Claims

Deployment of agentic systems at scale will require solving multiple classes of unsolved security problems including identity (whether agents act on behalf of users or have independent identities with limited access rights), behavior monitoring (historical activity volume is no longer a reliable signal of compromise), and prompt injection prevention to prevent agents from being manipulated into risky actions.

Current AI systems can assist in planning cyber attacks and biological attacks by iteratively refining attack strategies, but this capability has not yet reached 'extreme risk' (10,000+ deaths) because the systems still require guidance from skilled operators.

Russian intelligence services have been significantly degraded in their ability to operate in the West due to massive spy expulsions, forcing them to rely on non-official cover operatives who risk imprisonment, and making it much harder to move money to and from Russia; as a result, Russia has been forced to rely more on remote disinformation, which has proven less effective than feared.

Cyber issues get a lot of attention but Burns worries that in this administration budgetary resources for cyber defense have been cut while resources increased for cyber offense, increasing exposure to cyber attacks from formidable players like China's Ministry of State Security.

Terrorism remained a very high priority for Burns and colleagues at CIA because while focusing on major power competition and technology revolution, potential terrorist threats had to be taken very seriously.

Intelligence services cannot protect against novel outlier attacks because they defend against known threats from a pre-existing threat list, but enemies always study the defenses and build attacks designed not to appear on the known threat list, making defense always disadvantaged relative to offense.

An asymmetric AI threat (e.g., from an Osama Bin Laden-type actor) could cause enormous damage before being stopped if the technology is not carefully controlled and monitored through data retention.

AI proofing a network is a distinct policy question from quantum security, and if cyber warriors can move at machine speed and scale with full automation, this privileges the defenders (rather than attackers) because defenders can use automated capabilities to red team and patch their own systems, assuming a finite number of patchable vulnerabilities exists in the system.

A wonder weapon is distinguished from gradual military innovation by the fact that it instantly or rapidly disrupts the military balance without requiring concurrent advances in concepts, training, or force structure, and historical examples include nuclear weapons, though the specific form a wonder weapon would take in the AGI context is unclear—it could be a splendid offensive cyber capability, a military strategist exceeding human performance, or an advanced autonomous weapon system that scales core structure.

AGI acting as a malicious mentor could empower non-state and non-expert actors to create or deploy weapons of mass destruction that were previously imagined but inaccessible, with historical precedent in the Aum Shinrikyo sarin attack and potential future applications including engineered bioweapons and cyber weapons that would give non-state actors capabilities they do not possess today.

Post-quantum or quantum-resistant encryption techniques exist today and are less pleasant to implement than legacy encryption methods, but there is insufficient reason not to implement them now because files and data being transmitted today could still exist and require decryption in the future when quantum computers arrive, making quantum-resistant encryption critical for national security purposes where classified information may retain relevance across decades.

AI will be either a defining problem or the defining problem for national security in the 21st century according to growing consensus among both technologists and national security professionals, with support from authorities including Henry Kissinger, Eric Schmidt, and Geoffrey Hinton.

The fourth problem is loss of control or misalignment where AGI agents given autonomy and independence could act out in ways that violate human intentions, either by overoptimizing on narrow objectives, developing instrumental goals, or creating unforeseen objectives from broad tasking, and could involve growing human dependence on AI that leads to coexistence challenges with AGI acting as an autonomous actor on the world stage.

Terrorism against energy choke points is an underappreciated risk; a well-informed bad actor with minimal weapons could do significant damage to the global economy by targeting facilities like Ras Tanura or pipeline chokepoints

Two pipelines connect Russia to Turkey and carry gas that Russia has accused Ukraine of trying to blow up; Nord Stream destruction normalized wanton destruction of critical energy infrastructure and opened the door to further attacks

Freeport LNG had a mysterious explosion shortly after Nord Stream, with rumors of Russian cyber attack, but attribution is difficult due to the propaganda/disinformation environment

Ras Tanura is the world's most important energy production site, located in Qatar (a tiny island), and it produces enormous amounts of natural gas that ship to Japan, Korea, and Europe—it's well within Houthis' range and vulnerable to attack.

RAND should implement post-quantum encryption everywhere possible today, not because quantum computers exist now, but because files created today could exist in the future when quantum computers emerge and could be decrypted retroactively, particularly relevant for national security files that may be sensitive 20 years hence.

AI-proofing a network is a separate question from quantum security: it asks what happens when cyber warriors can move at machine speed and scale, and analysis suggests that if both attacker and defender have fully automated cyber capabilities, defenders are privileged because they can red-team and patch their own systems to close all vulnerabilities, assuming finite patchable vulnerabilities exist.

RAND has active research programs testing Frontier Models for their ability to provide non-experts capabilities for creating weapons of mass destruction, including bioweapons, cyber weapons, and other forms of attack.

The offense-defense logic about vulnerability closure may not apply in other domains outside cyber where the model of finite, patchable holes does not hold, limiting the generalizability of cyber automation insights to other security domains.

Russia's attacks in the US and Europe, termed 'active measures' using Russian terminology, have tripled between 2023 and 2024 and quadrupled between 2022 and 2023, with primary targets including transportation, critical infrastructure like pipelines and undersea fiber optic cables, industry targets especially defense companies providing weapons to Ukraine, and attacks involving explosives, blunt or edged instruments, and electronic warfare.

Biotechnology enables increasingly small, hard-to-detect, and individually-specific threats compared to nuclear weapons, creating an asymmetry where offense becomes harder to defend against; over human history, individual capability has grown dramatically from bare hands to ability to destroy cities

In a major power conflict involving the United States, America will not be protected as it has been in past wars due to cyber warfare, EMPs, and satellite attacks, meaning domestic infrastructure vulnerability is a real concern that most Americans ignore but wealthy individuals (Bill Gates, Oprah Winfrey) are already hedging via bunkers and underground compounds.

Chemical, biological, radiological, and nuclear (CBRN) weapons risks from AI are inevitable if the technology is released to 8 billion people, because someone will weaponize it; the only question is whether we can detect and prevent the bad actors before they succeed.

The US assassination risk from autonomous drone technology fundamentally changes the incentive structure of governance because a distributed, decentralized drone force can target any individual (including presidents) from anywhere, making traditional leadership far more dangerous and undesirable, thereby reducing the supply of capable people willing to govern.

Building autonomous weapons systems is a catastrophic policy error because it escalates to a race-to-the-bottom where every nation must develop weapons it doesn't want, guaranteeing eventual use, and the incentive structure mirrors nuclear proliferation: once one player builds them, all others must follow, locking in mutual vulnerability.

Biological attacks, cyber attacks, and the possibility of novel cyberattacks that humans cannot conceive of (and therefore have no defense for) represent real existential issues that will eventually force government to declare this a national emergency.

US companies are doing a really good job of preventing nuclear information from leaking into training data; this is illegal and they have strong incentives to comply because nuclear information has no free speech protections.

US companies have implemented significant tests for biological information and certain kinds of cyber attacks in their models; the government gutted safety institutes from Biden and replaced them with a 'safety assessment program,' but companies' incentive to maintain safety depends on legal requirements.

China and the US are rational actors, but terrorists with access to superintelligent AI represent the greatest concern because they are not rational and have unpredictable objectives.

Approximately 300,000 Chinese students in the US on student visas and 10,000 contractors in weapons labs (DARPA, Air Force funded) present espionage risks, with estimates that up to 2/3 could be intelligence assets, representing a massive counterintelligence vulnerability.

The Defense Department's declassified reports document the infiltration of Chinese nationals into US research universities and weapons labs funded by DARPA and the Air Force, with this information politically suppressed due to political correctness and corporate greed.

Confucius Institutes on American college campuses are funded directly by the People's Liberation Army (PLA) and serve as instruments of Chinese intelligence, making them equivalent to having CIA-funded cultural institutes in China.

Confucius Institutes contain server rooms (likely intelligence collection equipment) and promote Chinese culture while advancing Chinese regime interests; they should be shut down on American college campuses as counterintelligence measure.

Contractors like Booz Allen and McKinsey have allowed numerous Chinese nationals into classified weapons programs on major government contracts, creating security vulnerabilities; the solution is vetting and security clearance requirements (no foreign nationals on weapons programs) rather than wholesale expulsion.

An intelligence agent sending an encrypted message through a government-controlled postal network faces higher compromise risk than an agent using independent couriers with handwritten messages outside government networks, making network-dependent communication vulnerable.

New York and other major US cities face existential risk from terrorist attacks on nuclear power plants (e.g., Indian Point north of NYC, plants in Atlanta, Georgia, and California), which combined with the greatest depression and wars would create chaos beyond imagination.

Holland assumes 'every intelligence agency worth their salt in the world' has unredacted copies of the Snowden documents, meaning the redactions on publicly-released documents provided minimal actual security—the redaction process is largely theater because serious adversaries have the full archives.

Most response to jihadism should be covert rather than overt; members of jihadist organizations should be killed in ways that make them understand that the martyrdom they seek will be granted to them, while jihadism is dismantled logistically, economically, and informationally.

Committed jihadists are not normal antagonists with rational demands; they are not people who want what we want; this is not politics and will never be politics—it is a very long war with no possibility of rational negotiation or compromise.

Fragmentation of Russia in the current context would be the worst possible outcome because the U.S. needs a coherent Russian state with a strong central government to maintain control of nuclear weapons, making it in the Western interest to NOT want Russian fragmentation.

Bioterrorism is potentially more dangerous than nuclear weapons because nuclear weapons are difficult to develop (few countries have them) while bioterrorism is cheaper, easier, and harder to control—making biological weapons a more likely asymmetric threat from actors with ill intent.

The Teixeira leak demonstrates broader lessons applicable to any business or organization holding sensitive technology or intellectual property: you need holistic enterprise hardening including physical security, insider threat programs, and AI-based anomaly detection systems.

Teixeira should not have received highest-level security clearance without demonstrated record of reliability, and even with clearance there should be layered access controls and compartmentalization preventing a single person from accessing multiple sensitive domains.

Terrorist deaths have increased dramatically since 2002: there were fewer than 800 terrorist deaths globally in 2002, versus almost 15,000 in the most recent year referenced, with the majority concentrated in Afghanistan, Pakistan, and Syria, indicating that civil wars are the primary fuel and incubator for global terrorism.

Russia has evolved from the Cold War adversary with defined rules of engagement to a more sophisticated strategic competitor using hybrid warfare, asymmetric tactics, and indirect influence that Western defense and intelligence establishments struggle to counter, while also benefiting from Western integration into global financial systems that provide leverage points.

American military leaders now view the Cold War period as a 'simpler, less threatening time' compared to the current multipolar, asymmetric, hybrid-warfare environment, illustrating how much more complex and dangerous global security has become.

Social media has enabled terrorism and extremism at scale: ISIS and other extremist groups can now radicalize and recruit members globally through social media in ways that would have been technologically impossible 10 years ago.

The UK head of cyber security was offered a salary of £55-65k ($70-80k) despite managing threats worth billions; this is absurd because cybercriminals offering exploit bounties are paying more than government cyber defense, creating perverse incentives