Artificial Intelligence

NATO's Crossed Swords Adds AI Agents to Cyber Training

The NATO Cooperative Cyber Defence Centre of Excellence has kicked off its annual Crossed Swords exercise in Tallinn, introducing a dedicated track for AI agents and incorporating OpenAI’s cyber defense tooling.

Radwan AbdulhadiEditor and technology writer

Published: November 3, 2026 · Updated: November 3, 2026 · 3 min read

NATO's Crossed Swords Adds AI Agents to Cyber Training — Image: SecurityWeek

Launch of Crossed Swords 2026 in Tallinn

The NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE) officially kicked off Crossed Swords 2026 in Tallinn, Estonia, on Monday, with the execution phase scheduled to run through Friday. The international drill brings together more than 250 participants from over 40 countries, encompassing both NATO members and non-members. Personnel hail from national cyber forces and supporting units, including military cyber operators, threat hunters, and digital forensics experts.

At the command level, the exercise sharpens how staff direct both offensive and defensive cyber assets, while hands-on specialists hone their tactical skills. Furthermore, the cyber exercise is tied directly into a training event for special operations forces, emphasizing multi-domain cooperation and tactical alignment.

Synchronizing Cyber and Kinetic Operations

According to exercise leadership, synchronizing digital effects with physical operations remains a primary focus of the training curriculum. "The core operational challenge we are testing is synchronisation. Cyber effects must hit at the right moment to support a kinetic or special operations action – not in parallel, but in sequence, with timing measured in minutes, not hours," said Crossed Swords 2026 Exercise Director Jozef Kostelansky. He added that the operational complexity increases substantially because artificial intelligence is now actively involved on both sides.

For comparison on scale within the broader landscape, the CCDCOE's larger Locked Shields exercise involved more than 4,000 participants from 41 nations earlier in the year, highlighting the massive collaborative scale behind NATO-aligned cyber defense initiatives. For more details on that broader context, readers can look at the <a href="https://www.securityweek.com/locked-shields-2026-41-nations-strengthen-cyber-resilience-in-worlds-biggest-exercise/">Locked Shields exercise</a> coverage.

Integration of AI Agents and OpenAI Daybreak

A notable addition to this year's program is a dedicated track focusing on AI agents. Participants are tasked with building, deploying, and assessing these autonomous agents while operating side-by-side with them in real time. The exercise environment leverages locally hosted AI systems alongside, in a first for the program, <a href="https://www.securityweek.com/openai-pledges-1-billion-to-bring-frontier-ai-to-critical-infrastructure-defenders/">OpenAI’s Daybreak</a> cyber defense offering.

"By introducing AI agents into the operational workflow, Crossed Swords 2026 is directly addressing one of the most significant shifts in the modern cyber threat landscape," Kostelansky noted. He emphasized that the training aims to teach participants how to harness advanced artificial intelligence capabilities while preserving the essential human oversight required for complex, multi-domain mission success.

Civilian Partnerships and Critical Infrastructure

Beyond military units, the drill pairs national cyber forces with civilian partners to ensure that critical infrastructure protection is tightly woven into operational planning. More than 20 organizations representing industry, academic institutions, and non-governmental organizations are supporting the event by providing technical know-how, systems for targeting, and specialized tooling.

Among the supporting entities contributing to the environment are Bitdefender, ESET, Elastic, Mandiant, OpenAI, Stamus Networks, TryHackMe, and the International Committee of the Red Cross (ICRC). This collaboration reflects a broader industry trend toward strengthening systemic resilience against emerging, high-speed digital threats.

Evolution of the Crossed Swords Exercise

Crossed Swords originated from a red teaming workshop held in 2014 and has since evolved into a comprehensive program covering command-level training as well as combined cyber and kinetic operations. Participation metrics demonstrate steady growth, with numbers roughly doubling since 2022, when approximately 120 individuals from 24 countries took part.

The expansion underscores the growing importance of integrated cyber-military readiness among allied and partner nations as they navigate an increasingly complex and automated threat ecosystem.