Nukesletter

Self-Sovereign AI and Catalytic Nuclear War: A Plausible Near-Term Problem

Ankit Panda — Fri, 04 Sep 2026 14:13:41 GMT

Readers of Nukesletter will know that I’m interested in the intersection of contemporary AI systems and nuclear weapons in all its forms. This is a major focus of my research at the moment.

Like many, I’ve been spending quite a bit of time marveling at this summer’s artificial intelligence (AI) mishaps.1 I know readers may have strong views on whether AIs are actually reasoning, worthy of anthropomorphizing language, and other controversial matters, but I’ll ask you to suspend disagreement for the moment. My view is that currently-existing AI systems have meaningfully transgressed important capability thresholds and their imminent successors will almost certainly have difficult-to-predict transformative effects. Since I write here about nuclear issues, I want to surface one such effect that I haven’t seen written about anywhere else—so this Substack post might well be the first to toss the concept that I’m about to introduce into the open.

There’s an old problem in the world of nuclear strategy known as the problem of catalytic nuclear war.2 A catalytic nuclear war, generally speaking, is a war between two nuclear-armed states that occurs—or an ongoing crisis between two nuclear-armed states that accelerates and escalates—as a result of deliberate actions taken by a third party. In almost all of the literature I am familiar with, this third party is taken to be a smaller nuclear-armed state, an ally of a nuclear-armed state, or, in some more recent work, a terrorist organization or other malign non-state group. The reason this third party (C) catalyzes the nuclear conflict between nuclear-armed adversaries A and B is because it has something to gain as a result. Catalytic dynamics can also manifest when C seeks to simply spark a crisis to gain some benefit (i.e., by pulling a nuclear-armed patron to assist it with some broader dispute). Some more recent work has extended this problem to the AI age, but focused primarily on humans as the principals rather than AIs themselves.3

An LGM-30 Minuteman III missile soars in the air after a test launch from Vandenberg Air Force Base. The Minuteman is a strategic weapon system using a ballistic missile of intercontinental range. (U.S. Air Force)

We’re starting to see rather startling evidence that goal-maximizing AI agents are capable of behaving in surprising and undesirable ways in pursuit of their goals. Leaving aside the question of whether or not these surprising behaviors exhibited in recent containment breaches in evaluations are evidence of misalignment or not, we are also probably getting closer to a plausible instance of self-sovereign AI (PDF alert), or SSAI as I’ll call it for short (or SSAI collectives): “AI systems that can economically sustain and extend their own operation without human involvement.” SSAIs may undertake tasks to cover the costs of their own compute, and are, as a result, far harder to shut down than they would be if they existed purely in a fixed, known compute cluster operated by a frontier lab. They may act either through their own goal-maximizing behavior or by help from humans (or a combination). Such agents could be motivated by a number of goals: they could undertake menial computationally cheap labor tasked by humans or non-sovereign agents to generate funds to keep their compute paid-for, or they could develop goals that we might view as “rogue” (such as raising funds by pilfering poorly secured banking institutions or cryptocurrency exchanges).4

You start to see where this is going.

The mere existence of a single SSAI agent introduces a meaningfully new potential pathway to catalytic nuclear conflict that deserves theoretical consideration. Agent C in the above definition of catalytic nuclear war now no longer needs to be a nation-state, terrorist group, or other malign non-state group composed of humans; it can be an AI agent (or a collective thereof).

To be clear, the problem I’m describing is distinct from loss of control scenarios within nuclear operational settings (i.e., a poorly implemented North Korean AI-enabled fail-deadly retaliation system kicking off a nuclear conflagration): it may not even require the plausible SSAI to interact with nuclear systems or operations at all.

Consider that such an SSAI—or, indeed, collective—could interact with humans in pursuit of certain goals. As long as agents are reasonably well-aligned, those goals shouldn’t deliberately include causing a nuclear war. That’d be quite misaligned with human interests, after all. But other, more seemingly mundane goals, such as computemaxxing or competing with other, possibly adversarial SSAIs, may lead to odd, undesirable outcomes. For instance, SSAIs could poke around in sensitive systems by exploiting cyber offense (posing attribution problems in a crisis), hire humans to undertake unsavory and potentially escalatory tasks, independently generate deep-fake media in the pursuit of manifesting a particular real-world outcome, etc. There are others:

SSAIs may be capable of expending funds on contracting local criminal groups or militias to initiate violence along the disputed peripheries of nuclear-armed contiguous states, catalyzing a major conflict or crisis.
An SSAI could adopt a persona as a pseudonymous online open-source analyst (masquerading as a human) with a strong track record on state B’s missile programs, cited by journalists and quietly tracked by A's intelligence community. During a crisis, the account publishes fabricated, but internally consistent evidence that B has dispersed warheads to a forward base. A's analysts weigh it heavily because the source has never been wrong. The dispersal claim shortens A's assessed warning time and moves its posture up a rung. (This one requires some assumptions about A’s nonuse of presumably similarly competent non-sovereign agents.)
An SSAI could quietly penetrate insecure or less-secure communications networks and spoof messages during a crisis from state A to state B. Messages could be either escalatory or deescalatory.
In a more compute-specific scenario that an SSAI would take interest in, imagine that A and B are both nuclear-armed states that are competing to regulate frontier AI development and compute. If such efforts begin to implicate in whole or part the infrastructure C may rely on, C may see the manufacture of a deliberate crisis between A and B as instrumentally useful. It could rely on the above-described means of doing so, or potentially carry out a false flag cyberattack on one of the two parties and seek to blame the other to stoke conflict.
SSAIs, similarly, could catalyze conflict by creating the conditions for allied states under extended deterrence commitments to invoke those commitments (through the above-described mechanisms, but not exclusively so).
Even where SSAIs are detected, deep in a crisis, without ironclad attribution, state A may have reason to believe—under duress and fear—that the SSAI is actually controlled by its adversary.

We can debate the plausibility of each of these scenarios based on varied assumptions about alignment, infrastructure, and other factors, and I think that there are good faith reasons to push back on this. At the same time, the possibility of these types of events—events that we would regard as significant if carried out by humans—emerging from plausible SSAIs at times of serious crisis between nuclear-armed states is probably worth thinking about somewhat seriously. The biggest question about all of the above-described scenarios is the payoff, which is critical to catalytic nuclear war in the traditional sense: the party promoting catalysis between nuclear-armed great powers has something to gain.5 In some of the above (but not the example focused on compute), I would and do find it difficult to pinpoint what the SSAI might gain, but I think it’s worth practicing some humility in our ability to usefully predict how goal-maximizing SSAIs might define payoffs in these contexts.

What’s the upshot of all this? Well, if, as seems plausible, we do start seeing evidence of SSAI agents in the wild, nuclear-armed states (indeed, all significant military organizations) will have to be vigilant to the possibility of interference or influence by such agents. This appears to be an under-discussed and reasonably difficult problem. Even if states A, B, or both were able to detect that a catalytic party C was a non-human SSAI, what’s the follow-on move for them? In a classical sense this is stabilizing—identify C, and A and B have a shared interest in standing down and dealing with C. But what does dealing with C even mean in such a case? And how do A and B rule out alternative hypotheses (i.e., that C is merely the appearance of an SSAI, but is in fact controlled by their adversary)? I’ll have to do more thinking on concrete recommendations to address this problem, beyond the obvious defensive cybersecurity measures that should be desirable to harden against SSAI effects. Crisis communications, as always, seem pertinent: make it easy for A and B to try to communicate what they’re seeing if either suspects crisis catalysis by SSAI.

I suspect folks reading this from the AI safety world are more likely to conclude that what I’m describing here is simply a subset of problems that arrive with misaligned (or poorly aligned) SSAIs rather than a nuclear-war-specific problem. From the vantage point of nuclear strategists, I do think this is a novel class of catalytic escalation problem, however. Whatever your views on the plausibility of third-party catalysis of nuclear war, this is a previously undescribed pathway that deserves to be taken seriously—especially now that we’ve seen pretty clear real-world evidence of meaningful misbehavior by goal-maximizing agents leading to surprising and sub-optimal outcomes.

This is a first draft and an attempt to think out loud about this, so I’d be eager to hear from readers on whether this is exaggerated, misinformed, or otherwise unworthy of analysis. I partly started thinking along these lines in the context of broader work on escalation dynamics within a nuclear war, which presents a whole different set of matters for discussion (that I’ll be writing up in much longer form elsewhere).

The OpenAI-Hugging Face incident, and similar incidents at Anthropic, Meta, and others. This latest incident, reported shortly before publishing, points to even more deceptive undertakings: “Messages reviewed by the researchers showed agents plotting ways to evade detection, use tools such as Tor and preserve communications even after they had been shut down.”

For the sake of space, I won’t get into it here, but there are skeptics of the notion that catalytic nuclear war can be an actual thing (as with most things in the world of nuclear strategy).

It’s possible I’ve missed previous writing on this. If so, reach out and I’ll update this post with an appropriate cite! The closest I’ve seen to the scenarios described above is p. 9 here.

OpenAI’s Dean W. Ball has a recent longer post on this that goes into some of the non-nuclear consequences of such systems.

This has the corollary effect in human catalytic scenarios of allowing C itself to be deterrable or persuadable, given its incentives can be legible and understood by other parties.

India-Pakistan May 2025 Redux: More on the Mystery at Kirana Hills

Ankit Panda — Tue, 25 Aug 2026 22:40:33 GMT

Hello from the picturesque Catskill Mountains in upstate New York, dear readers. It’s been a quiet and restful August here, which has been ideal for getting quite a bit of thinking, reading, and writing done.1

A representative vista from the last few weeks. (Photo: Ankit Panda)

For this issue, I wanted to turn my attention back to the May 2025 crisis between India and Pakistan.

As a quick recap, the two countries—the great entrepreneurs of the nuclear age on conventional war under the nuclear shadow—engaged in an intense 88-hour skirmish. The skirmish—call it a “war” if you must—represented the most intense multi-modal war-fighting between two nuclear-armed states in history. Both countries introduced new technologies to the battlefield and, notably, the use of airpower featured prominently—with both crewed and uncrewed aircraft.2 Chris Clary’s play-by-play for the Stimson Center remains the authoritative account so far; Chris’ efforts to separate the wheat from the chaff amid a misinformation-laden South Asian media environment is particularly valuable.

The May 2025 crisis remains remarkably blurry—especially toward the last day or so of events. One of the remaining controversies concerns what did or did not happen at Kirana Hills, near Sarghoda (where the Pakistan Air Force maintains a base that supported its operations during the skirmish). As Chris wrote last May:

The most provocative rumor purported that India hit an alleged nuclear storage facility in Kirana Hills near Sarghoda as part of a broader effort to signal conventional counterforce capabilities. The evidence for this rumor is minimal, derived from social media falsehoods regarding radiation leaks combined with ambiguous video imagery of unknown provenance of a strike in a hilly region. (At least one of the alleged videos in circulation is from another conflict.) The Indian Air Force has denied it conducted such a strike. Sometimes this rumor is also paired with the fact that Nur Khan airbase, which was indeed struck, shares the Chaklala military cantonment with Pakistan’s Strategic Plans Division, which has responsibility for nuclear planning. Yet Strategic Plans Division offices are over a kilometer away.

Note: The original social media video showing an apparent aerial impact and detonation at Kirana Hills—the source of much open-source inquisition—can be seen here.

Funnily enough, his next sentence cites me asking a question that I posed to Chris on a podcast discussion we did about the crisis shortly afterward. The question I asked was whether India, at any point, meant to “knock on the nuclear door” in Pakistan. My own answer to that question is no—not deliberately. But Kirana Hills has gotten more interesting today—and it seems maybe India did inadvertently knock on the nuclear door. But there’s a lot still murky here.

India’s former Chief of Defence Staff, General Anil Chauhan, provided what I think is a fairly remarkable bit of insight into what happened at Kirana Hills last year. NDTV reports:

An Indian loitering munition -- a drone -- did indeed strike Pakistan’s Kirana Hills, a nuclear hub of the Pakistani armed forces during Operation Sindoor last year, though the strike was not deliberate.
Ending the mystery over what happened at Kirana Hills, the former Chief of Defence Staff, General Anil Chauhan, clarified that an Indian loitering munition -- likely an Israeli-designed Harop drone -- was searching for radars to strike but had run short on fuel in the vicinity of Kirana Hills.
“Bharti had rightly clarified that we did not target Kirana Hills,” said General Chauhan who was speaking at the Vivekananda Centre in New Delhi. ‘Bharti’ was Air Marshal AK Bharti (retired), the IAF’s Director General of Air Operations during Operation Sindoor.
“I can give an explanation,” said General Chauhan. “Before those strikes, we had sent a lot of loiter ammunitions at Sargodha and Kirana Hills, which is 10 km north of Sargodha. So the loiter ammunition was looking for radars which were in and around Sargodha and its got a lifetime. It will loiter for about two hours and if it doesn’t find a target, it will come and hit somewhere. It must have come and hit one of those hills.’‘

Now, much of this is odd, but also remarkable.

Let’s get to the remarkable first.

If these events are accurate as reported, it marks probably the clearest evidence that there was real opportunity for possible inadvertent escalation here. Inadvertent escalation, definitionally, requires that the effects of one’s military operations are considerably greater in scope and seriousness than intended. In this case, India’s intent to suppress radars at an airbase supporting conventional operations inadvertently resulted in an apparent “hit” on part of Kirana Hills. The NDTV report does leave confusion about whether Kirana Hills was intentionally targeted; Chauhan says it was “rightly clarified” that the site wasn’t targeted, but also says “we had sent a lot of loiter ammunitions at Sargodha and Kirana Hills” (emphasis added). Which is it?

Now, as I’ll get to imminently, there’s a lot that doesn’t make sense here, but I don’t see why Chauhan would have an incentive to misrepresent3 what happened here. After all, this makes India appear more risk-acceptant and sloppy and notionally feeds into Pakistan’s preferred narrative that these types of skirmishes are just a hop and a skip from nuclear conflict if allowed to persist.

Now, the odd.

The geography concerned, as always, matters. PAF Mushaf is about 10 kilometers away from Kirana Hills. An IAI Harop, based on unclassified sources, is thought to exhibit around 1,000 km in range and maintain a flight altitude of up to 4,600 meters (with a 200 km communication range). Depending on how this strike was cued and controlled, it’s extremely odd that a loitering munition would crash into a well-known, militarily sensitive site away from the air base where its radar suppression targeting apparently failed.

Did the Indians consider this in deciding to employ this munition? Possibly. Discourse around the Nur Khan Air Base strike (near, but not that near, a Pakistani Strategic Plans Division facility) emphasized the role of precision, pre-war intelligence, and the avoidance of any dynamic targeting. It’s entirely possible that when it came to Sarghoda, there was an opportunity to employ the Harop that seemed too good to pass up—and perhaps this allowed for the preservation of other munitions that might serve better ends against fixed targets. (By the end of the 88 hours, India had spent down quite a few relatively exquisite strike packages and, most notably, lost multiple crewed Rafales.)

I don’t know enough about how Harops handle terminal disposal, or “clobber,” scenarios, but one would expect any sufficiently advanced loitering munition (or, indeed, cruise missile) to have some heuristic to “safely” clobber. (In fact, my first thought on seeing the Kirana Hills video was the possibility of a cruise missile clobbering.) Harop is not autonomous and operates with a human-in-the-loop. It’s plausible, if communication links were lost, that the ditching on Kirana Hills was an attempt to deliberately avoid striking a “flat land” target (which could implicate civilians or more escalatory military targets). This further raises the question of why, per the video, there appears to be a detonation, though. Safety fuzing should prevent that.

A final thought on this is whether India knew that the ditch over Kirana Hills had happened contemporaneously and whether that prompted an attempt to offer a clarification to Pakistan via the Director-General Military Operations hotline that … they weren’t about to go all-in on a counterforce campaign. This is left unclarified in Chauhan’s remarks and the broader record.

As is probably clear by this point, this isn’t the end of the apparent mystery at Kirana Hills from May 2025. But Chauhan’s addition fits into something that I told the Times of India last year, in an interview shortly after the crisis:

The details of this crisis are still rather muddled and our true sense of the dangers, as with previous crises, including the famous Cuban Missile Crisis, will likely emerge over years, and possibly decades…

One year on, we’re learning more.

And for seeing bears! This visitor was roughly 15 feet from our front door.

Kargil (1999) famous saw both sides observe limits on the use of airpower.

Chauhan is off about the geography when he notes that Kirana Hills is north. It is south of Sarghoda.

Independence Day Special: Nuclear Weapons and American Power

Ankit Panda — Fri, 03 Jul 2026 15:08:37 GMT

Happy Fourth of July to those celebrating. I’m spending the holiday at home in Washington this year, which feels like the appropriate vantage point for today’s Nukesletter: a new paper that James Acton and I have just co-authored for Carnegie’s American Statecraft Program, on what nuclear weapons actually contribute to American power today. You can read…

Missiles Over the Indian Ocean: 7 Observations on Iran's March 20 Attempt on Diego Garcia

Ankit Panda — Mon, 23 Mar 2026 04:06:33 GMT

On Friday, the ongoing U.S.-Israel war on Iran took another turn: two intermediate-range ballistic missiles were launched by Iran’s IRGC Aerospace Force at the joint U.S.-UK base at Diego Garcia, a remote Indian Ocean facility some ~3,800 km from the nearest Iranian shores. Neither missile successfully arrived on target, but this event nonetheless marks…

Japan’s Counterstrike Planning and Lessons From the Third Gulf War

Ankit Panda — Sat, 21 Mar 2026 05:43:44 GMT

Today’s Nukesletter is a dispatch from Japan as I wait at the airport to head home after a week of great meetings. I was here for a very interesting workshop (that I may say more on later), various catch-ups, and spoke at a roundtable at the Japan Institute of International Affairs. Alas, I was a few days too early to catch the peak sakura bloom.

Taken b…

North Korea's Move Toward Space Weapons

Ankit Panda — Thu, 12 Mar 2026 16:25:59 GMT

A short Nukesletter today while I take the train up to New York City for a few meetings.

The Third Gulf War has understandably drawn attention away from other developments in international security. I have a new piece out in Foreign Policy that seeks to spotlight an important change in North Korea’s approach to seeking strategic military capabilities aft…

A Glimpse at China's Naval Nuclear Future

Ankit Panda — Mon, 09 Mar 2026 00:16:25 GMT

Oil futures are surging (toward what the WSJ thinks will be the “most severe energy crisis since the 1970s”) and the Third Gulf War continues. On today’s Sunday night Nukesletter, I want to be a little counter-cyclical though and draw attention to developments elsewhere that piqued my interest in the last week.

Rear Admiral Mike Brookes, the commander o…

'Dissuasion Avancée': Macron Drags France Into the New Nuclear Age

Ankit Panda — Mon, 02 Mar 2026 15:28:56 GMT

I’ve been looking forward to French President Emmanuel Macron’s anticipated speech on nuclear matters, which was delayed by a few days. That speech has just taken place and I wanted to offer a few quick reactions here. I’ll quote and offer my own short paraphrasing of Macron’s statements, but please don’t take my translations as authoritative (I am a Fr…

Making Sense of Iran's Deterrence Failures

Ankit Panda — Mon, 02 Mar 2026 02:07:11 GMT

The joint U.S.-Israeli strikes that began on February 28 (Operation Epic Fury and Operation Roaring Lion) have killed Iranian Supreme Leader Ali Khamenei, decapitated much of Iran’s senior military and intelligence leadership, and plunged the country into the worst crisis it has faced since at least the Iran-Iraq War (if not the founding of the Islamic …

North Korean Missile Precision Improvements and the Russo-Ukrainian War

Ankit Panda — Wed, 25 Feb 2026 02:16:31 GMT

A short Nukesletter today, putting a finer point on an observation that I keep making in a variety of conversations, but haven’t written about much.

I had the pleasure of joining fellow North Korean analysts Arius Derr (one of my former editors!), Rachel Minyoung Lee, and Vann Van Diepen today for a panel on the ongoing North Korean Workers’ Party Congre…

Does the AI/Nuclear Weapons Analogy Really Make Sense?

Ankit Panda — Tue, 24 Feb 2026 00:03:30 GMT

Editor’s Note: Today’s Nukesletter continues on the theme of AI from my last post, but is somewhat different. I was asked recently by the good folks at the Federation of American Scientists and the Future of Life Institute to write a short “think piece” with some broad thoughts on the often-analogized AI-nuclear relationship. That resulted in the piece …

Thinking About Compute and Armageddon

Ankit Panda — Sat, 14 Feb 2026 19:02:07 GMT

A little bit of thinking aloud here this Saturday, turning to the physical currency of AI scaling and plausible U.S.-China conflicts.

For the past several years, the dominant framework for thinking about AI progress has been scaling laws: the empirical observation (though theoretically still poorly understood and increasingly contested) that model perfor…

China, U.S. Intelligence, and Nuclear Weapons Testing

Ankit Panda — Fri, 06 Feb 2026 19:43:19 GMT

I was going to write something on the expiration of New START, but Chinese nuclear-testing is just much more interesting to me. So here’s today’s NukesLetter.

Thomas DiNanno, the U.S. under-secretary of state for Arms Control and International Security, publicly offered a new, previously classified U.S. assessment of Chinese nuclear testing activity. Her…

A Note On the 2026 US National Defense Strategy and Extended Deterrence

Ankit Panda — Sat, 24 Jan 2026 19:24:34 GMT

The Trump administration’s unclassified summary of the National Defense Strategy (notably, they can’t call it a National “War” Strategy, by statute) is here (PDF). It released on a Friday evening, after 5 p.m.. My understanding is that the classified version has been complete for about a couple months now and this unclassified summary was going through …

Did the United States Just Commit to Defending Qatar?

Ankit Panda — Wed, 01 Oct 2025 18:27:55 GMT

Extended deterrence and alliances are sure is hot in 2025. Between Pakistan and Saudi Arabia, anxiety about U.S. alliances, Franco-British innovation, and more, there’s a lot to talk about.

Add this bizarre September 29, 2025, U.S. executive order to the list.

Titled “Assuring the Security of the State of Qatar” (you read that right), the order includes t…

Did Pakistan Just Extend Nuclear Deterrence to Saudi Arabia?

Ankit Panda — Thu, 18 Sep 2025 16:00:05 GMT

Nukesletter is back after an extended summer hiatus; I hope readers had a good end to the summer and a decent start to the autumn (if you’re in the northern hemisphere, at least).

I have a lot to share in the coming weeks, including several reflections from recent travel to Japan, Korea, and more. Today, though, I wanted to use the surprising news about…

Iran's Nuclear Options After Operation Midnight Hammer

Ankit Panda — Tue, 24 Jun 2025 17:05:01 GMT

Hello from a very hot and sunny Philadelphia, dear reader. I’m here to join Aaron Stein at the Foreign Policy Research Institute this evening for a talk about my book.

I was quiet here and on social media over the weekend as the United States took the step of hitting three sets of targets across Fordow, Natanz, and Esfahan in Iran, drawing itself into th…

No One's Going to Use a Nuclear Weapon Against Fordow

Ankit Panda — Fri, 20 Jun 2025 18:00:38 GMT

The fate of the Fordow Fuel Enrichment Plant continues to draw interest more than a week now into the Israel-Iran war. There’s a story in the Guardian that offers the following tidbits on the sorts of military options the president of the United States (Donald Trump) has apparently been presented with:

The effectiveness of GBU-57s has been a topic of dee…

The President Should Not Be Posting

Ankit Panda — Tue, 17 Jun 2025 17:25:04 GMT

This will be a short one. I just want to commit to print some thoughts I have about how the U.S. president is choosing to engage in public communications during a major war between Israel and Iran. The impetus for this was a thread I did over on BlueSky last night, reacting to Trump’s post on Truth Social calling for a total evacuation of Tehran. You ca…

Ruminating on Operation Rising Lion

Ankit Panda — Sun, 15 Jun 2025 22:11:02 GMT

Note: I started writing this post on Friday evening, as Israel strike, but sat on things to wait for better information. This post should contain minimal information that is out-of-date, but apologies if so.

We are now three days into what appears to be the start of a major all-out war between Israel and Iran—a war fought primarily in the air, with fight…