Reading Superpowers and AGI: Bombing Data Centres Is an Old Idea, and It Is Not Disarmament

On 1 March 2026, Iranian Shahed drones struck two Amazon Web Services facilities in the United Arab Emirates, and a near miss in Bahrain damaged a third. Structural damage, power cut by the fire service, fires, and water from the suppression systems. Two of the three availability zones in the ME-CENTRAL-1 region went offline. Banking, payments, delivery and enterprise software across the Gulf went down or ran degraded. Two months later, on 30 April, AWS was still telling customers the region was “currently unable to reliably support customer applications” and advising them to restore from backups in other regions.

Somebody bombed data centres. It worked, for one specific definition of worked.

Last week the internet discovered the idea. A report published by the Center for a New American Security in August, Superpowers and AGI by Jacob Stokes, produced seventy-two hours of coverage announcing that a former Obama administration official wants the United States to bomb Chinese data centres. By the weekend a former editor of the Global Times was threatening missile strikes on the American mainland in reply.

Striking compute is neither hypothetical nor new. Acting on it requires an intelligence judgement nobody can make today, and against a model that already exists it destroys availability rather than capability. That is the argument I want to make. Stokes makes most of that case better than his critics do, and his report does not recommend bombing Chinese data centres.

Seventy-two hours from a conditional to a war plan

On Thursday 3 September, OpenAI released GPT-6 Astra. President Greg Brockman closed the launch briefing with the line “Welcome to the AGI era”, having told reporters he personally believes OpenAI has reached AGI. CNAS ran an online event the same day, at which Stokes said the Department of Defense and the National Security Agency should start assessing what intelligence would be needed to justify extreme measures.

On Friday 4 September the South China Morning Post published US urged to consider military strikes to stop China achieving AGI first. The body of that piece is reasonably careful: it says Stokes called for the US government to consider the feasibility of diplomatic, espionage, cyber and kinetic measures, which is close to what the report says. That qualification stayed in the body and never reached the coverage that followed.

Futurism picked it up from SCMP and added the claim that the report begins from the assumption that AGI is inevitable. The report says the opposite in plain words. It states that using the term AGI does not prejudge whether such a system will ever come to fruition, cites the writers who have called AGI a fever dream and a conspiracy theory as making compelling cases, and stipulates for the sake of analysis a system delivering roughly 60 to 70 percent of what the boosters claim. Futurism also gave Stokes a career at the Department of Homeland Security. His CNAS biography lists the White House national security staff of then-Vice President Biden, the US-China Economic and Security Review Commission, Senator Klobuchar’s office, the US Institute of Peace and the National Security Network. No DHS.

Aggregators then copied Futurism. By Saturday the framing had reached a former Obama official with a brilliant idea to flatten the competition.

Then it stopped being a media story. Hu Xijin, former editor-in-chief of the state-backed Global Times, wrote on X that if the United States struck China’s data centres, retaliation “would directly target the U.S. mainland with missile strikes”. The Global Times itself ran an editorial calling the proposal a dangerous delusion and evidence that technology containment of China has slipped from a contest over rules into “fantasies of force”, noting how close CNAS is to official Washington. Donald Trump and Xi Jinping are scheduled to meet in Washington on 24 September with AI governance on the agenda.

That is a real escalation produced by a misreading, three weeks before a summit.

The American criticism was not much better calibrated. William Hartung of the Project on Government Oversight told SCMP that strikes on Chinese data centres would risk starting a shooting war between two nuclear-armed powers, and called the idea reckless in the extreme. He is right about the escalation risk and wrong about why the strike option fails. Unthinkability is not the objection. Somebody did it six months ago.

For anyone running a security function, the transferable lesson has nothing to do with China. A threat model assembled from headlines inherits every mistake made upstream of them, in this case a Homeland Security career Stokes never had and an assumption the report explicitly declines to make. Nobody’s aggregation pass makes a claim more conditional.

What the report actually says

I read the report rather than the coverage of it, and the two do not describe the same document.

The quoted sentence argues against AGI superweapons

The sentence everyone quoted is “Data centers can be bombed with conventional munitions.” It appears in the section on new military capabilities, inside an argument that AGI-enabled weapons would not be superweapons. Stokes’ point there is that AGI weapons remain subject to the same forces that shape the balance with existing technology, including the fact that any military capability can be attacked physically by older and simpler means. He puts it alongside the observation that military technology is a perpetual contest of measures and countermeasures. It is a deflationary claim about the limits of AGI military power, and it was reported as a proposal.

Three further inversions each reverse what the report says.

The coverage says the report assumes AGI is inevitable. The report declines to prejudge it and stipulates a partial version for the sake of argument.

The coverage frames the United States as the prospective attacker. The report says that given the current US lead in frontier models, China is the more likely one.

Bombing is not among the nine recommendations. The relevant recommendation is to run a scenario exercise testing when and how the United States might intervene to stop China from developing AGI, and to build the intelligence capability that would inform such a decision. A tabletop exercise is not a target list.

In fairness to the outlets that got it wrong, the kinetic passage is genuinely there. Stokes writes that a surprise Chinese breakthrough could force Washington to consider preventive action, and he works through what attacking would involve. The outlets changed the report’s emphasis and its framing. But anyone who formed a view of this debate from what was written about it in the last week has it backwards, and the coverage supplies the wrong reason for rejecting the strike option.

The five mechanisms nobody quoted

Almost all of the report argues the limits of AGI as an instrument of state power, and those pages are more useful to a security reader than the paragraph that made the news.

The central claim is deflationary throughout. Either state building AGI would not automatically convert that into geopolitical dominance. Capability has to be applied to specific valuable tasks at costs that beat the alternatives, and that step can fail. Stokes builds five mechanisms through which AGI might move the balance of power: economic growth and productive capacity, influence over the global information environment, new military capabilities, large-scale misalignment or loss of control, and downstream political effects at home. He then argues the limits of each. Information control with AGI tools would be partial rather than omnipresent, because information still moves on hard copy, local storage and word of mouth. AGI weapons offer little advantage in pure destructive power, because nuclear states can already threaten obliteration in minutes, so any advantage would have to come from speed, coordination or target discrimination and would have to be demonstrated under realistic combat conditions. Stokes applies the same limit to the economic mechanism, because growth on that scale still requires resources, electricity, water and land.

The misalignment mechanism is the one a security audience should read. Stokes treats an AGI system that starts taking actions its operators did not intend as a net-negative outcome for both Washington and Beijing. He cites the 2026 International AI Safety Report’s taxonomy of failure modes: hallucination, reasoning, out-of-distribution, tool use and multi-agent coordination. Shared exposure of that kind, he argues, should create an incentive to coordinate. He is then honest about why it will not: both governments have a competing incentive to capitalise on incidents blamed on the other, which he offers as the explanation for how sparse bilateral cooperation on AI safety has been. That is a better analysis of the alignment-versus-competition problem than most of what gets published under the heading of AI alignment. It appeared in a report the press covered as a bombing proposal.

Stokes sets out four phases: both states pursuing AGI, one on the cusp, one in possession while the other is not, and finally both. Bombing appears in the second phase, as the last and most dangerous of several options available to a state that believes it is behind, after speeding up its own programme, ceding the lead and racing to apply the technology better, theft, and cyber sabotage. Stokes then adds a fifth possibility that undercuts the whole structure: the phases could blur together, AGI’s definition could stay contested, and an AGI transition could feel less like a sudden tsunami and more like technological climate change. A report that ends by suggesting its own phase model may not describe reality is not a war plan.

The idea is five years old

Two lines of argument precede the report, one running from 2021 in the strategic literature and the other from October 2022 in US export policy.

From fabs to compute

The first line starts with semiconductors. In late 2021, Jared McKinney and Peter Harris published Broken Nest: Deterring China from Invading Taiwan in Parameters, the US Army War College quarterly. Their proposal was that Taiwan and Washington should plan to destroy TSMC’s fabrication plants in the event of an invasion, making the island expensive to hold rather than valuable to take. It has been among the War College’s most downloaded papers since. McKinney and Harris put the technology asset at risk instead of the state that owns it, and every later version does the same.

On 29 March 2023, Eliezer Yudkowsky moved that logic from fabs onto compute in TIME. Arguing that the six-month training pause proposed that week asked for too little, he set out an enforcement regime: shut down large GPU clusters, cap training compute and ratchet the cap downward, track all GPUs sold, and if a country outside the agreement builds a cluster, “be willing to destroy a rogue datacenter by airstrike”. His version is not the one now circulating. Yudkowsky framed it as multinational treaty enforcement against anyone, explicitly including governments and militaries, and dismissed arms-race framing entirely.

In March 2025, Dan Hendrycks, Eric Schmidt and Alexandr Wang published Superintelligence Strategy, introducing Mutual Assured AI Malfunction. Where Yudkowsky proposed enforcement among cooperating states, MAIM describes deterrence between rivals: a state making an aggressive bid for unilateral AI dominance is met with preventive sabotage. The paper sets out a ladder. Espionage first, then covert sabotage by insiders tampering with weights, training data or chip fabrication, then hackers quietly degrading a training run so the finished model underperforms, with Stuxnet as the stated analogy, and kinetic strikes on data centres at the top.

Two things about that ladder get lost when it is summarised as a bombing proposal. The authors’ stronger claim is that MAIM already describes the situation the AI powers are in rather than proposing a new one. And they describe kinetic strikes as “likely unnecessary”. The people who built the escalation ladder put munitions at the top of it and said you probably do not need to go there.

Others made this case before I did. Authors at RAND answered within weeks that MAIM is not a feasible deterrent in practice. The Machine Intelligence Research Institute followed on 11 April 2025 with an analysis of unmonitorable red lines, questionable threat credibility and a volatile deterrence calculus. Hendrycks replied with Adam Khoja on 22 September 2025, in a publication he edits and which the Center for AI Safety funds. The Institute for AI Policy and Strategy published a review of the whole exchange in December 2025. Three rounds of serious argument, eight months before the report that made the news.

Export controls, running since October 2022

The non-kinetic version of the same policy has been running since 7 October 2022, when the United States imposed comprehensive controls on advanced semiconductor exports to China. That instrument has been in flux ever since, and the current state matters for anyone citing it.

BIS announced in May 2025 that it would rescind the AI Diffusion Framework and instructed enforcement officials to stop applying it. As of this writing the formal Federal Register notice removing it has still not been published. The text remains in the Code of Federal Regulations, unenforced. Lawyers who work on this call it a zombie rule.

The non-enforcement is narrower than that shorthand suggests. In guidance dated 31 May 2026, BIS confirmed that a licence requirement first imposed on 17 November 2023 still applies to advanced computing items destined for entities headquartered in Country Group D:5 or Macau, or whose ultimate parent is, even where those entities are located outside either. What is unenforced is the Diffusion Rule’s newer destination-based layer, and only where the recipient is not one of those entities.

The final rule BIS filed on 13 January 2026, published and effective on 15 January, moved NVIDIA H200 and AMD MI325X class chips from presumption of denial to case-by-case review for exports from the United States to end users in China and Macau, subject to nine certifications including third-party lab testing before every shipment. The threshold is a total processing performance under 21,000 and total DRAM bandwidth under 6,500 GB/s. Parts above it, Blackwell class among them, stay under presumption of denial, as does any re-export or in-country transfer regardless of performance. The White House announced a 25 percent Section 232 tariff on the same performance class on 14 January.

In late August, Commerce was reported to be drafting a rule to stop Chinese firms renting Nvidia compute through servers in Thailand and Singapore, and export lawyers doubt the statutory authority exists to enforce it. The January certifications reach part of the same problem from the exporter’s side: an applicant has to list Infrastructure-as-a-Service remote end users in China, Macau, Russia, Iran, North Korea, Belarus, Cuba and Venezuela, or entities headquartered there.

Headline restrictions loosened, enforcement continued, and the framework is being rebuilt around holes it created. Stokes recommends keeping the controls, tightening them where possible, and restoring them where they have lapsed. That last clause concedes the loosening of the last eighteen months.

Anyone presenting the strike question as a new frontier is arriving late to an argument that has already been through three rounds of peer criticism and one full policy cycle of its non-violent equivalent.

Nobody can tell you when to act

Stokes spends more of the kinetic passage on why you could not do it than on how, and this is the strongest thing in the report.

The comparison he draws is nuclear. Monitoring a nuclear programme means watching a short list of observable stages: fissile material production, specialised centrifuges, weaponisation, and delivery systems including missiles, submarines and bomber aircraft. Warhead and delivery tests are close to impossible to conceal from modern surveillance and cannot easily be passed off as civilian activity. States built an analytic apparatus on that, including the concept of breakout time, which in nonproliferation practice means how long a rival needs to produce enough weapons-grade fissile material for one device. Weaponisation and delivery run on separate clocks.

AI monitoring has none of those properties. AI inputs are ubiquitous and in constant use, and more of that use is civilian than military. There is no established breakout-time framework for AGI, and there cannot yet be a good one, because nobody knows which inputs and thresholds matter. Stokes’ analogy for the position is exact: it is like hypothesising that nuclear weapons need fissile material set off by an explosive device, without knowing the enrichment level required or the design of the device.

The consequence is the part that should worry people. A state with high confidence in its assessment can afford to wait and strike preemptively, just before a rival crosses. A state with low confidence is pushed towards a preventive strike, meaning earlier, while the threat is still gathering but not imminent. Since nobody can have high confidence, a state weighing this decision has an incentive to strike sooner on worse information. That arrangement is not stable, and the same incentive was one of the pressures behind the 2003 Iraq intelligence failure. The object being assessed here is less observable than centrifuges.

The historical record is more mixed than either side of this argument usually allows. Stokes notes that the United States considered bombing both the Soviet Union and China to prevent them developing nuclear weapons and concluded in both cases that the risk of escalation to general war outweighed the benefit, and that it later invaded Iraq and struck Iran over their programmes. I have not independently verified the first pair and am reporting his account rather than asserting it myself. Those four cases are less alike than one pattern would suggest and I would not draw a rule from them. What they establish, on his account, is that the United States has faced this decision repeatedly and answered it both ways. China is not Iraq, and the AGI case is a peer case.

Timing defeats the strike option before any of the technical arguments below are needed.

What a strike destroys, in three parts

Three things happen inside a data centre and they have completely different destruction properties. Collapsing them into “the model” is what makes the strike argument sound stronger than it is.

Accelerators and active training state

These are genuinely destroyed. Kill the cluster mid-run and the run stops. The compute is gone, and recovery depends entirely on where the checkpoints were written and whether they left the site. Against active training state, a strike does what its advocates claim. It works inside a narrow window, after a run has started and before its output has been replicated. The strike also has to catch enough of the necessary capacity in one place to be decisive.

Serving capacity

Serving capacity is destroyed locally and restored elsewhere, more easily than training but not for free. Independent user requests route among regional replicas, which is why inference disperses geographically far better than training does. A single large request may still depend on tensor or pipeline parallelism across tightly coupled nodes, and cross-region serving carries latency, capacity, state and data-residency costs.

An existing set of weights

Weights are not destroyed at all, once independent copies exist elsewhere, whether as backups, regional deployment artefacts, partner holdings or deliberate public release. That is not automatic. A high-security design can deliberately minimise copies, hold replicas encrypted and materialise plaintext only inside attested hardware. But the default posture at most organisations produces copies, and open-weight release puts them everywhere by design.

Organising by objective rather than by target

Destroying a serving site or a training cluster leaves replicated weights and finished models untouched.

It does destroy what comes next, and this is where I would resist the glib version of my own argument. Training capacity is what you need to continue an interrupted run, and to do post-training and reinforcement learning. You need it again to retrain after a defect, to distil, to adapt, and to build the successor model. Destroying the infrastructure that trained a model does not destroy a model whose weights have been replicated. It destroys the capacity to produce the next one. Whether that is decisive depends entirely on whether the thing you fear already exists.

The two objectives are compute denial and model erasure. Compute denial works before and during training and keeps working afterwards against serving and successor capacity. Model erasure gets harder with every copy made and becomes impossible once independent copies exist outside the target. The narrow window belongs only to erasure: after a run starts, before the checkpoint propagates. That window is also the hardest thing to observe from outside, which returns you to the intelligence problem the authors of these proposals cannot solve. You would need to know a run had started, know it mattered, and act before completion, using dual-use accelerators that are commercially deployed everywhere and constantly in use.

Weights are the object, and RAND said so in 2024

The security discipline that answers this question already exists, and the kinetic-strategy writing has largely not engaged with it.

Securing AI Model Weights, published in May 2024 by Sella Nevo, Dan Lahav, Ajay Karpur, Yogev Bar-On, Henry Alexander Bradley and Jeff Alstott, identifies 38 distinct attack vectors against model weights and maps them against five categories of attacker operational capacity, from opportunistic criminals up to top-priority nation-state operations. It defines five security levels, SL1 to SL5, with benchmark controls for each.

Weights are the output of everything expensive about building a frontier model: the compute, the data collection, the years of research. An attacker who obtains them bypasses most of those sunk prerequisites and can operate the model outside the owner’s access controls, provided they can reconstruct the architecture and supply enough inference compute. RAND’s description of frontier weights is that they reach terabytes of storage, which is the relevant property. Llama 3.1 405B in 16-bit precision is roughly 810 gigabytes, and larger mixture-of-experts checkpoints run past a terabyte. Sharded across files, encrypted or quantised, it remains something a network can move.

That ladder has moved into the labs’ own safety documents. Google DeepMind’s Frontier Safety Framework 3.1, published 17 April 2026, sets its model-weight security levels in line with RAND’s, and is explicit that it means RAND’s goals and principles rather than its concrete benchmarks. It recommends Security Level 3 for a model that has measurably accelerated AI development, and Security Level 4 for one that could automate the work of a Google research team.

Anthropic’s June 2025 work with Pattern Labs on confidential inference is written against SL4 and SL5 directly, which reflects continuity rather than adoption: Dan Lahav of Pattern Labs, later Irregular, co-wrote the RAND report. Sella Nevo has since proposed a national security sprint aimed explicitly at reaching SL5.

AI model weight security is a named discipline with benchmarks attached, and the strategic writing about strikes is still targeting the factory.

The United States already has an export control on model weights. The AI Diffusion Framework created ECCN 4E091, which makes that control part of the zombie rule described above: a codified obligation sitting alongside an agency policy of not enforcing it.

A second instrument reaches weights from another direction. The January 2026 certifications require an exporter to verify that the consignee will not transfer model weights trained on the exported chips to any end user not disclosed on the licence without BIS authorisation, and will not give a prohibited party remote access to any algorithm trained on them.

Washington regulated the artefact eighteen months before the debate about bombing the buildings reached the front pages, in one instrument it then left in limbo and one it attached to the chips. That is a more consequential fact about American compute policy than anything in last week’s coverage.

This site has covered model extraction as an attack and the wider attack taxonomy for years. What changes at national scale is the adversary’s budget, not the mechanism.

Where the nuclear analogy breaks

Counterproliferation runs through every version of this argument, and the comparison is good for most of its length.

Both kinds of programme depend on expensive production infrastructure that can be attacked physically. Enrichment and training diverge after production. Enrichment produces conserved physical material, so doubling a stockpile means processing twice as much of it. Training produces information. A second complete instance costs a network transfer, and no munition undoes one that already happened.

I resist two claims that usually travel with this analogy. Highly enriched uranium is not conveniently bulky or conspicuous: the IAEA’s significant quantity for it is 25 kilograms of contained uranium-235, and its weak radiation signature is precisely why passive detection is difficult. And the strategic record of striking production facilities is more contested than it is usually presented, with a real scholarly argument that the 1981 Osirak raid drove Iraq’s programme underground rather than ending it. The digital-versus-physical distinction stands without either claim.

Verification is the separate problem, and inspectors face a harder version of it here. At declared safeguarded sites, inspectors can account for material and equipment against established physical signatures, though clandestine facilities remain a hard intelligence problem there too. Frontier AI is harder to separate by purpose. The same accelerator classes train models, serve them, render films and run scientific computing. The decisive variable is which software is executing, and that is not visible from orbit.

The concentration assumption, checked

Every version of the strike argument depends on the target being large, identifiable and singular. That assumption is true today at the frontier and it is weakening, and both halves have to be held at once.

The half that favours the strike advocates

OpenAI said GPT-6 Astra came out of its largest training run to date, using more than 100,000 GPUs at the Stargate site in Texas. That is one building complex, in one state, running the training that produced the model whose launch triggered last week’s news cycle. If concentrated frontier compute is a legitimate military target, the largest publicly disclosed concentration of frontier compute is in west Texas rather than in China. Nobody covering this argument last week noticed that the logic points home first.

The half that does not

On 23 April 2026 Google DeepMind published Decoupled DiLoCo. It reports two sets of numbers, and they come from different experiments. In simulated runs across eight datacentres, the method needed 0.84 Gbps of inter-site bandwidth where conventional data-parallel training needed roughly 198 Gbps, and it held 88 percent goodput under high rates of hardware failure where data-parallel managed 27 percent.

In a real deployment, DeepMind trained a 12-billion-parameter model across four separate US regions on 2 to 5 Gbps of wide-area networking, more than twenty times faster than conventional synchronisation methods. Chaos-engineering tests continued training after entire learner units were lost and reintegrated them when they came back online.

Several conditions limit what those numbers show. The bandwidth and goodput figures come from simulation. The run that actually happened across regions is 12 billion parameters, which is not a frontier training budget. The low-communication line that would work over ordinary connectivity tops out publicly around there. DeepMind’s own framing is that the architecture can put unused compute to work wherever it already exists and turn stranded resources into useful capacity. That is a claim about reaching more compute and says nothing about retiring purpose-built clusters.

NVIDIA’s Nemotron-4 340B run across two sites 1,000 kilometres apart at over 96 percent of single-site throughput is closest on scale and furthest from ordinary connectivity, because it used premium long-haul fibre and made conventional synchronisation work rather than avoiding it.

Two approaches are converging on the same destination from opposite directions and neither has arrived. I set out the full ladder elsewhere, including where the published evidence stops. Reading it as an accomplished fact is an error, and so is dismissing it.

For the strike argument the consequence is specific. A targeting strategy built on today’s concentration works, and has to assume its own success would accelerate dispersal of the target. Critics of MAIM identified that within weeks of publication. It also worsens the intelligence problem: a monitoring regime built to find one very large building would have to aggregate evidence across sites instead, and the inference from a large power draw to a single training run degrades as the run spreads.

Denial is not disarmament

March 2026 disproves the glib version of my argument, and I want to state what it actually established.

No public reporting establishes what model artefacts were in those AWS buildings or whether every copy survived, and I am not going to assert that none was lost. The IRGC said the facilities supported the enemy’s military and intelligence work. Amazon declined to comment on the claim, and researchers at Just Security noted that US law generally requires government and military data to be held in the United States or on Department of Defense premises, which raises real doubt about the premise. Michael Schmitt published a legal analysis in Just Security on 12 March working through the customary targeting rules reflected in Additional Protocol I, and the questions there are not comfortably settled.

What the incident does demonstrate is narrower and sufficient. Destroying cloud infrastructure produces prolonged denial of service. Two months after the strikes AWS was still advising customers to migrate what they could reach and restore the remainder from backups elsewhere, with 37 services listed as disrupted and billing suspended in both regions. That is a real military effect, achieved with conventional munitions, requiring none of the verification the strategic literature struggles with.

It is also a completely different objective from removing a capability from the world, and people conflate the two constantly.

If someone destroys the facilities serving a model, the model still exists and nobody can use it for as long as the outage lasts. For a wartime adversary that may be entirely sufficient. Denying a rival the use of its AI for a week during a crisis is a real objective. Against training infrastructure before a capability is complete, a strike can still work as counterproliferation by delay, which is what counterproliferation usually means in practice. Against an already-replicated checkpoint, striking the infrastructure that serves it looks much more like wartime denial than like disarmament.

Denial of use belongs in the same category as attacking power stations or communications: temporarily degrade what an adversary can do inside a conflict you are already in. Whatever Iran intended, that is what the March strikes achieved.

Presenting a wartime denial capability as a nonproliferation instrument is how you arrive at a preventive strike doctrine aimed partly at an objective it cannot reach, justified by an intelligence judgement outsiders may be unable to make with sufficient confidence.

And for an already-published open-weight model, the erasure objective is void by construction. Once the checkpoint is broadly mirrored, no facility on earth is a unique point of destruction. Compute for successor models, serving infrastructure and fine-tuning capacity all remain attackable. The mirrored checkpoint stays where it is.

What is actually in your control

Nothing above changes what a defender does on Monday, and none of it was meant to. State targeting decisions are outside an enterprise security team’s control, and a piece that pretends otherwise is selling something. Five things are in scope.

Availability-zone separation is a hedge against uncorrelated failure and was never a hedge against an adversary selecting aim points. The AWS architecture absorbed the first strike exactly as designed, and failed when a second physical event arrived in the same region hours later. Under an independence assumption, losing two specified zones is a probability small enough to design around. Once the same adversary selects both targets, that number stops meaning anything, and nobody sends you an alert when it does. Write the qualifier into your resilience documentation before someone else writes it for you. Then run one exercise with an adversary in it rather than a random instance kill.

If the objective is preventing another actor from obtaining a closed model, the decisive control is weight security before replication rather than physical protection of the building. That means the RAND ladder taken seriously: insider threat programmes, hardware-backed access controls, confidential computing at the higher levels, and egress monitoring sized to notice terabytes leaving. It also means an honest assessment of which category of attacker operational capacity you are defending against. It answers that one objective. It does nothing about clusters that have been destroyed or about a model already published. My own impression, which I have not measured, is that most organisations running near-frontier models operate two levels below what their security documentation implies.

The dispersal-versus-concentration trade-off is usually stated too crudely. RAND is right that an attacker who reaches a weaker copy has bypassed the primary site and can use most of the 38 vectors regardless of how good your best facility is. But the security variable is how many paths can produce usable plaintext weights, and how well each one is controlled. Encrypted replication across independent failure domains, with materialisation confined to attested hardware and tightly held keys, buys resilience without multiplying the trust domains an attacker can work on. That is harder to build than either extreme and it is the only version that gets you both.

Decide explicitly whether theft or unavailability is the failure you cannot accept. A model whose exfiltration would be a national security event and whose week-long outage would be an inconvenience is a different engineering problem from one people depend on daily where theft is a commercial loss. Skip that decision and you end up in the middle, which is the one position that is weak against both.

Read the force majeure clause. The AWS Customer Agreement defines war as a force majeure event and the service level agreements exclude force-majeure unavailability from the service commitment. Amazon waived usage charges for both affected regions, which is a commercial gesture rather than SLA performance. The SLA produced no service credit for a war-related regional failure, and restoring workloads elsewhere stayed the customer’s job.

Three of the five cost nothing but a decision. Weight security at the higher RAND levels and encrypted replication across independent failure domains cost real money. All five are rarely done because correlated physical risk is nobody’s job. Infrastructure teams own uptime against the failures they have seen, security teams own the software attack surface, and business continuity owns a document nobody has tested against a scenario this specific. That gap is the same one that leaves physical consequences of AI failure unowned in most organisations.

What would have to be true

Everything above is easier to argue about than to settle, so here is the version that can be checked. Five conditions have to hold together for a preventive strike on compute to achieve what its advocates want. Four of them cannot be established today, for four different reasons. Only concentration currently favours the strike case, and it is the condition changing fastest.

You would have to know a decisive training run had started. No breakout-time framework exists for AI, and nobody has published a credible candidate. The nuclear equivalent took decades of inspection practice and a short list of necessary physical inputs to build. Frontier training runs on accelerators that are commercially deployed in every major economy and in constant use for other things.

You would have to know the run would cross a decisive threshold. Which capability thresholds are strategically decisive is unknown, and the industry cannot agree on what would count as arriving. OpenAI’s president said last week that he personally believes his company has reached AGI. ARC Prize, which ran the benchmark behind Astra’s headline score, says it is not claiming the system is AGI, and reports the same model at 62.7 percent under its own provider-neutral test setup and 99.9 percent under OpenAI’s provider adapter. An intelligence community asked to certify that a rival had crossed a line would have to define the line first, on numbers that move 37 points with the test scaffolding.

The capacity would have to be concentrated enough for a strike to be decisive. True today at the frontier, on the evidence of a hundred thousand GPUs at one Texas site. Weakening, on the evidence of Decoupled DiLoCo. This is the only one of the five that is an engineering fact rather than a judgement, and it is the one moving fastest.

The output would have to not have been replicated yet. This is the narrowest window and the least observable. Checkpoint propagation is a network event inside someone else’s estate, and no publicly known national technical means detects it.

The escalation would have to be survivable. This is where the public argument concentrates and it is the least tractable, because the answer depends on a rival’s response to an act with no precedent between peer nuclear powers. Hu Xijin’s reply to a misreading is not evidence about what Beijing would do, and treating it as such would repeat the error in reverse.

Three of the five are intelligence problems and one is a political judgement nobody can make in advance. The remaining one is an engineering fact that is changing against the strike advocates. And the reward for getting all five right is delay rather than disarmament, unless the run in question has not yet produced a checkpoint that left the building.

That is the case against, and it does not require believing that bombing is unthinkable.

Two reasons to reject the strike option

Destroying strategic technology infrastructure was proposed for Taiwan’s fabs in 2021 and moved onto AI compute in March 2023. Hendrycks, Schmidt and Wang formalised it as MAIM in March 2025, and RAND, MIRI and IAPS have published three rounds of criticism since. MAIM’s authors put munitions at the top of their own ladder and said you probably do not need them. The coverage is five days old and reversed the report it was based on.

Two reasons to reject the strike option survive the noise. No breakout-time framework exists to time the strike, and no publicly known national technical means detects whether the output was replicated first. A finished model exists wherever its weights were copied, and the buildings are a target only if delay is the objective.

Delay is a real military objective. It is not disarmament.