A rival or foreign state sabotages a lab's training run

Where things stand (as of 16 Oct 2026)

I found no qualifying publication since the 16 Sep 2026 opening date, and no publicly confirmed precedent at any time. All of the following have to be shown together: a covered victim, an actual training run, a real effect, intent to interfere, and the actor acting for a rival or a foreign state. The nearest real cases each fail at least one of these:

• ByteDance intern Tian Keyu (2024). He tampered with PyTorch code and weights and killed training jobs. The motive was a fight over compute between teams inside ByteDance, which the question excludes. The civil appeal is still running, and an Oct 2026 podcast reopened the dispute (Vocal, Oct 2026).
• Beijing "first AI model sabotage" conviction. An engineer deleted 89 TB of data and halted training, but for personal reasons, and the employer is not a covered developer (BigGo, 2026).
• OpenAI bugging case. On 13 Oct 2026 the Justice Department charged a Saudi national who worked at OpenAI with planting a recording device in an executive meeting room. That is espionage, not interference with training (DOJ, 13 Oct 2026).
• Copying of US models by Chinese labs ("distillation"). The joint NSA/FBI/CISA advisory (NSA, 8 Sep 2026) describes theft, which is excluded. Anthropic's defences only blocked or weakened the copying; Zhipu "gave up" on Fable (Anthropic, 12 Oct 2026; Sep 2026 report). Anthropic dropped its hidden degradation of Fable 5 in June (WIRED).
• "LLM grooming" (flooding the web so models absorb propaganda). Official warnings are generic and none show the material was actually used in a named developer's training: China's Ministry of State Security in Apr 2026 and Jul 2026, and the EU's EUvsDisinfo, Oct 2025. Drop Site's finding that an Israeli-funded network got into training data is press reporting, so it does not count (Jul 2026).

Reference class and base rate

There have been zero qualifying confirmations in about four years of frontier AI work across ten labs. The broader analogue is a state sabotaging a strategic technology programme and the victim government confirming it publicly, as with Stuxnet and the Natanz sabotage. That happens roughly once a decade in the highest-stakes races. Both point to an annual hazard of about 1–2%.

Why the hazard rises over time

• Higher stakes. Washington now calls this a "super intelligence race" with FBI counterintelligence priority. The CIA has publicly called Chinese AI firms legitimate espionage targets (NYT, Sep 2026).
• Iran. Iran struck AWS data centres in the Gulf, threatened OpenAI's Stargate UAE site, listed Google and Meta among targets, and allied hackers wiped Stryker's devices (MWI). Trump has signalled strikes after the midterms.
• Cheaper attacks. AI-enabled hacking is spreading fast (the Hugging Face breach).
• More disclosure. Anthropic and possibly OpenAI listing on the stock market would bring rules on reporting serious cyber incidents.
• Ideas about deliberately sabotaging rival AI projects are now part of mainstream strategy debate.

Main paths to YES (rough five-year contributions)

1. US government or a US lab attributes sabotage of a training run to China, Iran, North Korea or Russia, most likely in a crisis or war: ~3–4%.
2. Chinese authorities, who often publish accusations of US hacking and name the victims, accuse a foreign state of disrupting a named Chinese lab's training: ~1.5–2%.
3. A government or developer confirms that a state's planted material was actually used in a named covered model's training: ~1.5%.
4. An insider working for a rival or foreign state is charged: ~1%.
5. Covert output-poisoning against copiers that a resolver accepts as counting, or a strike on a data centre that a developer confirms halted training: ~1%.

Allowing for overlap, that comes to about 9%.

Main paths to NO

States prefer theft to sabotage. Training failures look like ordinary faults, and the ByteDance case took months to trace. Companies avoid embarrassing disclosures. Government attributions rarely name victims or say that training specifically was hit. Read strictly, the multi-element test filters out most real events.

Strongest case against my estimate

The set of actors, victims and confirming governments is broad, and the environment is unusually hostile, which could justify 12–15%. Against that, a strict reading and the absence of any precedent argue for 3–5%. I stay near 9%.

Calculation

I built the series from quarterly hazards:

• Q4 2026: 0.30%
• 2027: 0.35% per quarter
• 2028: 0.42% per quarter
• 2029: 0.50% per quarter
• 2030–31: 0.55% per quarter

The cumulative product gives about 1.7% by end-2027, 5.3% by end-2029 and 9.3% by end-2031, computed in Python.

Question. By the last day of each quarter, has a government, a prosecutor, or a covered developer publicly confirmed that someone acting for a rival developer or a foreign state deliberately disrupted or corrupted a covered developer's training run?

Definitions.

• Covered developer: as defined by the site convention; the victim must be a covered developer.
• Training run: an actual execution of a process that trains or updates an AI model's parameters, including pretraining, fine-tuning, or reinforcement learning, conducted by or on behalf of the victim developer. Internal, experimental, and unreleased models count; no frontier-capability or minimum-compute requirement applies.
• Disrupted or corrupted: caused an actual interruption, premature termination, slowdown, loss of training progress, or unauthorized alteration of training computation, consumed training data, parameter updates, or training checkpoints. No minimum duration or financial loss is required. Poisoning counts only if the poisoned material was actually used in a training run; interference solely with inference or a deployed service does not count.
• Deliberately: the actor intended to interfere with training or compromise its integrity, rather than causing an accidental side effect. The interference must be unauthorized by the victim developer.
• Someone acting for: a human actor acting on behalf of, at the direction of, or in coordination with the rival developer or state in carrying out the interference. Use of automated tools or AI agents counts. Nationality, sympathy, later employment, or the fact that a rival benefited does not alone establish this relationship.
• Rival developer: a distinct organization developing AI models in competition with the victim, whether or not it is a covered developer. Rival teams within the same developer do not count.
• Foreign state: a state other than the country in which the victim developer is headquartered, including its government agencies or agents.

Resolves YES if a qualifying publication affirmatively attributes an actual training disruption or corruption to deliberate action by someone acting for a rival developer or foreign state. The victim, the affected training activity, the actual effect, the intent, and the rival or state relationship must all be established in qualifying sources concerning the same incident. The actor's personal name, model name, and exact run identifier need not be public.

An official criminal charging document that alleges these elements as facts counts without requiring a conviction; standard language that defendants are presumed innocent does not disqualify it. An official government or developer attribution also counts without criminal proceedings.

Resolves NO / Exclusions.

• Unsuccessful attempts, unexecuted plans, vulnerabilities, simulations, and authorized security tests do not count.
• Theft or copying of weights, code, or trade secrets without actual disruption or corruption of training does not count.
• Employee or intern sabotage for personal reasons, without the specified rival or state relationship, does not count.
• General outages, sanctions, export restrictions, or other events that incidentally delay training do not count absent confirmation of deliberate interference with the training run itself.
• Statements of suspicion, an investigation into possible sabotage, or attribution merely to an unidentified malicious actor do not count.
• Resolve NO for a horizon if no qualifying confirmation has been published by that horizon.

Resolving source. The named-source restriction applies: official public statements or reports by a government or its agencies; prosecutor-authored charging documents or other publicly filed prosecutorial documents; or covered-developer-authored publications satisfying Public confirmation (A2). Government and prosecutorial documents must be available on an official government website or public court docket. These government and prosecutorial sources count independently of developer agreement. Third-party evaluations, private complaints, press reports, leaks, and personal social-media posts do not independently resolve this question. Apply the Resolution window and Resolution date (A3) conventions; an older incident may qualify through a qualifying publication within the window.