NATO’s Crossed Swords Exercise Brings AI Agents Into Cyber Operations Training

The NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE) kicked off Crossed Swords 2026 in Tallinn, Estonia, on Monday, with the exercise’s execution phase set to run through Friday. 

More than 250 people from over 40 countries, both NATO members and non-members, are practicing how to plan cyber operations and time them with kinetic military action.

Participants come from national cyber forces and the units supporting them, including military cyber operators, threat hunters, and digital forensics experts. At the command level, the drill sharpens how staff direct both offensive and defensive cyber assets, while hands-on specialists hone their tactical skills. The cyber exercise is also tied into a training event for special operations forces.

“The core operational challenge we are testing is synchronisation. Cyber effects must hit at the right moment to support a kinetic or special operations action – not in parallel, but in sequence, with timing measured in minutes, not hours. This year, that gets harder, because AI is now in the loop on both sides,” said Crossed Swords 2026 Exercise Director Jozef Kostelansky.

New this year is a dedicated track on AI agents, in which participants build, deploy and assess agents and operate side by side with them. The exercise environment runs on locally hosted AI and, in a first for Crossed Swords, also uses OpenAI’s Daybreak cyber defense offering. 

“By introducing AI agents into the operational workflow, Crossed Swords 2026 is directly addressing one of the most significant shifts in the modern cyber threat landscape. We are training our participants to harness the power of AI while maintaining the critical human oversight required for complex, multi-domain mission success,” Kostelansky said.

The drill also pairs national cyber forces with civilian partners so that critical infrastructure protection is built into their plans. Over 20 organizations from industry, academia and the NGO sector support the event with know-how, systems to target and specialized tooling. Among them are Bitdefender, ESET, Elastic, Mandiant, OpenAI, Stamus Networks, TryHackMe, and the International Committee of the Red Cross (ICRC).

Crossed Swords traces its roots to a 2014 red teaming workshop and has since expanded to include command-level training and combined cyber and kinetic operations. Participation has roughly doubled since 2022, when around 120 people from 24 countries took part, and last year’s edition had 240 participants from about 40 nations.

The CCDCOE’s larger Locked Shields exercise involved more than 4,000 participants from 41 nations in 2026.