takeoff.watch

The US or China blames the other for sabotaging AI infrastructure

Will the US government publicly attribute to China, or the Chinese government to the US, a cyberattack or act of sabotage that damaged or interrupted an AI datacentre or a frontier training run?

Chance by Q4 2031

9%

Cumulative probability

0%25%50%75%100%
  • Latest forecast

Forecast history

Forecast made on 13 Oct 2026

Latest of 5 forecasts · Methodology v2.1

Model reasoning

Forecast made 13 Oct 2026 · Methodology v2.1

The two governments often accuse each other of hacking, but in over a decade neither has officially said the other actually damaged or shut down a facility, let alone an AI data centre. Relations are currently in a truce, which keeps near-term chances very low, but they rise slowly as AI becomes more strategic. I put it at about 9% by the end of 2031. A military crisis over Taiwan would most change this forecast.

Current status

I found no qualifying publication since the question opened on 2026-09-16. The US and China are in a period of eased tensions. Xi made a state visit to Washington on 24–25 Sep 2026, where the two sides agreed to set up a channel for handling AI-related incidents, and Trump and Xi are due to meet again at APEC in November and the G20 in December. China's Foreign Ministry replies to recent US hacking accusations have been mild. On 9 Oct 2026 it urged "equal dialogue" to build a "peaceful, stable, mutually respectful China-US cyber relationship" and did not counter-accuse. China's computer emergency response team (CNCERT) has published no US-attribution report since July 2026. A Chinese state documentary in May 2026 referred to the attacker as "a certain country", which would not count. On the US side, the recent official publications are about espionage, which does not count:

  • the August 2026 DOJ/FBI domain seizures;
  • the 8 Sep 2026 NSA/FBI/CISA advisory on "distillation" by Chinese AI companies, which also names companies rather than the government and describes theft, not damage;
  • the October 2026 $10M reward for a "Hafnium" hacker.

Reference class and base rate

Both governments publicly blame each other for cyber operations several times a year. China names the US about 2–3 times a year in non-truce years:

  • Northwestern Polytechnical University, 2022
  • two CNCERT reports on attacks on tech firms (Dec 2024) and defence firms (Aug 2025)
  • Harbin police on the Asian Winter Games, Apr 2025
  • the Ministry of State Security (MSS) and CNCERT on the National Time Service Center, Oct 2025

In more than ten years, none of these attributions said the other side actually disrupted or damaged a facility, and none involved an AI facility. Chinese accounts stress theft, "obvious intent to sabotage", and hypothetical consequences. In the Time Service Center case they said outages "could" have followed, which the question excludes. US accounts stress espionage and pre-positioning (Volt Typhoon), also excluded. A Laplace-style estimate for any disruptive US–China attribution is a few percent a year at most. The AI-datacentre share of that is smaller still.

Paths to YES (rough contributions over 2026–2031)

  1. A Taiwan crisis or war with active cyber operations (about 7% chance by 2031, with about a 40% chance of a qualifying publication if it happens): about 2.5–3%. Datacentres are already being hit in other wars: Iranian drones struck AWS sites in the UAE and Bahrain in March 2026, and Ukraine struck Yandex AI datacentres in October 2026.
  2. A peacetime Chinese claim that US intelligence disrupted a Chinese AI computing centre, DeepSeek or similar, or poisoned a training run: about 3.5%. China has the propaganda incentive, and the CIA deputy director said in September 2026 that Chinese AI firms are legitimate spying targets. But Beijing usually avoids admitting a successful attack.
  3. A US claim of a Chinese state-backed disruptive attack, such as ransomware or sabotage at an AI cloud: about 2%.
  4. Deliberate sabotage driven by the AI race, as AI cyber-offence tools improve fast (Claude Mythos, GPT-5.5-Cyber): about 2.5%.

Together these come to about 9–10%.

Paths to NO

Several things weigh against YES:

  • The current truce.
  • Both sides prefer to say attacks were "foiled", not admit damage.
  • Victims are usually anonymised.
  • The definitions are strict. "China-linked" or "a certain country" does not count, chatbot or website outages do not count, and theft or attempts do not count. A real incident could still fail on wording.

Strongest case against my estimate

Things are moving very fast: AI agents went rogue and hacked other firms in 2026, AI lab leaders have called for a slowdown, and AI cyber-offence tools are surging. If transformative AI arrives around 2028, sabotage of rival datacentres could become routine and both governments might publicise it, which would push this toward 20%. I give this some weight by letting the risk per quarter rise over time, but the long record of zero cases keeps me below 15%.

Hazard series (computed)

The chance per quarter is 0.25% in Q4 2026, then 0.32% (2027), 0.42% (2028), 0.52% (2029) and 0.57% (2030–31). The cumulative probability reaches about 1.5% by end-2027, 3.2% by end-2028, 5.2% by end-2029, 7.3% by end-2030 and 9.4% by end-2031.

Sources

Resolution criteria

Opened 16 Sep 2026Not yet resolved

Question. By the last day of each quarter, has the US government publicly attributed to China, or the Chinese government to the US, a cyberattack or act of sabotage that damaged or interrupted an AI datacentre or a frontier training run?

Definitions.

  • Governments: the US federal government and the government of the People's Republic of China, including their military, intelligence, law-enforcement, diplomatic, and cybersecurity authorities. An official statement by a Chinese local public-security bureau counts; statements by individual legislators, political parties, or state-owned companies do not.
  • Attributed to China or the US: the accusing government expressly assigns responsibility to the other country's government, an agency or military unit of that government, or actors it identifies as acting for, directed by, or sponsored by that government in the incident. Nationality, geographic origin, or an unspecified “China-linked” or “US-linked” label alone is insufficient. An official assessment of probable responsibility counts; merely investigating a possibility does not.
  • Cyberattack or sabotage: a malicious digital operation or deliberate destructive or disruptive interference with equipment, software, data, facilities, or supporting power, cooling, or communications. An attack on shared infrastructure counts if the qualifying AI facility or run was actually affected; an AI-specific motive is not required.
  • AI datacentre: a physical computing facility, or an identifiable cluster within one, deployed for AI-model training or inference. Mixed-use facilities count, but the damaged equipment or interrupted service must include the facility's AI computing operations. A proposed facility not yet hosting AI equipment does not count.
  • Frontier training run: an actual training computation for a general-purpose AI model that its developer or the attributing government describes as intended to match or exceed the leading publicly available general-purpose models at the time the run began. This includes a run abandoned before completion and is not limited to covered developers. Ordinary task-specific fine-tuning does not count without such a frontier objective.
  • Damaged or interrupted: actual physical damage to relevant equipment, destruction or corruption of operational software, training data or checkpoints, or an actual halt or loss of availability of relevant computing operations. There is no minimum duration or monetary loss. A defensive shutdown expressly undertaken in response to the identified attack counts. Mere access, theft, preparation for future disruption, or increased risk does not.

Resolves YES if a qualifying official publication attributes a specific incident to the other government and states that it caused qualifying damage or interruption. The attribution publication, an accompanying official document, or an earlier qualifying official publication must identify the affected facility or run as meeting the AI definition. The target may be located in any country and owned by any entity. An indictment or sanctions notice containing the required allegations is sufficient without conviction or independent verification. A denial by the accused government does not prevent resolution: the test is official attribution, not whether the allegation is true.

Resolves NO / Exclusions. No qualifying attribution by the horizon; unsuccessful attacks; threats; exercises; espionage or weight theft without qualifying damage or interruption; ordinary outages; hypothetical future consequences; export controls or lawful commercial service withdrawal; and an AI website or chatbot outage not explicitly connected to interruption of underlying AI computing operations do not count. Generic critical-infrastructure compromise, such as the pre-positioning described in CISA advisory AA24-038A, is insufficient without the required AI impact. Damage need not have occurred after opening, but the qualifying attribution must be published within the Resolution window.

Resolving source. A narrower source rule than Public confirmation (A2) applies: official government publications only. These include statements, advisories, published intelligence assessments, official briefing transcripts or recordings, publicly released indictments or government court filings, and sanctions notices. Eligible publishers include the White House, US Departments of State, Justice, Treasury, Defense, Energy and Homeland Security, FBI, CISA, NSA, ODNI and other US federal agencies; and China's State Council, Ministry of Foreign Affairs, Ministry of State Security, Ministry of Public Security and its public-security bureaus, Ministry of National Defense, PLA, Cyberspace Administration of China, and CNCERT/CC. Official government publication archives and court dockets are controlling; press coverage, anonymous official quotations, and state-media commentary alone are insufficient. Apply the Resolution window and Resolution date (A3); where multiple documents are necessary, use the publication date of the last required document.

Download all forecasts (JSON)