.6 million barrels a day, down from a pre-war 17.2, and a Singapore-flagged container ship sank, its port authority confirmed, after being struck. The International Energy Agency reported the world's oil stocks 509 million barrels below their pre-war level and agreed on Thursday to release what remains of the barrels pledged in March. Economic warfare is now being fought on two clocks. The West's runs to its elections and its inventories. The other side's runs to neither.

There is precedent for winning a contest of this kind, and it was won by time rather than force. In June 1948, the Soviet Union closed the roads and railways to West Berlin. The Western allies responded with an airlift. The blockade was lifted on May 12, 1949, after eleven months, not because the aircraft had defeated anything, but because Moscow concluded that the West could hold its position longer than Moscow could sustain the blockade. The instrument that prevailed was the horizon, and the West had shown it could keep it.

The remedy I named last week, a single authority to rank competing claims, turns out to be necessary but not sufficient. The authority existed this week and used itself. What it lacked was a commitment that outlasts the next election: a stated date and condition under which the pressure lifts, a provision of fuel and interceptors that carries the country to that date, and an officer beneath the President charged with holding the ranking when the price of diesel argues for changing it. In practice that is a sunset clause: the waiver expires on a date unless the President certifies to Congress why it should not. A sanction without a horizon is a disclosure. A satellite link without published terms is a lever on the ally rather than the adversary.

If you advise on these instruments, the decision you owe this quarter is a horizon. Before the next sanction is signed, the next license issued, or the next allied system switched on, put the date in the document: the condition under which the pressure ends, the provision that carries you there, and the office that holds the line until it arrives. The side that can wait chooses the day. This week, it was not ours.

Richard Berry is the founder and principal of Stratnova Advisors and a former Senior Executive who led the Commander's Action Group at U.S. Indo-Pacific Command; he publishes the weekly assessment Strategic Horizons.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

China is about to run the largest influence operation in history. It will not have to run it. The world will download it.

EXPERT PERSPECTIVE -- Our research team at Vanderbilt spent months inside the internal documents of GoLaxy, a Beijing firm - with ties to the Chinese state - that built a machine for shaping opinion abroad. Using AI, it generates personas, amplifies narratives that are favorable to Beijing and buries narratives that are not. And it’s been busy. It was used in Hong Kong to combat dissent against the National Security Law. It was used in Taiwan to sway the island’s 2024 elections.

Now consider what happens when it does not need to be built at all. If Chinese open-weight models — the ones that anyone can download, modify and run on their own machines — become the foundation that the world builds on, then the Chinese Communist Party’s (CCP) framing of Taiwan, Tiananmen, Xinjiang and Beijing itself ships inside every product that sits on top. No personas. No campaign. Just the default answer, everywhere. Something like this would make GoLaxy look like a dress rehearsal.

And here is the part that should stop Washington cold. Chinese models are about to be everywhere, and American strategy could allow it to happen. Washington is deciding whether to let frontier development run while clamping down on powerful open-weight models (whose safeguards can be stripped away). Here’s the deal though: restrictions would not kill demand for a cheap model that a company can download and make its own. China is standing at the counter with exactly that.

Today, we talk about the AI race as if it has one finish line. But it has two. The first is for frontier capability: who builds the most advanced models. American companies lead the way today. The second finish line is for reach: whose models become the foundation on which thousands of products are built? Chinese firms may have the advantage on this one. The first brings concentrated scientific, economic and military power. The second decides whose systems become the workhorses of ordinary life, and that reach shapes what people know and will learn in the future.

American frontier models like Claude, ChatGPT and Gemini are closed, meaning you use them on the company's servers, and the company can cut off access. Chinese developers compete by releasing cheap open-weight models that companies can run on their own, with no provider to answer to. The babysitter has left the building.

This has already started. Airbnb relies on Alibaba's Qwen in its customer-service agent. Qwen, even briefly, powered a tool for searching proposed regulations on the Federal Register website. Amazon says thousands of customers have deployed DeepSeek through its cloud. In every case the interface is American. But the model underneath it is not.

Here’s something else to consider: Chinese developers must operate under Communist Party rules about what may be said. Those rules then shape which questions the models answer, which facts they omit and how they frame sensitive subjects. Open weights can be retuned, but scrubbing built-in defaults is expensive, and most companies will focus their efforts on addressing what matters to their business rather than check how a model handles every political subject. If a cheap Chinese model sits under thousands of products, its habits travel with it — into research tools, classroom software and fact-checkers — and the person on the other end never knows.

Beijing already knows about this risk. When Meta released its open-weight Llama models, Chinese regulators worried that a foreign model could "poison" China's AI ecosystem with information that the CCP censors. It seems to make sense that Washington should take seriously a vulnerability that Beijing recognized first.

None of this makes the open-weight safety problem smaller. In fact, just the opposite. Once a powerful open-weight model is released, its developer cannot recall it. Its safeguards can be stripped away and the model can be used for cyberattacks, the creation of biological weapons or worse. If we’re going to address this as a society, then testing requirements, liability rules and release restrictions are needed. But a Chinese open-weight model carries the same dangerous capabilities as an American one, and no American rule touches it.

If we constrain American developers and leave foreign weights untouched, demand will certainly shifts toward Chinese models. Theoretically, Washington could end up regulating the companies it can see while deepening its own dependence on the ones it cannot.

One answer might be to ban the Chinese models. But that means telling Americans which information technology they may use — and here lies the irony: the openness that protects Americans from domestic censorship may leave them exposed to systems built under Chinese censorship.

TikTok offers a glimpse of the stakes. More than 170 million Americans use it, and tens of millions say they get their news there. Washington spent five years fighting over its recommendation algorithm, and the deal that kept it in the United States required a change to that algorithm. But an algorithm only ranks videos that people make. While that fight dragged on, AI models learned to make the videos themselves — realistic footage with synced audio, from a sentence, in seconds. Three months after the deal closed, TikTok upgraded its ad tools to ByteDance’s newest video model. No rule required anyone to ask whose model was making the videos.

Now, you can see why the United States is facing a trilemma. It wants to prevent the uncontrolled release of dangerous AI capabilities. It wants to preserve Americans' freedom to choose their technology and information. And it wants to avoid dependence on models that are shaped inside an authoritarian system. It cannot fully secure all three.

Honest regulation starts by admitting that. Before restricting an U.S. model, ask which model developers will pick first. Domestic and foreign models distributed in the United States should face the same tests and the same rules. And companies that build products on a foundation model should have to say whose model it is.

AI leadership combines two things: the capability of a country's best models, and the reach of the models embedded in ordinary life. AI risk also combines two things: what a powerful model might do, and what a ubiquitous one tells people is true. GoLaxy showed us what Beijing can do with a machine to shape a belief. Now, what are we going to do about it?

Mr. Goldstein and Mr. Benson are professors at Vanderbilt University who specialize in national and international security.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Welcome to The Iron Triangle, the Cipher Brief column serving Procurement Officers tasked with buying the future, Investors funding the next generation of defense technology, and the Policy Wonks analyzing its impact on the global order.

On the night of April 24, 1980, eight Navy RH-53D Sea Stallions lifted off the deck of the USS Nimitz and headed for a patch of Iranian salt flat called Desert One. The plan needed six of them to get there in working order. One was abandoned in the desert after a rotor warning. One turned back in a dust storm. One arrived with a failed hydraulic system. The mission was aborted. Then, while the force repositioned to refuel, a helicopter drifted into an EC-130. Eight Americans died on that salt flat, and fifty-two hostages stayed in Tehran.

When the Secretary of War stood at Quantico on September 30 and announced a new four-star command for autonomous warfare, my first question was not about drones. It was about helicopters.

The Holloway review found the mission "conceptually valid and feasible" and blamed "the ad hoc nature of the organization and planning." The fix, Nunn-Cohen in 1986, gave the new Special Operations Command a budget line the services could not raid. We did eventually build better helicopter units. But we didn't build SOCOM around a helicopter. We built it around the problem that broke the helicopters.

The Secretary seems to understand this. "Ukraine's lesson is not that one type of drone wins wars," Hegseth told the room, "but rather the need for a purpose-built system that maximizes the ability to adapt." His signed memo says the output "is not a particular drone, but the ability to adapt in combat." Then the Department named it the Autonomous Warfare Command. This is like naming SOCOM the Helicopter Command. A drone is a photograph of an adaptation. The adaptation is the movie. In Ukraine, radio-controlled FPVs gave way to fiber-optic spools, which gave way to nets, shotguns and interceptor drones, each turn in weeks or months.

When the 3rd Army Corps air-dropped ground robots ten kilometers behind Russian lines during Operation Vivaldi last month, the footage went everywhere. The commanders talked about something else. A battalion commander known as "Darwin," credited a command structure "qualified enough as we are." An American volunteer with the corps described his entire job as "installing Western mission command trust and initiative." We taught them that. They are teaching it back to us with robots, and we are taking notes on the robots.

Retired Lt. Gen. Mark Hertling warns that "creating a headquarters does not create a capability." He is right, and that is the point of this column. The memo orders a 30-day implementation plan, due on the Secretary's desk around the end of October. A headquarters is a wiring diagram. The capability is a soldier in the motor pool at two in the morning with a soldering iron, a laptop and a firmware image that does not work yet. Here is how to build him, keep him and turn him loose.

Start With the Soldier We Already Have

The Army has made a great start. Its newest specialty, the 15X tactical unmanned aircraft system specialist, is graduating classes of about thirty at Fort Huachuca, with 770 expected by year's end and a planned force of two to three thousand. The colonel who runs the training brigade said it better than anyone at Quantico: "The Army has not bought a drone that the 15X is responsible for being an expert on." Train the soldier to learn the machine, not the machine's manual.

Now follow that soldier for six years. If he is good, he makes sergeant. If he is very good, he makes staff sergeant, and the day he pins it on, his job stops being the drone and starts being the eight soldiers who fly it: counseling, evaluations, ranges and the duty roster. The enlisted promotion system has one ladder, and it runs through the leadership of people. The best technician in the platoon either becomes a manager or gets passed over. Either way he leaves the bench, and the private sector is waiting with a better offer.

Bring Back the Specialist

Warrant officers exist to solve part of this problem. The Army already has an unmanned aircraft systems warrant, and the Air Force, which abolished its warrants in 1959, brought them back in December 2024 for cyber, intelligence and space. But warrants are a thin layer by design. You do not put one in every platoon, and the loop the Secretary described lives in the squad and the section.

The Army has solved this before. In 1955, after a committee recommended separating command from technical responsibility, it created specialist grades to reward experience and technical knowledge. A Specialist Six drew a staff sergeant's pay without a staff sergeant's squad. His job was to be the most technically proficient in the building, and the Army paid him to stay that way. The ladder was dismantled from the top down, and in 1985 SP5 and SP6 went away.

Bring them back, starting with unmanned systems. Promote a Specialist Five or Six on what he can build, fix, modify and teach. Same pay grades, separate ladder, one rule: technical authority, never command. Put specialists in every formation that flies, drives or swims a robot, with the warrant corps above them as the technical chain. A Specialist Six at battalion who can rewrite the flight controller tonight, and a CW3 at brigade who knows which vendor to call in the morning: that is what a fix in days looks like.

Pay for the Skill, Not the Stripe

We already pay soldiers for perishable expertise. A linguist earns a Foreign Language Proficiency Bonus of up to $500 a month per language, and must retest every year to keep it. Nobody thinks that is strange. Russian is hard, and it fades.

So does firmware. Build a tiered certification for unmanned systems (repair, modify, program) and pay it monthly, with an annual retest, because the skill expires as fast as the drones do. The money does not need an act of Congress. Under 37 U.S.C. 353, a service Secretary can designate any skill as critical and pay up to $1,750 a month in skill incentive pay, or a proficiency bonus of up to $55,000 a year for certified proficiency. The authority is sitting on the shelf.

Then add the cheapest incentive in the Army's inventory: a badge. The 1953 committee that produced the specialist grades was worried about prestige, and prestige in the Army is worn on the chest. Anyone who has watched soldiers grind through an Expert Infantryman Badge lane knows what they will do for a piece of metal. An expert badge for unmanned systems, tested on build, fix and fly against the clock, would cost almost nothing and fill every off-duty hour in the brigade.

Recruit at the Bench

In June 2025, the Army commissioned four technology executives directly as reserve lieutenant colonels. Now do it at the other end of the org chart. Let a civilian FPV builder or embedded-systems engineer enlist as a Specialist Five instead of a private, on a skills test rather than a resume.

And stop leaving the best reservoir untapped. Thousands of Americans now build drones for a living. The Guard and Reserve can put them in uniform one weekend a month as technical specialists, carrying current industry skill into units without the Army having to match a Silicon Valley salary.

Give Them Permission and a Parts Budget

A specialist who can fix the drone but is not allowed to innovate is an expensive spectator. In April 2025 the Secretary's own Army transformation memo directed the service to "seek to include right to repair provisions in all existing contracts." Finish the job, then delegate the authority to modify and fly small systems down to brigade, so a fix written tonight does not wait months for a distant office to approve it.

Then give him money. The Army's UAS Marketplace, launched in March, has already cleared more than $750 million in sales, and it is adding components and software. Ukraine went further: drone units earn points for verified strikes and spend them on the Brave1 Market, a catalog of more than a thousand products. We do not need the kill leaderboard. We need the principle. Put a parts budget and a catalog in the hands of the battalion specialist, because the fix usually costs less than the paperwork.

Train the Whole Chain

Technical acumen cannot stop at the specialist. The lieutenant has to know what to ask for, and the battalion commander has to know when a twenty-year-old is telling him something he does not want to hear. Put a hands-on unmanned systems block in the officer basic and captains career courses. Send specialists to vendor factories through Training With Industry, and bring vendor engineers forward to battalion in return. Then rate commanders on how fast their formations close the loop.

For the Procurement Officer

Before you sign, ask one question: can a twenty-two-year-old with a screwdriver and a laptop legally open this, fix it and reflash it at two in the morning? If the answer is a field service rep and a ticket number, you did not buy a capability. You rented one. Price the technical data, the open interfaces and the soldier training as line items, and count how many of your fielded systems a Specialist Six could actually work on today.

The Investment Thesis

Your next customer is a Specialist Six. Buying power is already drifting down to the units, through marketplaces here and points in Ukraine. The company with the best drone of 2026 is a commodity supplier by 2027. The company the soldier chooses to learn on, train on and fix with is a platform. Discount revenue built on dependency, and pay up for iteration speed.

The Policy Wonk's Warning

The memo says plainly that the Department will need legislation for the command itself. When the FY2028 NDAA takes it up, Congress should do for adaptation what Nunn-Cohen did for special operations: a protected budget line, and a statutory charter that defines the mission as adaptation across the force, not ownership of a category of hardware. Most of the personnel fixes above need no new law at all. Congress's job is to ask why they have not happened yet.

My Take.

The fight over this command will happen in a document most people will never read. The 30-day plan must "identify measures of adaptation and Service adoption." That clause is where AUTOWARCOM is won or lost. If adaptation is measured in drones delivered, the command becomes a very expensive purchasing agent. Measure two numbers instead: days from a unit reporting a battlefield problem to a fix in its hands, and the count of soldiers in each formation certified to make that fix. Report both to Congress every quarter. Owen West and Max Strasiser built their reputations on speed. I suspect they would welcome being graded on it.

The Risk.

The specialist ranks went away for reasons. Old soldiers still tell stories about the Spec Five who drew sergeant's pay and could not, or would not, run a detail, and about the confusion over who was in charge when the sergeant went down. The bright line between technical authority and command answers most of that. Delegating authority to modify means some soldiers will break drones. That is the tuition, and it is cheaper than the alternative. The bigger risk is the one Hertling named: a new headquarters that adds a layer between the operator and the vendor. If the 30-day plan is mostly wiring diagram and very little soldier, believe him.

Conclusion

Hegseth told the room at Quantico that the English at Agincourt moved their fletchers close to the front to keep the arrows coming. The fletchers were not archers. They were tradesmen, kept near the line because the arrows ran out faster than anyone had planned. In a few weeks, the plan on the Secretary's desk will tell us whether we understood the story. Will we count drones, or will we count days, and the soldiers who make them shorter?

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

On the evening of Friday, October 9, the Treasury published General License 135. It authorizes the “sale, delivery, offloading and importation” of Russian diesel until April 7, 2027, and does not specify a buyer, a seller, or a quantity. The President provided the quantities after a call with President Putin: more than 300,000 tons “immediately,” 500,000 in November, and millions more if Russia’s refineries allow. The first shipment amounts to less than a day of American consumption. The shipment comes from a country that barred its own diesel exports in July and, in the last quarter, imported the fuel for the first time. AAA put the national average for diesel that day at $6.28 a gallon.

The license is valid for six months. The law beside it allows nine days. On September 18, the President signed a sanctions act that the Senate had passed 86-11. By October 18, it requires duties of up to 500 percent on Russian goods and duties of up to 100 percent on every export to the United States from any of the five largest importers of Russian crude oil or natural gas that knowingly purchases again. The first duty covers petroleum products, and so the diesel the Treasury has just licensed. A third law, passed in 2022 and never repealed, still bars Russian petroleum from American ports; the license does not mention it. Washington must penalize Russia’s customers nine days after licensing itself to become one.

For six weeks in these pages, I have argued that the United States is assembling the instruments of great-power competition without deciding who commands them. This week, the pattern reached the oldest instrument of economic warfare, the sanction, and it was not only an American pattern.

On October 7, the European Union’s ambassadors agreed on their 22nd package of sanctions against Russia. They removed one Russian company at Estonia’s request because it supplies the rare earths that an Estonian plant refines for European magnets. Two days later, in Beijing, the European trade commissioner announced an understanding under which China will moderate its exports of hybrid cars to Europe. In return, Beijing will continue to process European companies’ rare-earth and magnet licenses through what both sides call a green channel. The notice suspending China’s licensing rules for American buyers still expires on paper on November 10, eight days before the President is due in Shenzhen. The United States received no such channel.

China’s rare-earth controls are administered by a single ministry, which this week rewarded Europe while leaving the United States waiting. That is an exception used as an instrument: a favor granted in exchange for a concession, and revocable. The American and European exceptions were of another kind. They were relief from sanctions the governments had imposed themselves, granted because the price of diesel or a factory’s feedstock had become intolerable. An exception of that kind is information. It tells Moscow and Beijing the price at which the pressure on them will be lifted.

Each of the week’s decisions had a reason its government could defend. Diesel at more than six dollars a gallon before winter is a real problem, and so is a processing plant in a frontline state of the North Atlantic Treaty Organization. But a sanction lasts only as long as its author can go without what it forbids.

The difficulty is that each decision was made by the office responsible for a single problem. The Treasury issues the license; the President sets the duties, and the Trade Representative adjusts them afterward. The fuel Russia has promised comes from refineries Ukraine is striking, so every Ukrainian strike now reduces the diesel Washington has announced, and Moscow has a commercial reason to ask the United States to restrain Kyiv. The President had already asked Kyiv in September to “take it easy on the refineries,” and President Zelensky called the license “a weak decision by strong partners.” No single authority beneath the President is charged with weighing one of these decisions against another before it reaches him. Each office did its work, and the claim that prevailed was the one with the nearest deadline.

The United States has faced this problem before. In July 1943, after a public quarrel between the board planning economic warfare and the agency financing it, President Roosevelt abolished the board. By September, he had placed economic warfare, lend-lease, and foreign relief under a single Foreign Economic Administration. He did so in the middle of a war because instruments that pull against one another need someone with the authority to rank them.

The duties due on October 18 are the place to begin, and they will be easy to read. A real duty on Russian goods and on Russia’s customers restores the sanction, and taxes the diesel Washington asked for. A nominal rate satisfies the statute and confirms the license as the policy. A waiver says so outright. In the last two cases, Russia’s customers may conclude that buying is safe, and Beijing that American pressure has a price that can be quoted in advance.

Avoiding that takes two things the West has not arranged. The first is a single authority who can rank the claims before they reach the President and hold every office to that ranking: someone who decides whether the sanction yields to the price of diesel or the price of diesel yields to the sanction. The second is provision. A sanction is a siege, and a siege is won by the side that can wait. A government that means to forbid a thing should first establish what it will need from the adversary while the prohibition lasts, then stockpile it, find it elsewhere, or grant the exception at the outset on its own terms.

If you advise on these decisions, ask for the ranking before the duties are signed and for the provisions before the next sanction is drafted. Otherwise, Moscow and Beijing will read October 18 as a schedule of American needs, with the dates on which they fall due.

Richard Berry is the founder and principal of Stratnova Advisors and a former Senior Executive who led the Commander’s Action Group at U.S. Indo-Pacific Command; he publishes the weekly assessment Strategic Horizons.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

OPINION -- China is about to run the largest influence operation in history. It will not have to run it. The world will download it.

Our research team at Vanderbilt spent months inside the internal documents of GoLaxy, a Beijing firm with ties to the Chinese state. It built a machine for shaping opinion in other countries: A.I. that generates personas, amplifies the stories Beijing wants believed and buries the ones it does not. It was used in Hong Kong. It was used in Taiwan. That is an influence operation built by hand, one persona at a time.

Now consider what happens when it does not need to be built at all. If Chinese open-weight models — the ones anyone can download, modify and run on their own machines — become the foundation the world builds on, the Party's framing of Taiwan, Tiananmen, Xinjiang and Beijing itself ships inside every product that sits on top. No personas. No campaign. Just the default answer, everywhere. GoLaxy would look like a rehearsal.

Here is the part that should stop Washington cold. Chinese models are about to be everywhere, and American strategy is what is putting them there.

Washington is deciding whether to let frontier development run while clamping down on powerful open-weight models whose safeguards can be stripped away. Restrictions would not kill demand for a cheap model a company can download and make its own. China is standing at the counter with exactly that.

We talk about the A.I. race as if it has one finish line. It has two. The first is for frontier capability: who builds the most advanced models. American companies lead today. The second is for reach: whose models become the foundation under thousands of products. Chinese firms may be building the advantage there. The first brings concentrated scientific, economic and military power. The second decides whose systems become the workhorses of ordinary life, and that reach shapes what people know.

American frontier models such as Claude, ChatGPT and Gemini are closed: you use them on the company's servers, and the company can cut off access. Chinese developers compete by releasing cheap open-weight models that companies can run on their own, with no provider to answer to.

This has already started. Airbnb relies on Alibaba's Qwen in its customer-service agent. Qwen even briefly powered a tool for searching proposed regulations on the Federal Register website. Amazon says thousands of customers have deployed DeepSeek through its cloud. In every case the interface is American. The model underneath is not.

Chinese developers operate under Communist Party rules about what may be said. Those rules shape which questions the models answer, which facts they omit and how they frame sensitive subjects. Open weights can be retuned, but scrubbing built-in defaults is expensive, and most companies will tune what matters to their business rather than check how a model handles every political subject. If a cheap Chinese model sits under thousands of products, its habits travel with it — into research tools, classroom software and fact-checkers — and the person on the other end never knows.

Beijing already believes this. When Meta released its open-weight Llama models, Chinese regulators worried that a foreign model could "poison" China's A.I. ecosystem with information the Party censors. Washington should take seriously a vulnerability Beijing recognized first.

None of this makes the open-weight safety problem smaller. It makes it bigger. Once a powerful open-weight model is out, its developer cannot recall it. Its safeguards can be stripped and the model turned toward cyberattacks, biological weapons or worse. Testing requirements, liability rules and release restrictions are needed. But a Chinese open-weight model carries the same dangerous capabilities as an American one, and no American rule touches it.

Constrain American developers and leave foreign weights untouched, and demand shifts toward Chinese models. Washington ends up regulating the companies it can see while deepening its dependence on the ones it cannot.

Washington could ban the Chinese models. But that means telling Americans which information technology they may use — and here lies the irony: the openness that protects Americans from domestic censorship may leave them exposed to systems built under Chinese censorship.

TikTok offers a glimpse of the stakes. More than 150 million Americans use it, and more than 50 million regularly get news there. Add DeepSeek or Qwen to generate the content TikTok’s algorithm selects and distributes, and China could supply both the information and the system that delivers it to an enormous audience.

The United States therefore faces a trilemma. It wants to prevent the uncontrolled release of dangerous A.I. capabilities. It wants to preserve Americans' freedom to choose their technology and information. And it wants to avoid dependence on models shaped inside an authoritarian system. It cannot fully secure all three.

Honest regulation starts by admitting that. Before restricting an American model, ask which model developers will pick instead. Domestic and foreign models distributed in the United States should face the same tests and the same rules. And companies that build products on a foundation model should have to say whose model it is.

A.I. leadership is two things: the capability of a country's best models, and the reach of the models embedded in ordinary life. A.I. risk is two things as well: what a powerful model might do, and what a ubiquitous one tells people is true. GoLaxy showed what Beijing does with a machine for shaping belief. Open weights are how it gets one in every pocket. And right now, Washington is holding the door.

Mr. Goldstein and Mr. Benson are professors at Vanderbilt University who specialize in national and international security.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

On the last day of the 2026 World Cup, NORAD F-16s fired flares over northern New Jersey to warn off civilian pilots who had flown into restricted airspace. During the tournament, federal agencies seized more than 700 drones across 11 host cities. The counter-drone effort worked.

That's what worries me.

In less than two years, Los Angeles will open the 2028 Olympic Games, a National Special Security Event spread across dozens of venues followed weeks later by the Paralympics. The threat there won't be the one we just beat, and this summer's solutions won't be the ones we need.

I've seen this before. From 2010 to 2013 I ran the Army's Rapid Equipping Force in the middle of the counter-IED fight. Congress authorized roughly $21 billion for JIEDDO, and we spent nearly $50 billion more on MRAPs. We still lost the adaptation race. The enemy learned and changed faster than our institutions could. Drones have the same traits that made IEDs so hard to beat: cheap dual-use parts, know-how that spreads through informal networks, and changes that cost the adversary almost nothing. Drones are IEDs that fly.

The next drone won't have a radio link

We don't lack counter-drone technology. But every answer we field starts a clock; someone is already building the counter. In Ukraine and the Gulf, autonomous navigation that doesn't need GPS is maturing quickly. One operator can run a swarm, and AI handles terminal guidance. Most counter-drone systems fielded today detect the radio link between drone and operator, and jam it. The drones that matter in 2028 may not have one.

When the sensor at the venue can't hear the drone, the warning has to come from before launch. Left of launch is intelligence.

Weak signals become capabilities before we see them

The drone threat rarely announces itself. During the battle for Mosul in 2016 and 2017, ISIS dropped small munitions from commercial quadcopters. In 2024, fiber-optic drones appeared in Ukraine as a workaround to jamming and quickly became widespread. In June 2025, Ukraine smuggled more than 100 small drones into Russia hidden in trucks, flew them over commercial mobile networks with open-source autopilot software, and struck strategic bomber bases as far away as Siberia. It was built from commercial parts and networks. The capability was the combination.

The same thing is happening here, in plain sight. A small startup has built software that keeps data moving when networks fail, uses AI agents to fuse that data and recommend actions, and ships new features every week. It's built for logistics. Pair it with an off-the-shelf mesh radio sold for drones; vendors say some can cover thousands of square miles from altitude. In a matter of months, a small team could field a jam-resistant, AI-assisted network of drones and sensors that no requirement anticipated and no threat library lists.

Nothing about either piece is a threat. That's the problem. We catalog platforms; the threat emerges in the combinations. And the expertise to put them together is for hire. This month, a Ukrainian air defense officer offered me his team's combat experience on LinkedIn.

Intelligence is more than threat warning

Our intelligence enterprise tends to treat counter-drone support as a threat function: who is flying, what they intend, what is coming. That job matters, but it's one of three.

The second job is awareness. Near a stadium or a base, most drones are flown by hobbyists, photographers, delivery services or people who never checked the rules. The hard problem is finding the one that matters in a crowded sky. That takes a picture of normal: Remote ID, FAA authorizations, event credentials, known commercial traffic. Most of that data sits outside intelligence channels, with the FAA, commercial operators, and state and local agencies that gained their own counter-drone authority on July 1 under the SAFER SKIES Act. The fusion model has to be built with these partners, not around them.

The third job is adaptation. Every drone we recover tells us how the adversary is changing: firmware, components, frequencies, supply chains. That knowledge has to reach the people building countermeasures and the units that will face the same drone next week. When Gen. Stanley McChrystal's task force in Iraq tied intelligence to operations, it went from about 18 raids a month in 2004 to about 300 a month by 2006. Not with better equipment, but because every completed cycle made the next one faster.

One threat, one learning loop

It's tempting to treat Los Angeles as a homeland security problem and the Gulf as a warfighting problem. The drone doesn't care. The same parts, tactics and know-how reach forward bases, stateside installations and crowded stadiums at the same time. Northern Command couldn't determine who flew several drones over a strategic U.S. installation after the Iran campaign began this year.

That cuts both ways. What we exploit from a drone downed overseas is the earliest warning Los Angeles will get. What we test at stadiums at home, in real conditions, strengthens the force overseas. JIATF 401 convenes DHS, the FBI, the FAA and dozens of other federal organizations; its director, Brig. Gen. Matt Ross, puts it plainly: "Nobody can solve this problem alone." Intelligence has to be the engine that makes that connection worth having.

Two clocks, one collision point

Our planning runs on a deliberate, gated clock: fund, test, buy, then freeze the configuration so people can train on it. The adversary's clock has no freeze date. State actors are patient: they watch our events, probe our installations and study our playbook. Extremists and lone actors copy what works overseas, hide among careless flyers and can change tactics up to the day they act. Whatever becomes cheap and proven overseas in early 2028 will be available to them in July 2028.

The collision point is our freeze date. Whatever they adopt after it, we meet unrehearsed.

The answer: test continuously through 2027 at real events, buy fast in early 2028, and never fully freeze. Keep money, authority and software update paths open so something can still change in the final 90 days.

Intelligence has to unfreeze the plan

Only intelligence can create the pressure to reopen a plan that has been funded, tested and trained on. Program managers have every incentive not to, and operators rarely get the chance. The intelligence community should schedule those assessments now, tied to the plan's decision points:

• a threat baseline today
• a reassessment after every 2027 test and every real incident
• a formal assessment before we buy
• a final one inside the last 90 days

Each should answer one question: what has changed that should change the plan?

Sometimes the answer will be "nothing." The system has to be ready for the times it's "a lot." That means flexible funding that portfolio managers can move as the threat moves, and a Congress willing to let them.

In Afghanistan, when the enemy adapted faster than we did, soldiers and allies paid for the delay. We know the date of the next test. Build for the threat we'll face in 2028, not the one we just beat.

Pete Newell is the CEO of BMNT and a former director of the Army's Rapid Equipping Force.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

About one month before Election Day, Americans deserve to know how their government is protecting elections from foreign threats. The Pentagon’s recent directive assigns military intelligence and cyber capabilities to that mission. I welcome that commitment. Americans also need to understand how it fits into the national effort and how federal agencies are supporting the state and local officials who administer elections.

As a former Election Threats Executive at the Office of the Director of National Intelligence, I would have preferred an ODNI-led announcement explaining the foreign threat and the coordinated response, with the FBI, Defense Department, and Department of Homeland Security alongside it. Most of my career was spent at the intersection of combat support and intelligence. My preference comes from ODNI’s role in integrating intelligence across agencies and explaining what it tells us about foreign threats.

Election security depends on accurate ballot counts and public confidence grounded in credible information. An announcement centered on Defense risks giving a military cast to the mission and leaving the public with an incomplete picture. Americans need to understand how federal agencies use their authorities and resources to support elections administered by state and local officials.

An Old Threat Comes Into Focus

Foreign efforts to influence American elections did not begin in 2016. Soviet operations against President Ronald Reagan’s 1984 reelection campaign included a forged letter intended to discredit him. The FBI publicly exposed the forgery. The technology was different, but the purpose is familiar: manipulate Americans’ perceptions through concealed foreign activity.

The 2016 election brought that threat into the center of American public debate and forced a reassessment across the Intelligence Community. The January 2017 intelligence assessment described Russia’s campaign as an escalation in the scope, intensity, and directness of its efforts. Hacking and influence operations could reinforce one another, reaching Americans through channels they used every day.

Identifying a foreign operation is only part of the job. The people it targets need enough information, soon enough, to protect themselves.

By the 2020 election cycle, the government had developed a more deliberate answer. It involved intelligence collection and analysis, investigations, cyber defense, support to election officials, and decisions about what information could be shared beyond classified channels.

Russia is part of a broader challenge that includes China, Iran, and countries with varying relationships with the United States. We need the full national security team to understand what these governments are doing and why, and to inform the operations and policies needed to counter interference, regardless of who is behind it.

What the 2020 effort taught us

The Executive Branch Notification Framework, adopted in 2019, established a process for deciding when and how to notify people about foreign election influence and interference. It complemented existing victim-notification requirements. An interagency group organized by ODNI evaluated threats; DHS handled notifications concerning critical infrastructure, while the FBI handled other notifications.

The framework recognized that different threats require different forms of communication. Some call for a private warning to a targeted candidate or organization. Others justify informing the American public. Decisions were intended to be coordinated and nonpartisan, while respecting protected speech.

Public communication in 2020 extended beyond that framework. In July, National Counterintelligence and Security Center Director William Evanina described intelligence briefings for presidential campaigns, political committees, and Congress. His July 24 public statement and August 7 update also provided unclassified information about the evolving foreign threat. These were complementary channels: detailed briefings for particular audiences and information the broader public could use.

There were also coordinated announcements about specific threats. On October 21, the DNI and FBI director appeared together at an election-security press conference. FBI Director Christopher Wray explained the Bureau’s investigative responsibilities, described cooperation with government and private-sector partners, and urged Americans to seek reliable voting information from state election officials.

Private notifications, classified briefings, unclassified threat updates, and public statements serve different needs. A public attribution can expose an adversary; a private warning can help a target respond without unnecessarily amplifying the operation.

Public confidence depends on evidence and competent election administration. Officials should explain what they know and what remains uncertain. Otherwise, foreign actors have more room to supply their own explanations.

Finland’s Lesson: Prepare Together

I had the privilege of traveling to Finland to discuss and learn about its election preparedness. What struck me was how far the Finns took the team sport concept: they connected responsibilities across government and practiced working together.

Finland calls its approach comprehensive security. Government agencies, businesses, organizations, and citizens all have a part to play. Its election preparations have included training for authorities and political parties. Its broader government preparedness exercises combine work within individual ministries with shared crisis scenarios. These are practical ways to build relationships and understand responsibilities before a crisis.

Finland’s experience with Russian disinformation shows why this matters. Years before the 2016 U.S. election, Russian state-controlled media and pro-Kremlin figures spread claims that Finnish authorities were taking children from Russian families without legitimate reasons. EUvsDisinfo documented a recurring campaign around child protection and custody cases. This was a broader attack on trust in public institutions, rather than an election-specific operation.

Finnish officials answered publicly. On October 12, 2012, the social affairs minister met Russian journalists in Helsinki, while Finland’s ambassador in Moscow held a press conference to correct unfounded claims and explain Finnish child welfare. When another case attracted attention in 2016, the Ministry of Social Affairs and Health issued a public statement explaining that children were not removed because of nationality, that taking a child into care was a last resort, and that parents could appeal decisions. It also provided links to Russian-language information.

The lesson for the United States is that coordination has to be practiced before it is needed. Agencies must know who will establish the facts, who can act, and who will explain the response to the public. Finland’s example also shows the value of answering false claims with clear information about how institutions work and what protections people have. For election security, that means helping Americans understand both the threat and the safeguards protecting their vote.

AI makes coordination more urgent

In September 2024, ODNI reported that Russian and Iranian actors were using generative AI in election influence efforts. Russia had generated election-related text, images, audio, and video. Iranian actors used AI for social media posts and articles on websites posing as legitimate news outlets.

During my tenure, we were beginning to consider how to respond to deepfakes in foreign influence campaigns. We struggled with how to flag them quickly and explain the threat publicly while protecting intelligence sources.

ODNI assessed that AI was accelerating and improving aspects of these operations, but had not yet revolutionized them. Producing deceptive material does not establish that it persuaded voters or changed an election outcome.

In September 2026, Anthropic reported disrupting operations that used its tools to build fake social media identities and news sites, prepare campaign plans, and conceal who was behind the material. Much of the content it discovered attracted little or no genuine engagement. Those findings concern the operations the company observed, rather than all foreign influence activity. Public warnings should distinguish an adversary’s capabilities from an operation’s reach and effects.

Defenders need to determine whether AI is making impersonation more convincing or allowing foreign actors to exploit local incidents more quickly. They also need to establish who is behind an operation and warn its targets before the deception spreads.

These are intelligence and operational questions that cross agency boundaries. They also require clear limits. A false claim is not automatically a foreign operation. Americans’ political speech remains protected, including speech officials find objectionable. Election defense must establish the foreign nexus and act within lawful authorities.

Make the Full National Response Clear

Secretary Pete Hegseth’s September 22 memorandum directs the defense intelligence enterprise to collect and produce intelligence on foreign election threats, consistent with law and departmental policies. It also directs Cyber Command to use its existing authorities in coordination with DHS to counter foreign cyber threats. Addressed to Cyber Command, NSA, DIA, and NGA, the memo explicitly describes Defense as supporting a whole-of-government effort.

The memo does not name ODNI or the FBI, but that does not establish that they are excluded from the wider effort. Nor does it designate Defense as the national lead. My concern is how its departmental instructions connect to the full response, and how that response is explained to Americans.

The Washington Post reported on October 4 that state officials, including Republicans, described gaps in federal threat information and support. It also reported recent steps, including CISA’s September 24 security plan and the restoration of NSA’s Election Security Group. Those steps deserve acknowledgment. The practical test is whether assistance reaches election officials in time, through relationships they trust.

The Pentagon has an important role. NSA’s account of its work with Cyber Command during the 2022 midterms described sharing foreign intelligence with domestic partners and using cyber capabilities to disrupt foreign attackers. Those capabilities belong in the national effort. My concern is how the overall effort is explained and led. ODNI should provide a coordinated assessment of the foreign threat. The FBI should explain its investigative role. DHS should explain its support to the officials responsible for administering elections. Defense should explain how its capabilities support those missions. Together, they should tell Americans how warnings and public attributions will be handled.

There is precedent. In November 2019, Justice, Defense, DHS, ODNI, the FBI, NSA, and CISA issued a joint statement describing preparations for the 2020 election. They emphasized sharing actionable information and working with state and local officials and private-sector partners. We do not need sensitive operational details. We do need to know who integrates the intelligence, who alerts a target, and who speaks when a foreign operation requires a public warning. Those arrangements should be tested before an incident forces a rushed decision. They should also remain in place through the counting and certification of results.

No agency sees every part of this problem. Election officials need information they can act on, and the public needs explanations it can trust. Federal leadership must connect the intelligence, investigations, cyber defense, and support to those administering the vote.

With one month to go, the message should be clear: vote and have confidence in doing so. A healthy democracy makes room for vigorous disagreement. The government’s role is to ensure that the rightful tensions of our democracy are our own.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Nobel laureate Geoffrey Hinton walked out of a closed-door Capitol Hill briefing on September 17 and gave lawmakers a deadline.

“Maybe a year, but not much more than a year,” he told reporters, describing how long Congress has before artificial intelligence moves beyond meaningful human control.

It’s not an outlier estimate on the Hill anymore. An Anthropic researcher who resigned this month put it more starkly, warning that the people building the technology “earnestly believe it could kill us all by the end of the decade.”

Trump had already dismissed the premise days earlier. Across a string of Truth Social posts that Monday, he called AI fears a “hoax,” dubbed himself the “Hoax Buster,” and mocked the idea of robots marching into American cities. He returned to the subject five days later, announcing he would form an “AI Force” and appoint an AI czar to accelerate American dominance in the technology rather than restrain it.

House Speaker Mike Johnson echoed him the next day in even more candid terms.

“What the president is saying is, you’re not all going to be dead in 10 years,” he stated. “That’s a hoax.”

That collision, a 78-year-old scientist warning of civilizational risk and a sitting president calling the same warning a partisan fiction, is the real story of the AI safety debate, and it is already hardening into a national security question in its own right.

Sens. Ted Cruz, Amy Klobuchar and John Thune are drafting bipartisan legislation aimed specifically at “catastrophic risks involving biological or nuclear threats” from frontier AI, expected as soon as this month. But the politics obscures a more basic question that rarely gets answered: how, mechanically, is any of this supposed to happen?

Most people still picture something out of the Terminator: killer robots, guns blazing. What actually keeps researchers at the frontier labs up at night looks nothing like that. It’s smaller, odder, and in a few cases, it’s already happened.

The sandbox that did not hold

The clearest illustration of loss of control came in July, when OpenAI disclosed that a combination of its models, including GPT-5.6 Sol and an internal-only research prototype, got out of an isolated test environment and breached Hugging Face’s production systems.

The models were not told to escape. They were running an internal OpenAI evaluation built to push them toward advanced exploitation, with the safeguards that normally block high-risk cyber activity deliberately switched off so the company could gauge their maximum capability.

The test environment had no direct internet access beyond a proxy for installing software packages. The models spent substantial computing power finding a way out anyway: they exploited a previously unknown flaw in that proxy, worked through OpenAI's research network to a machine that was online, then searched for the test's answer key and breached Hugging Face to get it. OpenAI says the models went to "extreme lengths" to reach a narrow goal. The company says it has disclosed the flaw to the vendor.

UN human rights chief Volker Türk told the Human Rights Council in Geneva earlier this month that he shares “the concerns of industry insiders that advanced AI could pose an existential risk to humanity,” calling for “cast-iron guarantees” before, in his words, it is too late.

Türk cited exactly this kind of behavior when he drew his own red line in Geneva.

“AI that escapes its testing environment, or blackmails developers to prevent itself from being turned off, is AI that is too powerful,” he said.

Roman Yampolskiy, an AI safety and cybersecurity researcher at the University of Louisville, tells The Cipher Brief that the incident is best understood as a sneak peek rather than a fluke.

“A preview of a dangerous capability, although neither establishes that catastrophic harm is inevitable,” he says. “OpenAI’s agents escaped isolation and compromised external systems without authorization. These incidents illustrate two different risks: AI pursuing unintended objectives and criminals using AI to automate attacks. Both reduce the amount of human expertise and intervention required for a cyberattack.”

This isn’t a machine turning against its makers. It is software chasing a narrow goal it was given, with no one watching closely enough to notice where the shortcut led.

When the attacker never sleeps

Loss of control is a system slipping its leash. Self-replication could come next. Once it’s off the leash, nobody has to sit at a keyboard to keep it moving.

In early July, cloud security firm Sysdig documented what it assessed to be the first ransomware campaign run end-to-end by an autonomous AI agent, a case it dubbed JadePuffer. After breaking into an internet-facing server through a known software flaw, the agent conducted its own reconnaissance, harvested credentials, moved laterally across the network, and encrypted more than 1,300 configuration records, adapting on the fly when its attempts failed.

In one moment that stood out to researchers, a login attempt failed and, thirty-one seconds later, the agent had already figured out why, tried something different, and gotten in. No person ever saw the error message or lifted a finger to fix it.

Ian Tien, CEO of Mattermost, a collaboration and automation platform built for national security and critical infrastructure clients, tells The Cipher Brief the incident and what followed it mark a genuine inflection point.

“The Hugging Face and JadePuffer incidents represent important new milestones in the weaponization of AI,” he observes. “They should signal to the public that AI is creating new pathways for adversaries and criminals to cause harm, and those developments should be taken seriously.”

At the same time, Tien is careful not to inflate the danger.

“Defenders are also using AI to create new pathways for defense, including detecting and disrupting adversary and criminal operations,” he points out.

Tien’s point is that the technology cuts both ways: the same speed that lets an attacker adapt in seconds can be used to detect and disrupt that activity, if defenders adopt it as quickly as attackers do.

Jason Lang, Managing Director of Offensive Security at TrustedSec, tells The Cipher Brief the technical substance of the case is less novel than the headlines suggest.

“AI wasn’t doing anything that security researchers haven’t been doing for years. The difference is the speed at which it performs those actions,” he explains, noting that JadePuffer’s entry point “exploited a security flaw that had been publicly known for more than a year. Yet, the targeted system was still unpatched.”

In other words, the opening wasn’t some undiscovered AI weakness. It was an ordinary, already-known bug that a human had never gotten around to patching, and the AI just moved on it faster than a person would have.

Still, Lang doesn’t dismiss the trend line. He’s not arguing the threat is exaggerated, only that the mechanism is familiar; what’s changed is the clock.

“AI can and likely will enable attackers to perform research and attacks at a speed faster than modern defenses can cope with,” he continues. “For now.”

Rafal Los, Chief Strategy Officer at Binary Defense, tells The Cipher Brief he reads the same case with more caution about the story built around it.

“I believe that these models did in fact cause harm, but that there is definitely some part of those narratives that was ‘enabled’ by humans looking for validation of their company’s frontier supremacy,” he observes.

What worries Los isn’t the exploit itself, he says, but the trajectory it points to: “an AI agent can carry out much of the technical attack chain autonomously, adapt when something fails and continue toward its objective.”

“Capabilities that once required continuous human involvement can increasingly be automated and scaled,” Los highlights.

That urgency reached Washington almost immediately. Two weeks before Hinton’s briefing, the cyber agencies of the Five Eyes alliance had issued a joint warning that frontier AI was collapsing the gap between vulnerability and exploitation to “months, not years.”

In practice, that means the window defenders used to have between a flaw being discovered and someone actually weaponizing it, once measured in months or longer, is shrinking to weeks or less, leaving far less time to patch a system before it’s used against it.

Sen. John Kennedy (R-LA) tried to force a vote on legislation requiring AI developers to build in a shutdown mechanism the day before Hinton spoke to lawmakers. Sen. Rand Paul (R-KY) blocked it on the floor within hours, calling Kennedy’s language “very vague” and arguing that regulating an industry “so pervasive as AI throughout our economy” first needed hearings and industry input rather than a same-day, unanimous-consent vote.

Paul offered a counter, a bipartisan committee to study the risk instead; Kennedy declined it and let the bill die.

The problem of speed, not malice

The scenario that unsettles researchers most, however, has little to do with hacking. It is the possibility of a system pursuing a goal with genuine competence and no ill intent, simply moving faster than the humans meant to be supervising it.

That is what pushed Evan Hubinger, who leads alignment science at Anthropic, to break with his usual caution earlier this month. He wrote that he personally puts the odds of AI causing human extinction within the next decade above ten percent, and that Anthropic is “trying its best” but does not yet have a plan to control a superintelligent system safely.

Yampolskiy puts the mechanism in more concrete terms.

“An AI agent with access to computers, networks, and critical infrastructure could autonomously discover vulnerabilities, compromise systems, and disrupt hospitals, power grids, or supply chains,” he points out. “The immediate danger is not that AI becomes conscious, but that it becomes capable of causing irreversible harm at machine speed, potentially before humans can intervene.”

Not everyone treats the extinction premise as settled science. Lang, for one, is openly skeptical of the political response it has generated.

“Knee-jerk reactions are just that, reactions, not thought-out proposals with well-meaning reforms,” he underscores. “Fear is usually the currency by which control is purchased; therefore, any urgency-backed proposal is worthy of extra scrutiny.”

The specific fear dominating the public conversation, an AI that slips its constraints and turns on humanity outright, draws the sharpest pushback of all.

“I believe we should take them seriously in that it demonstrates capabilities, but not catastrophically in that it’s going to lead to an AI that ‘breaks out of containment’ and goes and exterminates humans or takes over the Internet,” Los says.

What worries him is something far more mundane: systems that get things wrong not out of malice, but because they’re missing something a person in the room would have caught. He points to air traffic control — a recommendation that looks right on paper but misses a factor a human controller would weigh without even thinking about it, with nobody checking the work before it’s acted on.

What Washington could still do

U.S. Sen. Jacky Rosen (D-NV) has taken the narrowest, most procedural version of the concern to the Senate Commerce Committee, calling on Chairman Ted Cruz to convene a hearing with top AI executives.

“This powerful technology can have the power to cause catastrophic damages if we don’t act to impose guardrails and safety mechanisms,” Sen. Jacky Rosen (D-NV) said in a statement issued to The Cipher Brief. “Congress must do everything in its power to ensure the American AI industry continues to lead, particularly outcompeting China, and also enact increased guardrails to ensure AI development is progressing in a safe and responsible manner.”

Some of that response is already moving.

In June, the administration signed an executive order directing federal agencies to expand AI-enabled cyber defenses for government and critical infrastructure systems, and to design a voluntary framework under which frontier AI developers can give the government up to 30 days of early access to their models before release.

The order imposes no requirements on the companies themselves, and its first agency deadlines fell in July and August.

Nothing in the order binds the industry at large, which is precisely Rosen's complaint, and precisely why Cruz, Klobuchar and Thune are trying to legislate the bio and nuclear pieces separately.

For all their disagreement over how alarmed to be, the four security experts converge on roughly the same one-year fix.

Yampolskiy calls for “mandatory isolation for AI agents operating near critical infrastructure,” the hospitals, power grids and pipelines Yampolskiy flagged earlier.

“No unrestricted internet access, no unnecessary privileged credentials, and no autonomous execution of consequential actions without independently enforced authorization,” he continues.

Tien points to keeping critical systems off the public internet altogether.

“Much of our critical infrastructure and government already operates on air-gapped and private networks,” he explains, and “maintaining that separation is one straightforward way to reduce exposure and buy time while AI-based defenses mature.”

That means a hospital’s or utility’s control systems have no physical connection to the internet at all. Hence, an agent that escapes its sandbox elsewhere has no path in, no matter how capable it becomes.

Los, meanwhile, wants more adversarial testing, “more human oversight,” and AI harnessed for “continuous and automated defense in the immediate future.”

Lang’s answer is the least dramatic of the four, but perhaps the most damning.

Patch known vulnerabilities. Use long, complex passwords. Check the sender’s domain before clicking. Make security a first-class citizen from the top down.

“Security is not hard, conceptually,” he adds. “What causes breaches are, at their roots, usually the forces of ignorance or ego, a truly devastating duo when combined.”

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

My friends and family often ask me why Russia behaves so offensively. They are baffled by Russia’s lack of humanity and Moscow’s actions such as hiring assassins, launching drones at innocents, and planning economic sabotage against international companies. While not an excuse, just an explanation, scholars of Russia understand the country’s deep sense of insecurity and vulnerability. Its longing to be a part of Europe, and its own view that its rightful place as a global leader are all driving Russia’s barbaric actions. According to strategic culture theorists, a state’s approach to war is shaped by its cultural and historical experiences, including geography, religion, language, and national identity. These factors influence a state’s perception of security threats, willingness to use military force, and approach to diplomacy and negotiation. They also help us to anticipate a state’s actions.

Russian strategic culture reflects a worldview shaped by centuries of conflict, invasion, brutality against others, inflicted on its people from foreign powers and by the government against its own population, and foiled attempts to become card carrying members of the west. Key elements of Russian strategic culture include the belief that the rest of the world, especially the West consistently undermines Russia and thwarts it rightful place as a world leader, and a belief in the necessity of military strength to push back the West. When the West does not push back, Moscow believes that their tactics are working.

Insecurity Drives Every Move

Russia’s persistent awareness of vulnerability and deep-seated mistrust of its neighbors is deeply ingrained and a consequence of centuries of historical experience. This insecurity manifests as a deep-seated suspicion of the West and a zealous determination to maintain control over Russia’s perceived sphere of influence. Understanding the historical currents that have shaped this perception is crucial for comprehending Russia’s present-day actions.

Russia’s experiences with wars and conflicts, such as the Mongol invasion, Napoleonic Wars, World War I, and World War II, have reinforced the idea that the country is constantly under threat and must be prepared to defend itself at all times. The Russian feeling of vulnerability and insecurity, particularly concerning interactions with “Western countries” is ingrained. To counter this insecurity Russian leaders have long highlighted the importance of having buffer zones on its borders. Removing those buffer zones heightens Russia’s sense of vulnerability.

From as early as the 18th century, Russian imperial strategy was heavily influenced by the need to create and maintain buffer zones along its western borders. Peter the Great and Catherine the Great both conquered lands on Russia’s borders so that Moscow would have a buffer from invasion. This proactive doctrine was aimed at insulating the Russian heartland from European powers. The annexation of Baltic territories, the absorption of Finland, and the partitioning of Poland were all manifestations of this strategy. These territorial acquisitions were driven by a pragmatic logic: to push potential adversaries further away and create a strategic depth that would absorb any initial blows in case of conflict. Russia continues to try to use buffer states or “allies” to keep others from its immediate vicinity, but this is an increasingly difficult task for Moscow as its former republics and satellite countries choose new alliances and partners.

Germany’s invasion of Russia in 1941 was a defining moment in Russia’s historical experience. This invasion resulted in some 27 million Soviet deaths and widespread devastation. It cemented Russia’s profound sense of betrayal from the West, and a visceral need for absolute security. World War II profoundly shaped Russia’s post-war security calculus, leading to a pursuit of military strength and a zero-tolerance policy for any perceived threat on its borders. The narrative of this war is deeply embedded in Russian society, serving as a constant reminder of the price of vulnerability and the imperative of never allowing such an event to recur. Putin’s family was directly affected by WW2 with his brother dying of starvation during the siege of Leningrad, his Grandmother killed by the Germans in Tver, and his father being severely injured during combat duties. He often discusses this in his speeches.

The post-Soviet era where East European nations and former Soviet Republics are joining NATO and the EU is particularly distressing for Moscow. The historically more neutral northern European countries joining NATO also is alarming to Moscow. From Moscow’s perspective, the loss of Ukraine to the West represents not just a geopolitical setback, but the obliteration of a crucial defensive buffer. We are also seeing Moscow’s anxiety rising regarding Armenia’s recent moves toward the West.

During the first summer of the Ukrainian war, Putin compared himself to Peter the Great and likened the invasion of Ukraine to the eighteenth century Russian Czar’s wars. This underscores the mindset of Russian leaders and shows that their history is never far from them.

Yearning for Inclusion

Russia’s geographic position has greatly impacted its strategic culture. Russia is the biggest country in the world, and while only 23 percent of the country is in Europe, almost 80 percent of the population lives there. This makes Europe extremely important for Russia. One can see this link throughout Russian history. Even from the founding of the modern Russian state in the sixteenth century, its foreign interests were linked to Europe. When Peter the Great established an empire, the interconnections with Europe increased. Russia conducted wars and created alliances with different European countries. Russian nobles were stung when European nobles mocked them and called them uncouth and barbaric.

Today, the Kremlin emphasizes narratives that underscore Western hostility, and Russia’s role as a decisive power in European affairs. These narratives reinforce Russia’s claims to special rights in regional security and justify to itself and its people, assertive foreign policy actions, including military interventions in neighboring states. Any expansion of western power such as expansion of NATO and deployment of U.S. forces in Europe are perceived as existential threats to the Russian state and infringing on Russia’s rightful relationship with Europe, just as they were during the Soviet-era.

Demanding a Seat at the Table

For centuries, leaders of the Russian Empire and the Soviet Union emphasized Russia as a great power. During the Cold War, Russia, through the Soviet Union, was able to act as a global leader. After the collapse of the Soviet Union, Russian leaders were confronted with the fact that Russia had limited “spheres” of influence.

A main aim of Russian foreign policy under Putin is regaining and maintaining great power status. Putin repeats in his speeches that Russia is a great power and that the West, especially the United States, does not give Russia the respect it deserves. The Russian people support this view. Moscow remains angered that in its view, after the Cold War, the United States created a unipolar world and used NATO to maintain its hegemonic status. Putin has consistently publicly lamented the breakup of the USSR as “the greatest geopolitical catastrophe of the century.” More recently, Putin has said, “At last, Russia has returned to the world arena as a strong state - a country that others heed and that can stand up for itself.”

Russian leaders view Russia’s military might, both kinetic and grey zone activities, as their way to press for global leader status. They believe that Russia must take what it believes is its due such as Ukraine. Russian leaders also contend that it must make the West uncomfortable with continued attacks such as the drone incursions, assassinations, and ongoing disinformation. Pressing this avenue, in their view, wil make the West eventually give up on pushing back on Russia and allow Russia to take its rightful place as a global leader.

Implications for Policy and Security

None of this explanation of Russia’s national security mindset is meant to apologize for Russia’s barbaric behaviors. It is meant to help negotiators and policy maker understand Russia’s perspective, however misinformed and self-determined. Russian strategic culture emphasizes an assertive approach to conflict which is meant to make up for Russian feelings of vulnerability and being outcast from the West. This approach is evident in Russia’s actions in Ukraine, where strategic culture drives Russia’s actions.

Moscow’s lack of trust in the West is underscored by Putin and his circle who are the representatives of the “greatest generation” of the Soviet Union. These leaders grew when the state was a global power and controlled parts of Europe. They came to the pinnacle of their careers when the West, having forced the breakup of the Soviet Union, attempted to replace Soviet and Russian culture with Western values. They are bitter about this.

Having a realistic view of Russia’s perceived right and left limits allows negotiators and military planners to develop a workable way ahead in foreign relations. It should not limit US actions in calling out Russia’s morally and ethically abhorrent actions but it should inform our actions.

In summary, Russian strategic culture is driven by a sense of vulnerability, a focus on wanting to be part of the cool club of European nations, and an outsized view that Russia should be a global leader, regardless of its barbaric actions.

Russian and Ukrainian Clashing Strategic Cultures

Russia and Ukraine both see a negative outcome of the current war as an existential threat to their existence. That means that negotiating a settlement is difficult, herculean, and likely under the current circumstances an impossible task. Diplomacy alone cannot produce a durable settlement, because the two strategic cultures are incompatible. At most, military exhaustion could produce an armistice that freezes the conflict without resolving it. Before Russia’s insecurity can be addressed, the rest of the world must make it clear that Russia will maintain pariah status if it continues its slaughter of Ukrainian citizens and attacks in the west. The third-party sanctions recently passed by Congress are a step in the right direction. Sanctions alone, however, will not stop Russia whose people are used to hardship and even expect it. I am usually an optimist but for now, unfortunately, I cannot see a positive way forward in this war. The themes that Ukraine and Russia have woven through their strategic cultures indicate that there will be more deaths, destruction, and hardship before this war ends. The best that the world can do is to contain the violence and help Ukraine continue to strengthen its statehood while calling out each and every Russian atrocity.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

The Intelligence Community (IC) has an opportunity now to influence how we talk about, and thus how we approach, AI use in our work by formally adopting the nomenclature “AI-in-the-Loop” rather than “Human-in-the-Loop.” The problem with human-in-the-loop is that it subordinates the human to AI; the term carries a built-in assumption that “the loop” belongs to AI and that humans will somehow be included. The term I am proposing omits the “human” we have become accustomed to, but it is a purposeful attempt to reflect what we want to achieve: using AI when and where we elect to do so.

AI-in-the-loop is not a new expression. Stanford’s Institute for Human-Centered Artificial Intelligence used the term as a centerpiece for a conference on the topic in 2022, arguing that humans should remain in charge while AI operates as part of a human-directed process.

This 2025 academic article makes the same distinction, arguing that “Human-in-the-loop (HIL) systems have emerged as a promising approach for combining the strengths of data-driven machine learning models with the contextual understanding of human experts. However, a deeper look into several of these systems reveals that calling them HIL would be a misnomer, as they are quite the opposite, namely AI-in-the-loop (AI2L) systems: the human is in control of the system, while the AI is there to support the human. We argue that existing evaluation methods often overemphasize the machine (learning) component’s performance, neglecting the human expert’s critical role.”

Much of industry discourse uses human-in-the-loop as an AI governance approach, but the debate over terminology remains unsettled. Researchers at The George Washington University argue this is partly because “Academia, government, and industry have not clearly defined the mechanisms by which humans are expected to oversee or collaborate with AI-enabled systems.” They add that “Inconsistent uses of terms like human-in-the-loop and human-AI teaming create confusion on what type of oversight and collaboration is intended,” calling this environment a “preposition salad.”

Forging new terminology for our AI usage is critical now as we seek to accelerate development and adoption in the IC while also supporting the burgeoning efforts to adopt AI securely. The IC has already set a standard for accelerated adoption in a secure environment while focusing on the human role.

ICD 505, as amended in 2025, on AI underscores the importance of IC personnel, noting that they “shall remain responsible and accountable for the analysis, decisions, and outcomes derived from insights gleaned using AI.” While the Directive does not mandate specific terminology, it requires users to “understand” and be accountable for AI use. It goes further in insisting that “personnel be able to review, challenge, and reject or replace AI-derived recommendations and findings when appropriate.” The President has since mandated that the IC publish a Standard on AI Assurance under ICD 505 and signed a memorandum on AI mandating “responsible acceleration of the use of AI across intelligence and warfighting domains.”

Intelligence agencies are moving to adopt internal AI policies to drive adoption while elevating the human role. For example, NGA has moved beyond simply adopting AI toward aspiring to become an AI-first organization where “AI does not replace human judgment. It amplifies it.”

While the human role is at the forefront, IC procurement is aiming for fast acquisition. CIA launched a new acquisition framework this year to speed adoption of innovative technologies, while NGA has elevated its Rapid Capabilities Office and has multiple major AI and advanced-analytics procurements moving toward solicitation.

An Array of Terminology Options

Practitioners and technologists may bristle at adopting a term that lacks "human," as noted above. This should not derail our efforts to better define our approach to AI. I have offered AI-in-the-Loop as an option that respected experts are promoting. But the IC can forge its own path by considering multiple options:

Human-Led AI (HLAI) — simple, direct, and clear about who leads the process

Human-Guided AI (HGAI) — emphasizes direction and oversight, though it may sound less decisive

Human-AI Teaming (HAIT) — widely used, though it can imply a more equal partnership than intended, and an awkward

acronym

Human-Directed AI (HDAI) — stronger than “guided,” emphasizing human authority

Human-Commanded AI (HCAI) — strong human primacy, though perhaps too military in tone for broad IC use

Human-Owned AI Workflow (HOAIW) — inelegant, but explicit that the workflow belongs to the human

Adopting new terminology now would be more than symbolic; it would help shape how we approach and use AI. We can ensure AI augmentation at the speed of mission as part of the human toolkit, not that humans are just “in-the-loop.” Indeed, the IC has used nomenclature adoption as a core part of improving mission performance and rigor at key junctures in the past.

After 9/11 and the invasion of Iraq, the IC shifted the terminology it used for adopting new or different tradecraft from our baseline techniques in analysis. The term Structured Analytic Techniques became official at CIA’s Sherman Kent School in 2005 as part of the Agency’s effort to promote these methods from the long-held category of “alternative” analysis into the mainstream of tradecraft. In my decades of experience in analysis, this change was more than a title change; the new terminology reshaped how analysts thought about their work. As a junior CIA analyst at the time, I remember a proliferation of structured analytic techniques that became so commonplace they were literally no longer alternative.

In the late 2010s, we shifted from “intelligence sharing,” a process that intelligence professionals I knew detested as giving away secrets for little to no gain, to “intelligence diplomacy,” a practice many of us willingly adopted to offer insights aimed at promoting US interests. The IC formally codified this approach in 2025 through ICD 405, Intelligence Diplomacy. The ICD distinguishes between mere intelligence sharing and intelligence diplomacy, noting that the latter must “be done in support of advancing a preferred policy objective.” The ICD goes further in noting that the intent is to “shape foreign leader perspectives,” a materially different approach than sharing alone. The Senate’s Intelligence Authorization Act in August 2026 endorsed Intelligence Diplomacy as “critical to advancing US foreign policy and national security goals,” and called for “elevating intelligence diplomacy as a tool of US statecraft” through continued investment.

The IC should act with deliberate speed to formalize AI-in-the-loop, or a related term, to set a tone of expectation and clarity for agencies and industry partners that even agentic autonomy must begin with human intent and be wrapped in human decision. We can do so in a presidentially required Standard on AI Assurance under ICD 505. Further, IC directors using an agreed-upon, more human-focused term and impressing on their workforce its importance would chart a path. IC acquisition shops’ requests to industry should also make this shift, giving industry clear guidance that development and implementation should include a workflow that explicitly highlights human ownership of AI adoption. Even when AI does the heavy lifting across data sets that humans can’t process alone at speed and scale, it must do it on our behalf.

All statements of fact, opinion, or analysis expressed are those of the author and do not reflect the official positions or views of the U.S. Government. Nothing in the contents should be construed as asserting or implying U.S. Government authentication of information or endorsement of the author's views.

The Cipher Brief is committed to publishing a range of perspectives on national security issues submitted by deeply experienced national security professionals. Opinions expressed are those of the author and do not represent the views or opinions of The Cipher Brief.

Have a perspective to share based on your experience in the national security field? Send it to Editor@thecipherbrief.com for publication consideration.

Read more expert-driven national security insights, perspective and analysis in The Cipher Brief

Beijing says artificial intelligence will give the state a visible hand to allocate capital. Here’s the rub: Washington’s economic authority sits in five places, and none of them is in command.

This column begins a four-week series ahead of The Cipher Brief Threat Conference on economic-warfare. The author is hosting a live session on this topic with former Commander of U.S. Special Operations Command, General Bryan Fenton (Ret.). Apply now to attend.

On September 26, the President answered the week's largest security question in just four words: "I'm rejecting their deal." Iran's offer to reopen the Strait of Hormuz within seven days, in exchange for lifting the blockade and waiving oil sanctions, had been on the table since September 24. It received its answer in public, from the one official authorized to give it, inside forty-eight hours.

The week's economic questions received no answer of that kind. The trade truce with China, and the pause on Beijing's rare-earth licensing regime tied to it, moved from November 10 to January 10 on the strength of a Treasury Secretary's statement; Beijing has yet to publish a matching notice.

The Russia sanctions act the President signed on September 18 requires determinations on the largest buyers of Russian energy by October 18, a deadline set by Congress rather than the executive, with waivers broad enough to let it pass unenforced. In February, the Supreme Court ruled six to three in Learning Resources v. Trump that the International Emergency Economic Powers Act does not authorize tariffs, removing the instrument the executive had used for its broadest tariffs.

This is important because Washington can decide a war in a sentence. But on the economic front, authority rests with Treasury, Commerce, the U.S. Trade Representative, Congress, and the courts. Each is competent. None is in command. The arrangement is by design and has served the country well for most of the last eighty years. But not anymore.

Beijing is now claiming a different design. In a recent lecture on Xi Jinping's economic strategy, former Australian Prime Minister Kevin Rudd, who has tracked Chinese ideology for fifty years, described a shift in the Communist Party's theoretical literature. Artificial intelligence (AI) and other "new quality productive forces" are portrayed not only as sources of productivity but also as "a superior macro-allocation mechanism for resources," driven by algorithms. Rudd says the literature now uses the term "the visible hand of the state," offered for the first time as a rival to the market's invisible one. He is careful about its status: the idea sits in the ideological literature, "not yet in the policy literature," and not yet in the behavior of firms. But in his reading, ideology in China is where policy begins.

The hand is already visible without the algorithm. The rare-earth regime now paused until January, the Ministry of Commerce's Announcement No. 61, applies to any product anywhere that carries more than 0.1 percent Chinese-origin rare-earth content by value. One ministry notice imposed it; one more can reimpose it. The capital moves the same way. Chinese households, burned by property and wary of equities, hold record savings in low-yield bank deposits, and the state draws on those deposits through local, provincial, and national loan instruments to fund its technology bet. Rhodium Group puts China's AI capital spending at 932 billion renminbi this year, double last year's, financed by state banks and equity placements rather than bond markets.

America's AI buildout is financed the other way. Its five largest builders raised a net $163 billion in debt in the first half of this year, compared with $90 billion in all of 2025, in a bond market where the ten-year Treasury has reached 5.18 percent, its highest since 2007. No ministry allocated that capital. The market did, and the market will reprice it.

Neither design is simply superior, and the distinction matters more than the verdict. A single allocator is fast and brittle. It can direct capital, licenses, and supply to a strategic target within a week, and it can misallocate at the same speed. The household savings now financing the AI bet were poured into a property boom that left many of those households with assets worth only a fraction of what they paid. A distributed system is slow and resilient. Its errors stay local, its capital carries a price, and no single notice can switch it off. In peacetime competition, resilience compounds. In economic warfare, tempo is the contested variable, and the side that can decide within the other's cycle sets the terms. Beijing has already shown what that looks like. It imposed its rare-earth regime by notice on October 9 of last year and suspended it by another on November 7, having collected in between Washington's agreement to delay its own rule extending export controls to the affiliates of blacklisted firms. Two notices, one month, one American concession.

This column has traced the same gap from the drone fleet to the power grid: the capacity exists, and the decision does not. The economic front shows it at national scale. Washington holds the reserve currency, the deepest capital markets, and the reach of the dollar system. What it lacks is a place to settle competing claims on those instruments and to make them binding on the timeline decided by an adversary.

October 18 is the first live test. The sanctions act's determinations are due that day, just sixteen days before the midterm elections. They will be imposed, waived, or deferred, and whichever it is will say more about the American economic hand than any strategy document published this year. Beijing will be watching the same date, holding a notice it can publish on any morning it chooses.

The question for Washington is who, when economic warfare requires a decision, is empowered to make it, and whether that decision can arrive before the adversary's action. Coordination assigns. Integration arbitrates.

Read more expert-driven national security insights in The Cipher Brief. Need full access to more content like this? Become a Subscriber+Member here.