A NATO-accredited cybersecurity center has introduced artificial intelligence (AI) agents into Crossed Swords 2026, a major international cyber warfare training exercise taking place in Tallinn, Estonia. The exercise brings together military cyber specialists and security experts from different countries to practice simulated cyber operations, test AI-powered tools, and improve coordination between digital and military activities. The new AI-agent training focuses on helping specialists understand how automated systems can support cyber operations while keeping human supervision central to important decisions.
The Crossed Swords 2026 exercise began on November 2, 2026, and runs through November 6 in Tallinn, Estonia. The exercise is organized by the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE), a NATO-accredited training and research center that operates outside NATO’s formal command structure. More than 250 participants from over 40 NATO and non-NATO countries are taking part, including military cyber operators, security specialists, and other professionals involved in cyber operations.
One of the biggest changes this year is the introduction of AI agents into cyber warfare training. Unlike simple automation that follows fixed rules, AI agents can plan tasks, use tools, and take actions with limited human help, although their level of autonomy depends on how they are designed and controlled. These capabilities could help cybersecurity teams work faster when dealing with complex digital threats.
Crossed Swords 2026 includes a new training program focused specifically on AI agents in cyber operations. Participants are designing, developing, deploying, and evaluating these agents within simulated military cybersecurity environments. Rather than simply observing automated tools, specialists work alongside AI systems to understand their capabilities and limitations. This training could help cyber teams assess where AI can assist with technical tasks and where human judgment remains necessary.
The exercise’s technical environment includes locally hosted AI systems and OpenAI Daybreak, which is being used in Crossed Swords for the first time. These tools form part of the simulated training environment where participants can work with AI-powered capabilities. However, the official announcement does not provide detailed technical specifications for Daybreak or explain exactly which tasks it performs during the exercise.
Another major focus of Crossed Swords 2026 is coordinating simulated cyber operations with physical military activities. The training is connected to a special operations forces exercise, allowing participants to practice how digital actions can support wider military missions. Exercise director Jozef Kostelansky has emphasized the importance of timing, explaining that cyber effects must be coordinated with other actions within minutes rather than hours. This helps specialists understand why successful cyber operations depend on planning, communication, and coordination across different military teams.
Participants include military cyber operators, digital forensic analysts, threat hunters, and other security specialists. These experts are practicing both offensive and defensive cybersecurity activities in simulated situations. Their training focuses on identifying weaknesses, responding to digital threats, and coordinating actions with other teams.
The exercise organizers are also emphasizing the importance of human supervision when using AI agents. Although AI can process large amounts of information and assist with technical tasks, people remain responsible for important decisions. This approach is intended to reduce mistakes and ensure that AI systems operate within the objectives of the exercise. TechBonafide has also explored why AI-powered cyber defenses still need human oversight, particularly when automated systems are used to respond to increasingly sophisticated threats.
The training also includes cooperation between military cybersecurity teams and civilian organizations. Protecting critical infrastructure, such as electricity networks, communication systems, and essential services, is an important part of cybersecurity planning. By working together, participants can improve their understanding of how cyber incidents might affect both military activities and everyday life. This concern is especially relevant as governments examine AI-powered ransomware threats to critical infrastructure, including electricity networks, communication systems, and other essential services.
More than 20 organizations from technology companies, academic institutions, and other groups are supporting Crossed Swords 2026. Partners include cybersecurity companies such as Bitdefender, ESET, Mandiant, and other technology specialists. Their involvement helps create realistic training environments and gives participants access to different technical skills and tools.
Crossed Swords has been held annually since 2014 and has developed into an international cybersecurity training exercise. NATO Allied Command Transformation’s 2026 overview of NATO cyber exercises describes how Crossed Swords connects operational planners with technical cyber teams to support wider military planning. The addition of AI-agent training gives participants another capability to assess in simulated operations as military cybersecurity practices evolve.
The exercise does not mean NATO has handed control of real military cyber operations to autonomous AI systems. Instead, it provides a controlled environment where experts can study how AI agents behave, identify potential problems, and learn how to use them responsibly.
Crossed Swords 2026 shows how AI agents are becoming part of advanced cybersecurity training, particularly in military environments where speed, coordination, and accuracy are important. By allowing specialists to build, test, and supervise AI systems during simulated operations, the exercise could provide useful lessons for future cyber defense planning. The main focus remains on combining automated capabilities with trained human operators rather than replacing people with fully autonomous systems.
