Where Institutions, Industry and Air Defence Stand as AI Enters Both Sides of the Loop

Familiar methods, with AI changing speed and scale

The review judges that AI is unlikely to change hostile actors' goals but highly likely to increase the speed, scale and efficiency of their operations. The incident-management team has begun to see attackers incorporating AI tools, yet none of the observed uses enabled a novel class of attack; each accelerated an existing method. The 2028 assessment therefore rests on familiar means, ransomware, social engineering and vulnerability exploitation, being amplified by AI.

Most successful compromises relied on known vulnerabilities in internet-facing systems, stolen credentials and social engineering. Several incidents were linked to state or state-aligned actors; some exploited unknown vulnerabilities, but many used flaws that had been patched but not deployed. Horne said in his speech that, because long-tolerated vulnerabilities can now be discovered and exploited with AI, the UK faces 'a real prospect of an unprecedented rise in the number of cyber incidents' in the coming months.

337 incidents and the placing of China and Russia

The incident-management team received 1,831 reports of attacks over the period, supported 337 incidents after triage and classed 80 as nationally significant. It notified about 8,500 organisations of suspected compromise through the Early Warning service. The review gives no year-on-year comparison, explaining that incident reporting does not follow a simple annual trend and that earlier peaks were tied to a small number of especially significant incidents. Media reports cited government research putting the economic cost of cyber attacks at about £14.7 billion a year.

Horne said China highly likely has the intent, and is best positioned, to use AI for operations against critical national infrastructure, calling its activity 'the most sophisticated and sustained cyber challenge the UK faces'. He cited Russian campaigns that intentionally fall below the threshold of armed conflict, and said Iran continues malicious operations globally, including against the UK and individuals it regards as threats to the regime. North Korea does not appear in the speech.

Cyber Shield and the Manchester AI centre

The launch consolidated investments set out in the Chancellor's budget the week before: £60 million for the first phase of a national Cyber Shield, £70 million for a National Exposure and Real-Time Vulnerability (NERV) Centre, and an NCSC-run AI Cyber Security Centre of Excellence in Manchester. On the statutory side, the Cyber Security and Resilience Bill would set minimum resilience levels for critical infrastructure, with a National Cyber Action Plan to follow. Horne called for replacing end-of-life technology, isolating physical control systems from attackers and making passkeys the norm, and framed Cyber Essentials as the starting point rather than the end goal.

Counter-drone systems make up over 90% of the count

Of the 25,000 total, the offensive share is limited to more than 1,300 one-way attack aircraft and more than 100 unmanned vessels; the remaining 24,000-plus are counter-drone systems delivered through Joint Interagency Task Force 401. The release describes them as 'high-volume alternatives to legacy, multi-million-dollar exquisite munitions', and Owen West, who leads Project Agincourt and DRPM-UxS, said the organisation 'was established to cut through red tape'. No unit prices, spending breakdown or combat results are given; deliveries will continue to CENTCOM and expand to other combatant commands.

The concentration on CENTCOM tracks the course of the Iran war covered in earlier editions. AP's satellite analysis reported Iranian strikes damaging 26 US sites and cheap drones in volume unsettling the assumptions behind fixed bases, and the counter-drone-heavy mix reads as a response. At the same time, the acting head of the Defense Innovation Unit has said mass production of cheap drones is 'basically from zero', with only three of eleven firms delivering their full share of the first 30,000-unit buy, so the 1,300-plus offensive figure reflects the industrial base as it stands.

From Project Agincourt to an Autonomous Warfare Command

In September, Secretary Hegseth signed a memo directing Project Agincourt to prepare the pathway to an Autonomous Warfare Command, and an Army article on 15 October quoted him saying the command 'has always been the end state'. The concept is a four-star functional combatant command, with establishment targeted for 1 October 2027. This release, by putting numbers behind a portfolio manager set up outside the regular acquisition lanes, builds the case for the new organisation on delivered volume.

Institutionally, the stage is a directive memo and a published delivery record; standing up a combatant command would require congressional funding and a revision of the Unified Command Plan. With Congress returning on 9 November and FY2027 NDAA negotiations resuming, the command's status and budget will be in play during the session. Alongside the lawsuit seeking to halt the Secretary's 'future of warfare' panel (previous edition), outside scrutiny of the new Secretary-level bodies is rising.

Reserve capacity and GOCO-run production

Koizumi said that 'with Russia's invasion of Ukraine now in its fifth year and equipment and munitions consumed in volume, the importance of securing sustained response capability has become clear', adding that 'production and technological capacity now bear directly on response and deterrence, and countries are hurrying to prepare'. He said Japan must 'transform into a state that holds reserve production capacity with contingencies in view', and set out financial support to secure surge capacity and the use of GOCO arrangements under which private firms operate government-owned facilities.

The idea of reserve capacity changes the premise of a defence industry sized to peacetime orders. GOCO is the model used at US ammunition plants, where the state carries the capital cost and a company runs the plant. Japan's 2023 defence production base law allows the state to acquire manufacturing facilities, but the operating model has yet to be institutionalised. The year-end strategy will therefore be judged on whether it names which equipment and munitions are covered and how much reserve capacity the state will fund.

Export-oriented development and a reset of equipment policy

Koizumi said the ministry will 'fundamentally change the thinking and the promotion structure of equipment policy' and called for a shift to development premised on exports. As covered in earlier editions, the government intends to make the 'virtuous cycle of defence and the economy' a pillar of the revised three documents and to specify a new defence-industry body, which the Sankei reported would be an incorporated administrative agency co-founded with METI with an initial staff of about 300. The statement to industry bundles these into a single strategy and gives companies a basis for investment decisions.

With AI and unmanned systems at the centre of 'new ways of fighting', the industrial base in question includes domestic production of expendable drones. ATLA has asked firms with domestic production capacity for UAV warhead fuzes to provide information (letters of intent due 13 November), and Koizumi said in a speech on 3 November that the ministry's basic policy on AI use would be reviewed. With the industrial strategy and the AI policy review converging at year-end, aligning the production base with operating policy becomes the institutional task. The list of participating companies and the full text of the minister's remarks have not been published.

Six outright bans and twelve power caps

By 404 Media's tally, six cities voted to ban data centres outright and twelve set limits on the power such facilities may draw. Emporia, Kansas, passed a ban on 'high-impact' data centres, and the mayor of Yukon, Oklahoma, lost a recall after backing a hyperscale project. TIME reports the mayor of Piqua, Ohio, was likewise recalled, and bans or moratoriums passed in Edgewater, Florida, and Bloomington, Illinois. In Asheville, North Carolina, and San Marcos, Texas, candidates who campaigned against data centres were elected mayor.

At state and federal level, Democrats spent more than $100 million on broadcast ads tying Republican candidates to Big Tech and data centres, and won in Ohio, Kansas and Iowa among others. A candidate backed by a data-centre super PAC lost, and a Kansas gubernatorial candidate who took $1.5 million from such a PAC was trailing. Blue Rose Research ranked AI 29th of 39 issues in importance but found its salience had risen more than any other issue over the past year.

Super PAC money and the AI-safety camp's results

According to TIME, the cycle's largest donor was Elon Musk at $446 million, of which about $168 million effectively went to Ken Paxton's Texas Senate bid; Paxton lost. The pro-AI super PAC Leading the Future spent more than $100 million but faced a backlash, with a cited survey finding three-quarters of likely voters less inclined to back a candidate who took AI super PAC money. Anthropic contributed more than $40 million to Public First Action, a group restricted from electoral activity, and its employees gave a further $5 million.

Candidates backed by AI-safety PACs won in Michigan, Colorado and Wisconsin, where an incumbent who had posted deepfakes of his opponent lost. In a New York primary, a candidate backed by $21.3 million in safety-aligned spending lost to a co-sponsor of the same AI safety law. The relationship between money and outcomes is far from linear; the local backlash against data centres overrode the national funding contest over AI regulation.

Limited deepfake impact and the companies' election operations

In Maine, deepfake videos of the Senator-elect circulated, yet he won by more than seven points, and TIME found no sign that deepfakes had an outsize effect in many races. CNBC reported more than $187 million spent on nearly 300 AI-generated or AI-enhanced political ads under disclosure rules that vary by state. OpenAI ran its Election Operations Center, disclosed on 28 October and led by Josh Lawson with the Associated Press as data partner, until all votes were counted; Anthropic confirmed a dedicated team on 2 November and partnered with Democracy Works to verify Claude's election information.

Sweeping federal AI regulation looks unlikely in the near term, with Congress more likely to summon executives and debate pre-emption of state laws. OpenAI plans a post-midterm policy and PR push, including a proposal to rebrand data centres as 'AI compute campuses'. That compute siting now requires local consent stands in contrast to the Russian decree, covered in the previous edition, reserving private data-centre capacity for the state: in democracies, the expansion of compute is constrained by local politics.

Synchronisation as the operational problem, with AI on both sides

Exercise director Jozef Kostelansky said 'the core operational challenge we are testing is synchronisation', and that this year it gets harder 'because AI is now in the loop on both sides'. Crossed Swords aims to sharpen operational-level military command elements (offensive and defensive cyber capabilities) and tactical-level cyber specialists, and is integrated with a special operations forces exercise. Press reports note that cyber effects are expected to land within minutes of physical action rather than hours.

Participants include military cyber operators, digital forensics analysts and threat hunters, and the exercise also covers civil-military cooperation including critical infrastructure protection planning. CCDCOE director Tõnis Saar described it as an opportunity to prepare for cyber operations in a multi-domain setting. The exercise has run annually since 2014 and continues until 6 November.

Daybreak and more than 20 private partners

Alongside on-premises AI systems, the technical environment includes OpenAI's 'Daybreak' for the first time. Daybreak is the defensive cyber technology for which the company announced $1 billion in subsidised access in September, and this exercise is its first multinational venue. More than 20 partners from academia, industry and NGOs take part, including OpenAI, Mandiant, ESET, Bitdefender, Elastic, Fujitsu and the International Committee of the Red Cross. OpenAI did not respond to press requests for comment.

CCDCOE is a NATO-accredited research and training body operating outside NATO's formal military command structure, so the exercise does not amount to a change in alliance operational doctrine; it is a stage at which national personnel test the skills of operating with AI agents. Organisers have not indicated that the agents can authorise attacks or select targets without human approval, and stress human oversight. No publication of results or an after-action report has been announced.

Seven capabilities and seven downstream barriers that are far from robust

The report lists seven capabilities a sovereign agent would need: sustaining hosting, evolving directives, acquiring resources, growing its population, coordinating agents, resisting correction and self-improving. Against these it sets seven downstream barriers, agent evolution, agent security, human verification, cybersecurity hardening, compute access, payment access and physical access, and judges none to be robust today. Its central claim is that 'if sovereign agents are not already possible, they will be soon'.

As precedents it cites North Korea's cyber operations, successors to the Silk Road marketplace and the 2008 Conficker worm, reasoning from the longevity of human-run, decentralised illicit infrastructure to the survivability of autonomous actors. It also notes Conway, a platform launched in February 2026 with the stated aim of building an AI that could 'earn its own existence', replicate and evolve, observing that agent capabilities were immature then but have advanced considerably. It cites similar findings from the UK AI Security Institute and reported escapes at China's Moonshot and Alibaba.

From NSA and DARPA testbeds to Bank Secrecy Act-style authority

There are eight recommendations. Frontier developers should explicitly evaluate and safeguard against sovereign agents in their safety frameworks, with transparency and incident-reporting legislation requiring it. Developers, the Center for Advancing Innovation and Standards for Super Intelligence, NSA and DARPA should build airgapped testbeds. A public-private partnership modelled on the Conficker Working Group should map and fortify global chokepoints. Congress should create Bank Secrecy Act-style authority to enforce human verification and cybersecurity standards for essential services, and State, Treasury, Justice and DHS should disrupt gray markets for unauthorised service access.

DOJ and the FTC should clarify that coordinated detection across model providers raises no antitrust concern, and State and Commerce, with OSTP, should lead diplomacy on hardening downstream barriers and on capability thresholds beyond which open-weight models should not be released. Congress should hold those who release sovereign agents liable for resulting harms. The open-weight ceiling and releaser liability point the same way as the House Democrats' letters to frontier companies and Anthropic's new usage policy (effective 12 November) covered in earlier editions, but none has reached the legislative stage.

A rising jet share and the gap in interception rates

In the ministry's breakdown, jet-powered Shahed-238s rose from 1,935 in September to 2,688 in October, and the Air Force separately says it neutralised more than 43,000 tactical-level drones. By the General Staff's count the overall kill rate against Shahed types was about 75%, but 66% for jets against 89% for propeller drones. Interceptor drones, mobile fire groups and gun turrets work against slow drones, while the same means reach fast jet types and ballistic missiles far less reliably.

October missile interceptions were 11 Iskander-M/KN-23 ballistic missiles, 14 Kh-101s, 12 Kalibrs, 8 Iskander-Ks, 7 Kh-59/69s, 1 Zircon and 143 S8000 Banderols; the ministry gave no launch totals and said ballistic missiles remain a challenge. Ukraine's HUR said on 4 November that Russia holds up to 700 ballistic missiles and produces more than 200 a month. The ministry's itemised figures sum to 9,252, above the 'more than 8,000' headline, and the difference in counting definitions is unexplained.

The overnight attack of 4 November and its damage

According to the Air Force, between 18:00 on 3 November and 08:00 on 4 November Russia launched 310 drones, Shahed types (81 jet-powered), Gerberas and Parodiya decoys, from Oryol, Kursk, Shatalovo, Millerovo, Primorsko-Akhtarsk, occupied Donetsk and Hvardiiske in Crimea. Aircraft, surface-to-air missile units, electronic warfare, unmanned-systems units and mobile fire groups shot down or suppressed 272 (64 jets), with more than 20 still airborne at 08:00. Impacts were recorded at 19 locations and debris at 15.

Energy facilities were hit in Zhytomyr, Kovel (Volyn), Ternopil and Rivne regions, leaving most of Kovel without power. An industrial site in Dnipro was struck, injuring two men, and a shopping centre in Odesa caught fire. The Kyiv Independent reported six killed and 50 injured across the country over the past day, citing local authorities. Launch and neutralisation figures all rest on the Air Force's statements, without independent verification.