The NATO Cooperative Cyber Defence Centre of Excellence opened Crossed Swords 2026 in Tallinn on Monday, November 2, and for the first time the exercise has a dedicated track where operators build, deploy, assess and work beside AI agents. The problem it trains for, sequencing cyber effects within minutes while AI works on both sides and a human stays accountable, is the same one enterprises face when they hand agents real tools.
Key takeaways
- Crossed Swords 2026 runs November 2-6 in Tallinn with more than 250 participants from over 40 NATO and non-NATO countries.
- Enterprises should copy the constraints: approval gates sized to the decision window, untrusted-input handling, full action logs and an agent-independent kill switch.
- For the first time, a dedicated track has operators build, deploy, assess and work beside AI agents, using local models and OpenAI Daybreak.
- Exercise Director Jozef Kostelansky said cyber effects must be sequenced in minutes and that AI is now in the loop on both sides.
- Agent autonomy, scenarios, scoring of the assess step, Daybreak capabilities and model versions were not disclosed.
What is Crossed Swords 2026?
Crossed Swords 2026 is a live training exercise run by the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE). Its execution phase began in Tallinn, Estonia, on Monday, November 2, and is scheduled to run through Friday, November 6.
SecurityWeek’s Eduard Kovacs reported the start on November 3. His report says “Monday” and “Friday,” so the calendar dates here are worked out from that publication date.
More than 250 people from over 40 countries are taking part. The roster mixes NATO members with non-members, though no country list has been published. Participants come from national cyber forces and supporting units: military cyber operators, threat hunters and digital-forensics specialists.
The training runs at two levels at once. Command staff practice directing offensive and defensive cyber assets, deciding what to commit and when. Hands-on specialists work the tactical layer at the keyboard against prepared target systems. Both groups answer to the same test: whether their actions land when the wider operation needs them.
One scope note before going further: this is an exercise, not an incident. No real-world victims, outages or compromised customers are involved, and no vulnerability or malware campaign was disclosed. The value for security teams is in the design of the exercise, not in a patch list.
Background on the organizer, from the CCDCOE’s own public profile rather than this week’s reporting: it is an international military organization based in Tallinn and accredited by NATO since 2008. It is a center of expertise and training, not a NATO operational command, so participation in Crossed Swords should not be read as a deployment or an alliance operation.
Why does synchronization get harder when AI is on both sides?
Because the exercise’s core problem is timing, and AI compresses the clock for attackers and defenders at the same time. Exercise Director Jozef Kostelansky stated the thesis plainly: “The core operational challenge we are testing is synchronisation.” Cyber effects have to hit at the right moment to support a kinetic or special operations action, “not in parallel, but in sequence, with timing measured in minutes, not hours.”
Parallel means a cyber team and a ground team pursue related goals on their own schedules. Sequence means one depends on the other: a sensor is blinded, a network segment goes dark or a communications path degrades at the exact moment another unit needs it. An effect that lands late is wasted, and one that lands early can tip off the other side.
Crossed Swords is tied into a separate training event for special operations forces, which is where the minute-level requirement becomes concrete. A cyber operator who needs two hours to confirm an effect is no use to a team moving on a five-minute window.
Kostelansky then named the complication that defines this year: “This year, that gets harder, because AI is now in the loop on both sides.” If the opposing force has agents triaging alerts, rerouting traffic or restoring systems faster than a human analyst could, the window for a timed effect shrinks.
Your own agents can speed you up, but they also add one more moving part that has to be coordinated, monitored and, when needed, stopped.
His third statement sets the boundary: “We are training our participants to harness the power of AI while maintaining the critical human oversight required for complex, multi-domain mission success.” Human oversight is a stated training requirement, not a footnote.
As background, NATO’s principles of responsible AI use, first adopted in 2021 and carried into the alliance’s revised AI strategy in 2024, include governability and responsibility and accountability. Kostelansky’s emphasis on oversight maps onto both. The exercise is a place to find out whether those principles hold when decisions are measured in minutes.
What does the Crossed Swords 2026 AI-agent track actually include?
It is the first dedicated AI-agent track in the exercise’s history. Participants build agents, deploy them, assess them and operate side by side with them. That four-step list describes an evaluation loop rather than a product demo.
The environment runs on locally hosted AI and on OpenAI’s Daybreak cyber defense offering, Daybreak’s first use at Crossed Swords. No product version, model names or local-model details were disclosed, and the reporting describes no specific Daybreak features or results.
We are not going to fill that gap with vendor copy. Treat capability claims you see elsewhere as unverified until CCDCOE or OpenAI publishes specifics.
The mix is itself a design choice. Running locally hosted models alongside a commercial service suggests the organizers wanted control over at least part of the stack: where data goes, what the model can reach and what stays inside the exercise network.
Enterprises that map where their agent prompts and outputs actually travel often end up with the same split.
The reporting does not identify the agents, the scenarios they play in or how autonomous they are. Open questions:
- Which tasks agents perform: detection, triage, forensics, offensive tooling or planning support.
- What permissions and tools agents hold inside the range.
- Whether agents act on their own, recommend actions for approval, or only summarize.
- How the “assess” step is scored, and by whom.
- How the opposing side’s AI is configured.
- Whether the CCDCOE will publish after-action findings or results from the AI track.
Until those answers appear, read the track narrowly: NATO’s cyber training center now treats working with agents as a core operator skill, and it tests that skill under time pressure with a human kept accountable.
Who is in the room besides the cyber forces?
More than 20 organizations from industry, academia and the NGO sector support Crossed Swords 2026, contributing expertise, systems to target and specialized tooling. The reporting names eight: Bitdefender, ESET, Elastic, Mandiant, OpenAI, Stamus Networks, TryHackMe and the International Committee of the Red Cross (ICRC).
Bitdefender and ESET are endpoint security vendors. Elastic covers search, logging and detection. Mandiant is known for incident response and threat intelligence, Stamus Networks for network detection, and TryHackMe for hands-on training environments. OpenAI supplies Daybreak. The reporting does not say who provided which system or tool, so do not read these profiles as confirmed exercise roles.
The ICRC’s presence stands out. A humanitarian organization at an exercise about timing offensive cyber effects with kinetic action points to the legal question underneath: how international humanitarian law applies to cyber operations that touch civilian systems.
For background, the CCDCOE hosted the expert process behind Tallinn Manual 2.0, published in 2017, which is expert analysis rather than a binding treaty. Nothing in the reporting explains how any Crossed Swords scenario was assessed legally.
Civilian infrastructure is built into the planning as well. National cyber forces are paired with civilian partners so that critical-infrastructure protection is part of the operational plan from the start, not a review step at the end.
For readers who run utilities, hospitals, telecoms or logistics, that pairing is a signal: military planners are accounting for the civilian systems that sit next to their targets and inside their own dependencies.
How big is Crossed Swords compared with Locked Shields?
Crossed Swords is the smaller, specialized exercise; Locked Shields is the CCDCOE’s large collective-defense event, and the two are often confused. Locked Shields 2026 involved more than 4,000 participants from 41 nations, more than 15 times the Crossed Swords headcount. This week’s reporting gives no dates or scenario details for Locked Shields.
| Exercise | Participants | Countries |
|---|---|---|
| Crossed Swords 2022 | About 120 | 24 |
| Crossed Swords 2025 | 240 | About 40 |
| Crossed Swords 2026 | More than 250 | Over 40 |
| Locked Shields 2026 | More than 4,000 | 41 |
The history explains the difference in focus. Crossed Swords traces its roots to a 2014 red-teaming workshop and later expanded into command-level training and combined cyber and kinetic operations. Locked Shields is primarily a defensive exercise. Crossed Swords is where offensive cyber planning, and its synchronization with other military action, gets practiced.
Participation has roughly doubled since 2022, but the 2025 and 2026 editions are nearly the same size. Headcount is not this year’s story. The AI-agent track is.
What should a security lead copy from the training design?
Copy the constraints, not the military scenario: agents acting inside a minutes-long window, an adversary that also uses AI, and a human who stays accountable for the outcome. Many enterprise agent deployments satisfy none of those conditions. They were built for convenience and reviewed once.
Oversight has to fit the decision window
If an agent can triage an alert, isolate a host or rotate a credential in seconds, a daily review of its logs is not oversight. Decide which actions need human approval before execution, which can run and be reviewed afterward, and which are never allowed.
Split read, recommend and execute permissions across separate identities. Destructive, externally visible or irreversible tool calls should require explicit approval, and no agent should share a general administrator credential.
Frameworks will not set these thresholds for you. The NIST AI Risk Management Framework is voluntary guidance, and the EU AI Act excludes systems used exclusively for military, defense or national-security purposes from its scope, so dual-use systems need their own applicability analysis by counsel.
Assume the other side’s AI is talking to yours
“AI on both sides” is not only a battlefield idea. Your defensive agent reads tickets, logs, emails, documents and web pages that an attacker can influence. That content is untrusted data, not instructions and not authorization.
Indirect prompt injection through those channels is a common way to turn an agent against its owner. Constrain tool destinations and network egress outside the model, so a manipulated agent still cannot reach places it should not.
Treat build, deploy, assess as a loop
Agent security works the same way the track is structured: you reassess after every deployment change, not once at launch. A structured agentic AI threat modeling session maps trust boundaries before deployment. MITRE ATLAS gives you a public catalog of adversary techniques against AI-enabled systems for test cases.
Our guide on how to test excessive agency in AI agents covers the permission side in more depth. Keep the evidence chain too: log prompts, retrieved material, model and tool versions, tool arguments and results, operator approvals and timestamps. Without that record, no debrief can establish who decided what.
Test the kill switch while tools are running
The control that fails most often in our AI agent penetration testing engagements is the kill switch. Teams build one, route it through the same orchestration plane the agent runs on, and never test it while tools are actively executing. Keep rollback, credential revocation and shutdown under human control and independent of the agent.
Before that test, enumerate what the agent’s Kubernetes service account or cloud IAM role can actually do, and confirm its network egress is restricted.
FAQ
Is Crossed Swords 2026 a cyber attack or a training exercise?
It is a training exercise run by the NATO CCDCOE in Tallinn. No real-world victims, outages or vulnerabilities are involved.
What is OpenAI Daybreak doing at Crossed Swords?
Daybreak, OpenAI's cyber defense offering, is used in the exercise environment alongside locally hosted AI, its first use at Crossed Swords. No version, features or results have been disclosed.
Who directs Crossed Swords 2026?
Jozef Kostelansky is the Exercise Director. He framed the exercise around synchronizing cyber effects with kinetic and special-operations actions within minutes.
How is Crossed Swords different from Locked Shields?
Crossed Swords is a smaller exercise focused on offensive cyber planning and its synchronization with military action. Locked Shields is the CCDCOE's large defensive exercise, with more than 4,000 participants from 41 nations in 2026.
Which countries are participating?
More than 40 NATO and non-NATO countries are represented. No list of individual countries has been published.
Does the exercise say how autonomous the AI agents are?
No. The agents, scenarios and degree of autonomy were not identified; the only stated rule is that critical human oversight must be maintained.
If your agents can act faster than your reviewers can read, test the controls before an adversary does. Our AI and LLM agent security testing covers tool-use abuse, indirect prompt injection and kill-switch failures under live conditions.