A Simulated War Must Never Become A Real Military Order – Analysis

October 21, 2026

By Burak Oktenli

Key Takeaways:

The article warns that AI used to design and analyze war games can create a risk that fictional exercise events lose their labels and enter operational decision chains, potentially producing false but consistent reports that commanders treat as real.

Recent examples include a U.S. Army III Armored Corps AI planning experiment with British and Polish partners and NATO’s STEADFAST DUEL 2026, neither of which reported an AI-caused breach, yet the piece stresses that connected tools and lost provenance could allow exercise outputs to affect live systems.

It recommends making exercise-to-operations handoffs an explicit acceptance test through durable provenance, purpose-limited credentials that expire, and deliberate fault-injection trials, aligning with NATO’s revised AI strategy emphasis on traceability and governability.

As NATO and allied forces bring artificial intelligence into military planning, fictional reports and exercise-only permissions must never become operational authority by accident.

On November 9, 1979, American air-defense aircraft left their bases in response to an attack that did not exist. A recorded missile-attack scenario had mistakenly been transmitted beyond North American Aerospace Defense Command headquarters. According to a contemporaneous U.S. diplomatic account, built-in checks exposed the false warning in less than six minutes. The aircraft were recalled; none carried nuclear weapons, and no strategic nuclear unit advanced its alert status.

The simulated attack was fiction. The aircraft taking off were real. The safeguards that stopped the error from spreading were real, too.


That distinction has acquired new urgency as armed forces use artificial intelligence to design, populate and analyze war games. On October 20, the U.S. Army reported that its III Armored Corps had tested emerging AI tools in a multinational planning exercise with British and Polish partners. One day earlier, NATO reported the conclusion of STEADFAST DUEL 2026, a major simulated collective-defense exercise involving all 32 Allies and approximately 8,000 participants. The Army planning experiment and the NATO exercise were separate events; neither announcement reported an AI-caused breach of exercise boundaries.

NATO is also applying AI to exercise design. During a September scripting event, multinational personnel used an AI-enabled environment to develop and coordinate exercise material. In the Indo-Pacific, Australia has opened a Fleet Battle Lab capable of running extended virtual naval war games. These developments promise faster iteration and more demanding training. They also make one old question newly important: when does a fictional report acquire the status of a real military fact?

The most dangerous handoff is not inside the model

An AI system does not need to believe it is fighting a real war to affect one. The consequential issue is what the software treats as evidence, which systems receive its output and what people or tools are permitted to do next. A model may know that it is inside an exercise and still generate a recommendation that becomes dangerous when its simulation origin disappears downstream.

Imagine a fictional missile strike inserted into a multinational command-post exercise. One AI assistant summarizes the episode. A second turns the summary into a staff briefing. A third retrieves that briefing as background and proposes an urgent response. The exercise label is lost along the way. The receiving officer sees three apparently consistent products, although all derive from one invented event. This is a hypothetical failure chain, not an allegation about the exercises announced this month.

Several reports repeating the same story are not three independent confirmations. Before a simulation-derived assertion can enter an operational assessment, someone must establish whether its underlying event occurred outside the exercise. Human approval does not repair a fictional premise that nobody checked.

A more direct path runs through connected tools. The National Institute of Standards and Technology has documented how instructions encountered by AI agents can redirect the use of tools and surrounding applications. The implication for an exercise is conditional but serious: if a training agent has access to operational credentials, live messaging or equipment controls beyond its role, a mistake or manipulated input can leave the rehearsal environment. Writing “exercise only” in a prompt is no substitute for a restriction enforced by the systems that receive the request.

That does not mean war games must be air-gapped from every real system. Live exercises properly use real aircraft, ships, communications and logistics under approved rules. The key is to separate legitimate exercise effects from unauthorized operational consequences. Training tools may support a real unit without acquiring permission to issue that unit a real mission order.

A rehearsal is also visible to the adversary

There is a second boundary, beyond the participating alliance. During NATO’s 1983 Able Archer command-post exercise, Soviet forces took unusual readiness measures. A later U.S. intelligence review concluded that some Soviet leaders may have feared the exercise concealed preparations for an actual attack. The review acknowledged uncertainty about how deeply that concern extended. No AI system caused the episode; its lesson is that an exercise can be misinterpreted by actors who see its external signals but not its internal rules.

An AI-enabled planning system could complicate that problem if it accelerates the production of alerts, assessments and recommendations while obscuring their assumptions. An adversary might interpret an allied precaution as offensive preparation, respond, and have that response fed back into the next assessment. Such a sequence would still depend on real human and military decisions, not an imaginary machine deciding independently to start a war.

Research on AI players in diplomatic and military simulations deserves the same restraint. A peer-reviewed 2024 study observed escalation in simplified multi-agent war games, including occasional simulated nuclear use. In contrast, preliminary 2026 experiments found that AI players sometimes avoided war until the researchers changed a game objective. Neither result estimates the probability of an AI-caused conflict in the real world. Together, they show why the model, the game incentives and the human decision system must be evaluated as one arrangement.

Make exercise boundaries an acceptance test

The practical answer is not to abandon AI-assisted rehearsal. It is to make the passage from exercise to operations an explicit, tested interface. A fictional event should carry durable provenance through summaries, exports, retrieved records and exchanges between national systems. If a generated intelligence product loses its exercise origin, the operational workflow should not silently promote it into verified reporting.

A second requirement concerns credentials and effect. Training agents should use purpose-limited access that cannot authorize operational tasks by default. Where a real interface must participate in an exercise, the permission should name the specific approved effects, the authority responsible and the time at which that permission expires. Moving from rehearsal into operational use should require a separate decision, not a confident recommendation from the AI.

Finally, exercise directors should test whether these boundaries survive mistakes. Deliberately remove an exercise label, insert contradictory reports, replay a stale briefing and route a simulated order toward a protected operational service. Measure what was blocked, what reached a human, whether a downstream task continued after the initiating agent stopped, and how quickly control was recovered. The point is to test the handoff, not merely whether the model can explain what went wrong.


This is a realistic international standard. NATO’s revised AI strategy already emphasizes traceability, reliability, governability and interoperable testing. It does not prescribe the particular exercise-to-operations acceptance test proposed here. NATO and willing partners could add such a test to existing exercise certification and procurement practices without imposing one country’s operational doctrine on another.

The opposing argument is that too many controls will make exercises artificial and slow. The answer is to keep the simulation as challenging as possible while limiting what its outputs may authorize outside it. A convincing fictional enemy and unpredictable scenario are training assets. An untraceable fictional intelligence report in a live decision chain is not.

In 1979, the distinction held because verification defeated a false warning quickly enough to prevent further escalation. AI can make future rehearsals richer, faster and more adaptive. Their success should be measured in part by something less glamorous: whether the system can prove where the rehearsal ends.

A war game should test an alliance’s ability to manage escalation. It must never become the unrecognized cause of it.


About Burak Oktenli
Burak Oktenli holds an MBA and a Master of Professional Studies in Applied Intelligence from Georgetown University. His research addresses the governance of authority in autonomous and AI-enabled systems, and his writing has appeared at the Modern War Institute at West Point, RUSI, RealClearDefense, RealClearMarkets, and Geopolitical Monitor. He is the author of Authority Architectures for Autonomous Systems, a ten-volume series on how authority in autonomous systems is delegated, monitored and recovered, at authority-architecture.me
View all posts by Burak Oktenli →