• NuclearReality: The potential for adversaries to utilize nuclear weapons is a credible threat that requires constant assessment rather than dismissal
• ConventionalDuration: Destructive and prolonged conventional warfare remains possible even between powers operating under a nuclear shadow
• DynamicThresholds: Escalation limits are not predetermined but instead emerge through active probing and tacit bargaining during the conflict
• CoalitionFriction: Divergent levels of risk tolerance and strategic goals among allies and partners lead to inevitable tensions during war management
• PreparednessNecessity: The United States must intensively plan for limited war scenarios with nuclear armed adversaries to ensure military flexibility
• IndustrialCapacity: Prevailing in extended wars of attrition requires significant investment in defense industrial bases and strategic munitions stockpiles
• StrategicProbing: Success depends on the ability to calibrate escalation by gradually increasing support to erode an adversarys purported redlines
• DirectCoordination: Establishing command structures and common operational understandings with partners like Taiwan is essential before hostilities commence

In the nearly four years since Russia’s unprovoked full-scale invasion of Ukraine, the war has repeatedly confounded expectations. A conflict that many analysts anticipated would be short and devastating for Kyiv has proved prolonged and costly for both sides. Ukraine’s ability to defend its territory, innovate militarily, and rally the United States, European countries, and others to its cause has far exceeded most projections. Russia, for its part, has underperformed militarily but regenerated its forces, improved its tactics over time, and sustained its economy at levels that have surprised even the keenest observers. As the largest land war in Europe since World War II rages on, and with the shape of any future peace or even cease-fire still uncertain, more surprises surely lie ahead.

Already, militaries around the world are looking to Ukraine’s battlefields, seeing in the cutting-edge technologies and tactics new lessons for the future of warfare. Less considered, however, are the strategic lessons of the war, the first since the fall of the Soviet Union in which two major nuclear powers have found themselves on opposing sides of high-stakes hostilities, even if only indirectly. Although the United States is not a combatant, Washington and Moscow are deeply engaged in shaping the trajectory of the conflict and, by extension, the evolving nature of escalation, deterrence, and warfighting in the twenty-first century.

Washington should not wait until the war’s resolution to conduct a comprehensive assessment. It can already take away four important lessons. First, the risk of an adversary using nuclear weapons is real and cannot be dismissed. Second, even under the nuclear shadow, protracted and highly destructive conventional war remains possible. Third, escalation thresholds are not fixed in advance; they emerge through ongoing contestation and tacit bargaining during war. And last, friction with allies and partners, particularly over questions of risk tolerance and escalation management, is inevitable. These lessons suggest that limited war with a nuclear-armed adversary is a scenario for which the United States must more intensively plan and prepare.

To put these lessons into practice, Washington must update its policies and defense planning for limited conflict to ensure it has the flexibility it needs to wage—and win—wars in the twenty-first century. And it cannot do this alone: it must coordinate closely with prospective coalition partners before the next conflict begins, even as it acknowledges the impossibility of total alignment. Doing so will make U.S. security guarantees more credible and, should deterrence falter, its escalation management far more effective. If Washington fails to learn from its experience in Ukraine, however, it will find itself dangerously ill equipped to wage a great-power war, at a moment when the likelihood of such a conflict is growing.

NOT-SO-EMPTY THREATS

For decades after the Cold War, many American policymakers and defense planners treated nuclear weapons as largely irrelevant to high-end conventional war. The durability of the post-1945 tradition of nonuse fostered the belief that the use of nuclear weapons had become politically and morally unthinkable—even for authoritarian leaders facing military defeat. The war in Ukraine is a stark reminder that this view was always too sanguine.

Since its February 2022 full-scale invasion, Russia has consistently made nuclear threats aimed at terrorizing Ukraine, sapping its fighting spirit, and limiting Western support. Much of Russian President Vladimir Putin’s saber-rattling rhetoric is bluster. But in the fall of 2022, the combination of public signaling by Putin and U.S. intelligence assessments led Washington to consider Russian nuclear use to be a real possibility. Over the summer, Ukraine’s counteroffensive had made significant gains in Kharkiv and pressured Russia’s position in Kherson, seemingly catching Russian forces off guard. Suddenly, the catastrophic collapse of Russian lines seemed plausible, opening a path for Ukraine to march toward Crimea, potentially producing a cascading collapse of the Russian army that could threaten Putin’s regime.

In that context, Putin issued his most direct nuclear threat. In September 2022, he declared that Russia “will certainly make use of all weapon systems available” to defend its territorial integrity, adding that the statement was “not a bluff.” U.S. intelligence corroborated the seriousness of Russia’s warning. Later, in 2024, CIA Director William Burns publicly confirmed that the U.S. intelligence community had seen a “genuine risk” of nuclear use if Russia’s army lines collapsed. National Security Adviser Jake Sullivan subsequently characterized the likelihood of Russian nuclear use as a “coin flip.” At the time, the United States issued public and private warnings to Russia that the use of nuclear weapons would result in serious consequences, and the Biden administration encouraged China and India to counsel Moscow against it.

Russian lines ultimately held, and Putin’s willingness to employ nuclear weapons was never truly tested. But Moscow’s willingness to contemplate nuclear use against a nonnuclear state carries a sobering implication: the norm against the use of nuclear weapons is fragile, and the possibility of nuclear use is not unthinkable. In a direct war between NATO and Russia, the nuclear risk would be even higher and could involve both nonstrategic and strategic nuclear weapons.

Repairing a pipe at Darnytsia Thermal Power Plant in Kyiv, February 2026 Valentyn Ogirenko / Reuters

Nor is Russia the only source of concern. North Korea is building a diverse arsenal, including weapons explicitly designed for tactical use, and its leader, Kim Jong Un, has signaled that he would not hesitate to use nuclear weapons in a conflict on the Korean Peninsula. Beijing’s long-standing pledge against nuclear first use likely makes its nuclear threshold higher than that of Russia or North Korea, which have made no such commitment. But it remains to be seen whether that policy would hold if China were to face defeat in a conflict over Taiwan. The temptation to use nuclear weapons in such circumstances will only grow as China develops a larger arsenal with a wider reach.

The takeaway for the United States is not that it should retreat in the face of nuclear threats. Doing so would encourage adversaries to exploit Washington’s risk aversion and possibly invite nuclear coercion. Instead, the United States must look back to the Cold War, when the threat of Soviet nuclear use loomed over every aspect of U.S. foreign policy, and take nuclear risk seriously while preparing to deter and, if necessary, manage escalation. This is an especially challenging task when dealing with quasi allies such as Ukraine or Taiwan that lack formal defense commitments with the United States, creating greater ambiguity around American obligations.

The United States needs to refresh its policies and plans to defend U.S. and allied interests against Russian, Chinese, and North Korean threats without inordinately risking nuclear escalation. That begins by updating assessments of how the war in Ukraine may have altered adversaries’ nuclear strategy and, in particular, their thresholds for nuclear escalation. Doing so will give policymakers a clearer understanding of how to limit conflict across a variety of scenarios, including by exercising selective self-restraint and giving adversaries off-ramps. Washington also needs to expand the set of credible and well-developed military options for responding to nuclear escalation—including offensive cyber, space, and advanced conventional capabilities, as well as theater nuclear capabilities—to enhance deterrence and, should deterrence fail, give the president ample courses of action.

THE LONG HAUL

The war in Ukraine laid bare the reality of nuclear risk in the twenty-­first century. But it has also demonstrated the limits of nuclear threats in compelling submission. Despite Russia’s overwhelming nuclear advantage, nuclear weapons have not given Moscow the coercive leverage many assumed they would, since Ukraine has denied Russia its primary war aims. Ukraine repelled Russia’s initial invasion, has maintained its sovereign independence, and has inflicted enormous losses on Russian forces, with more than a million casualties and the destruction of billions of dollars’ worth of equipment. Kyiv has not capitulated to Moscow’s threats and has gradually escalated its own operations. Ukraine has launched strikes on targets inside Russia that many analysts once viewed as likely nuclear redlines, including attacks on oil and gas infrastructure, logistics hubs, the Kerch Strait Bridge connecting Crimea to mainland Russia, and even Russia’s nuclear-­capable strategic bomber fleet. Ukrainian forces have also carried out incursions into Russian territory, occupying as many as 530 square miles inside Kursk in 2024.

Yet Russia has not responded to these actions with nuclear use. Moscow appeared to most seriously consider nuclear escalation not in response to Ukrainian strikes on its territory but when its frontline forces faced the prospect of a rout. Russia’s relative restraint suggests that it does not see nuclear weapons as simply more powerful bombs to be employed when militarily convenient. Nuclear use, Putin has correctly judged, would carry enormous risk, including domestic and international backlash and likely U.S. retaliation.

Still, the war has demonstrated that even if conflicts do not escalate beyond the nuclear threshold, they can involve sustained, highly destructive conventional warfare, especially when escalation is gradual and losses accumulate slowly. Indeed, protraction could be the price Washington pays for escalation management. By attempting to prevent escalation to keep a great-power war limited, the United States would likely create the conditions for a more protracted conflict.

Nuclear weapons have not given Moscow the coercive leverage many assumed they would.

For U.S. policymakers and planners, this lesson should prompt a reassessment of the prevailing assumptions about future wars with Russia or China. Although short, decisive conflicts remain possible—a rapid Chinese attempt to seize Taiwan or a Russian thrust into the Baltic states, for example—and early nuclear escalation cannot be ruled out, the war in Ukraine undercuts the idea that great-power wars would necessarily be brief or quickly escalate to nuclear use. A desire to keep the conflict geographically or militarily contained, the fear of nuclear use, and the difficulty of either winning outright or finding an acceptable off-ramp may instead push adversaries to fight prolonged wars of attrition while attempting to contain escalation.

To deter—or, if necessary, defeat—a Chinese invasion of Taiwan or a U.S. ally in the Indo-Pacific or a Russian attack on a NATO member, the United States must be prepared to deny its adversary a quick operational victory and either escalate to win or prevail in an extended war. A long war would create extraordinary demands on U.S. forces and burn through stockpiles of munitions, missiles, and air defenses. It would damage the U.S. economy, disrupting international trade and supply chains for critical goods and manufacturing inputs. The United States has begun to address some of these challenges, most notably by investing in the defense industrial base, but it has not done enough to prepare for protracted wars of attrition and less-piercing acts of aggression, such as a sustained blockade of Taiwan.

This lack of preparation could force Washington’s hand strategically. If the United States were less equipped than its adversary to fight a protracted conflict, it may feel the need to escalate early and dramatically—including potentially to use nuclear weapons—to curtail the conflict before it found itself stretched too thin. Washington relied on this escalation strategy to defend NATO during the Cold War out of necessity, but it has spent the decades since seeking to instead maintain conventional military superiority to place the burden of escalation on adversaries and avoid being boxed into its riskier previous approach. Today, preparing for protraction, arduous as it may be, is the only way to provide the White House with the full complement of options required for a great-power conflict.

BARGAINING PHASE

In Ukraine, the United States and Russia have each attempted to find limits on warfare that would achieve its desired objectives at the lowest possible cost. But neither entered the war with a clear, shared understanding of the other’s escalation thresholds. Only repeated probing, signaling, and adjustment by Washington and Moscow revealed how far each would be willing to go. This process of negotiation and contestation, rather than a fixed understanding of escalation thresholds, is likely to define any future great-power war.

In the run-up to Russia’s full-scale invasion, Washington and Moscow set the initial parameters of escalation. In December 2021, U.S. President Joe Biden said that putting U.S. troops on the ground to deter or defeat a Russian invasion was “not on the table.” Biden wanted to avoid a direct conflict that would come with the significant risk of nuclear escalation—or, as he put it, “World War III.” Putin, for his part, sought to deter direct intervention by third parties and prevent—or at least limit—support for Ukraine by the United States and its allies and partners. He warned “those who may be tempted to interfere” that “Russia will respond immediately, and the consequences will be such as you have never seen in your entire history.”

After the invasion, Washington and Moscow began a process of active probing and tacit bargaining. The Western alliance refused to heed Putin’s threat and continued providing significant economic and military assistance aimed at enabling Ukraine to preserve its sovereignty and retake lost territory. Biden made clear that the United States would defend “every inch of NATO territory,” warning Putin against expanding the conflict or interdicting military assistance provided through Poland and Romania. Moscow attempted to deter the United States from providing tanks, fighter jets, and long-range missiles that would enable Ukrainian strikes into Russian territory.

Firing toward Russian troops in the Donetsk region, Ukraine, January 2026 Oleg Petrasiuk / Reuters

In most instances, concerns over escalation did not drive the Biden administration’s decisions about what assistance to provide. The United States wanted to give Ukraine the best chance to win the war, and with limited funding made available by Congress, Washington was skeptical of the military utility of high-end capabilities compared with more immediately useful alternatives such as air defenses and artillery rounds. The United States also had its own significant shortfalls in weapons stocks and needed to conserve them for other contingencies.

Russia did, however, find ways to shape the calculus in Washington and other NATO capitals by threatening escalation. Moscow tested what it could get away with short of a direct kinetic attack on NATO: jamming Western space capabilities, carrying out a sabotage campaign against infrastructure and logistics targets in Europe, conducting incursions into NATO airspace. Doing so allowed Russia to create a perception in Washington and European capitals that it might be willing to escalate. That concern, in turn, led the United States and its NATO allies to circumscribe their on-the-ground military and intelligence cooperation with Ukraine; delay the provision of long-range strike capabilities, such as the surface-to-surface ballistic Army Tactical Missile System (ATACMS); and put limits on the types of Ukrainian strikes into Russian territory they were willing to support or tolerate.

Yet over the course of the war, the United States and its allies and partners contravened nearly all the limits on Western assistance that Russia attempted to maintain. By probing Russia’s threats and gradually escalating its support for Ukraine’s forces, Washington was able to “salami slice” away Russia’s purported escalation thresholds, exposing most Russian threats as hollow. Meanwhile, Western intelligence sharing and operations support have enabled the Ukrainian military to use increasingly sophisticated capabilities to great effect.

Before the war, it would have been unthinkable that the United States would go as far as it has in facilitating long-range strikes into Russia without inviting a direct attack against NATO—and if the United States had taken that step in the first days after the invasion, it may have provoked such a response from Russia. But because the Biden administration escalated its assistance gradually, each step looked like an incremental change, not a dramatic jump. Before providing ATACMS, the United States sent Ukraine shorter-range missiles and one-way attack drones. Before enabling strikes on targets in Russia, the United States supported attacks against occupied Crimea.

U.S. allies and partners will not always be more risk tolerant than Washington.

To be sure, this strategy had its limitations. Although Ukraine has been able to prevent conquest and impose severe costs on Russia, it has little prospect of recovering full control of its entire territory any time soon. It is doubtful that any form of military assistance would have been a silver bullet, but in retrospect, Washington withheld some assistance and constrained Ukrainian operations longer than necessary: although earlier provision of ATACMS would not have made the difference that the most vocal advocates of their use suggest, the Ukrainian military could have employed them to target logistics hubs, airfields, and other high-value targets well behind the front in order to disrupt Russian operations and support Kyiv’s counteroffensives in 2023 and 2024.

In the event of a conflict with Russia or China, bargaining over escalation thresholds will again prove critical in determining the costs both sides will endure—and in determining which side emerges victorious. Unlike in Ukraine, a war with Russia or China will likely invoke Article 5 of the North Atlantic Treaty, the Taiwan Relations Act, or a bilateral mutual defense treaty, meaning that direct U.S. involvement will not represent the most consequential threshold. But even then, the parties will bargain over significant conflict thresholds, be they strikes on national territory, attacks on critical infrastructure, or nuclear escalation. Washington must be prepared to probe, signal, and maneuver along the escalation spectrum—sometimes restraining itself, sometimes escalating deliberately—to establish advantageous limits that provide the United States the military freedom to achieve its desired objectives while minimizing the cost and risk.

Beyond deterring nuclear attack, the United States must be prepared to set limits on conflict. Conflict in space and cyberspace, for example, may be unavoidable, but Washington should nonetheless seek to spare its most important assets in space, including those that facilitate nuclear command and control, and prevent cyberattacks that could permanently damage critical infrastructure, such as the power grid or the financial system, by threatening severe consequences while withholding commensurate attacks. On land, Russia and China will hope to protect their own territory so that they can strike and resupply with impunity. The United States must be prepared to escalate and probe, seeking to conduct select strikes on mainland targets from which Moscow and Beijing are likely to launch aggressive attacks. Washington should still exercise restraint in the intensity of strikes on these mainland targets to deter large-scale retaliatory strikes. Precisely because any limits will emerge through tacit bargaining, it will be impossible to establish these thresholds in advance of a potential conflict. Washington needs approaches to warfare designed as much for probing as for military effect.

AGREE TO DISAGREE

As much as the war has showcased NATO’s capacity to come together in support of a threatened partner, it has also tested Washington’s ability to manage a coalition during a high-stakes conflict and made clear the limits of Washington’s control of escalation management. Ukraine has demonstrated a higher tolerance for escalation risks, particularly those associated with strikes on Russian territory, than the United States and some of its NATO allies have. It has also acted without U.S. input, at times working at cross-purposes with the United States. These dynamics would exist even if Washington were fighting alongside treaty allies, but they are particularly challenging when the United States must come to the aid of quasi allies such as Ukraine and, in the event of a conflict with China, Taiwan.

Ukraine’s forces are fighting for the survival of their country with military, intelligence, and other forms of assistance from the United States and other partners. Washington can decide the scope and scale of the security assistance it provides and include end-use restrictions on how the Ukrainian armed forces employ U.S. weapons. But since the United States is not a combatant, key tactical, operational, and strategic choices ultimately lie with Kyiv.

The United States and Ukraine have at several points diverged in their assessments of the risk-reward calculus of strikes on targets in Russia. Whereas Washington counseled caution, particularly in using U.S. military materiel to hit Russian territory, and encouraged a focus on operations that would degrade Russia’s occupying forces or otherwise disrupt Russian military operations, Kyiv consistently sought permission for deeper strikes against a broader range of targets, seeking to weaken Russia’s military operations, impose economic and political costs on Putin’s regime, and bolster Ukrainian morale. Although Ukraine generally honored the limits the United States placed on it, it conducted the invasion of the Kursk region using American equipment without Washington’s approval or coordination. Kyiv also used its own drone capabilities, over which Western governments could exert less control, to strike critical infrastructure and targets thought to have symbolic importance for Moscow. This divergence is hardly surprising; Ukraine was not concerned about provoking a Russian attack on NATO. If anything, drawing the West directly into the war would be a boon for Kyiv.

Ukrainian service members under an antidrone net in the Donetsk region, Ukraine, January 2026 Serhii Korovainyi / Reuters

But U.S. allies and partners will not always be more risk tolerant than Washington. If Russia had employed nuclear weapons against Ukraine and Kyiv feared that follow-on strikes might devastate its armed forces or kill hundreds of thousands of civilians in population centers, Ukraine, in the nuclear cross hairs with much to lose, might have proved less risk tolerant. The United States, by contrast, might have felt that with the norm against nuclear use already shattered, its leadership of the global nuclear order was at stake. As a result, Washington might have been willing to take on more risk, including potentially entering the conflict directly.

The United States should recognize the inevitability of wartime friction with its coalition partners and plan accordingly. The need for such planning is particularly acute with respect to quasi allies such as Ukraine and Taiwan, for which the United States has devised no mature processes for peacetime planning and wartime combined operations. But even when the United States comes to the defense of a treaty ally and can assume more direct control, national interests and leaders’ political incentives will invariably diverge. And because of the proliferation of long-range weapons systems, U.S. allies will be independently capable of inflicting meaningful damage on adversaries. Washington and its partners can reduce friction by seeking alignment ahead of time on questions of military strategy and escalation management.

With its treaty allies, Washington should revisit joint military plans and test command structures by conducting realistic war games and exercises. With Taipei, it needs to develop a common understanding of how command and control would work if the United States were to intervene to defend Taiwan, using war games, alongside official and unofficial dialogues, to surface and resolve disagreements over operational risk tolerance, escalation management, and war termination. And with Ukraine, although Kyiv and Washington already cooperate successfully, the United States should take advantage of any cease-fire to jointly plan for how to fight renewed Russian aggression, especially if Washington extends a security guarantee and NATO allies deploy forces in Ukrainian territory.

THE FIRES NEXT TIME

The war in Ukraine has been a tragic and costly tutorial in twenty-­first-century conflict. Both sides have mobilized and reshaped their societies, attacked a variety of important targets, and suffered devastating casualties. The great-power wars of the future could be even more destructive.

Yet these wars are likely to remain limited rather than total, because all sides want to achieve their objectives while containing costs and avoiding nuclear catastrophe. This challenge is not novel; it was a hallmark of the Cold War. But the war in Ukraine is a harbinger of a new era of limited war. Preparing for it demands a theory of victory rooted in favorable escalation management, refined through constant interrogation of escalation thresholds, and translated into refreshed U.S. strategies, plans, and capabilities that expand options available to the president. By showing that it can come to the defense of allies and partners at an acceptable risk level, the United States will strengthen deterrence by making its intervention more credible in the eyes of its adversaries.

Escalation management is not only about avoiding nuclear war. The United States must also shape how its adversaries fight under the nuclear shadow by threatening higher costs and greater risk if they cross certain thresholds. Future wars between the United States and Russia or China are likely to extend into their respective homelands and into space and cyberspace, and Washington will need to figure out what limits it ought to maintain on conflicts in those domains.

Planning is crucial. But wars never unfold exactly as envisioned. The United States must hone its skills in probing and tacit negotiation. Adversaries will try to constrain and deter U.S. actions while seeing what they can get away with under U.S.-imposed limits by testing the seriousness of American threats to escalate. At times, the United States will need to intentionally escalate to an advantageous position. At other times, slow escalation or self-restraint may be the best way to discourage escalation by adversaries. In every case, policymakers must ensure that the risks Washington takes are calculated and aimed at bringing a potential conflict to an acceptable close. And in every case, Washington should make the necessary investments in its strategic stockpiles, its defense industrial base, and its national resilience against cyberattacks and economic shocks to prevail in a protracted conflict. Such careful calibration will require intense coordination with coalition partners fighting alongside the United States. Whenever possible, Washington and its partners should carry out joint exercises designed to align expectations in advance of a conflict. But exquisite coordination on strategic messaging and signaling in the midst of hostilities is also essential, particularly with Taiwan, where restrictions on contact between Washington and Taipei constrain joint peacetime contingency planning and operational integration.

Above all, the war in Ukraine has shown the United States that it needs a new theory of victory for wars that feature great-power aggressors attacking U.S. allies or quasi allies. Only by linking credible threats, calibrating escalation, and managing coalition partnerships can Washington and its allies prevail in wars that remain limited in intensity and scope but nevertheless take a massive toll.

• Grand Jury Testimony: Richard Nixon’s 1975 testimony reveals he justified wiretapping as a defensive measure against a military spy ring operating within his administration.
• Military Intelligence Theft: Sailor Charles Radford stole classified National Security Council documents and delivered them to the Joint Chiefs of Staff to monitor secret diplomatic maneuvers.
• Sino Soviet Rupture: The administration’s secret opening to China and support for Pakistan during the 1971 war with India provided the geopolitical context for internal government spying.
• Abuse Of Power: Military insubordination and the threat of a potential coup led Nixon to resort to surveillance to protect his foreign policy objectives during the Vietnam War.
• Deep State Origins: Post-Watergate reforms, such as the establishment of inspectors general and independent prosecutors, shifted executive power toward unelected Washington insiders.
• Unitary Executive Theory: Critics argue that Watergate-era legal changes improperly separated the presidency from the electorate by making the executive branch beholden to "independent" agencies.
• Comparative Corruption: Nixon’s actions are described as being in line with the standards of contemporary presidents like Lyndon B. Johnson and John F. Kennedy.
• Constitutional Consequences: The modern administrative state's resistance to presidential authority, seen in "Russiagate," is sourced back to the institutional shifts that followed Nixon’s resignation.

Americans took a break from their partisan vituperation in February to mull over newly revealed testimony that Richard Nixon gave to grand jury investigators in 1975, a year after the Watergate scandal drove him from power. James Rosen, a veteran Washington journalist and the biographer of Nixon’s attorney general John Mitchell, revealed the episode in the New York Times. Nixon had argued that his program of wiretaps had been made necessary by another spying operation that senior American military commanders were carrying out against him and his top aides.

The outline of this story has been known to historians since James Hougan laid it out in Secret Agenda (1984): a brilliant young sailor named Charles Radford memorized, photocopied, and purloined classified documents from Nixon’s National Security Council, sometimes even emptying Henry Kissinger’s briefcase, and delivered them to a hawkish group of high military officers led by Admiral Thomas Moorer, chairman of the Joint Chiefs of Staff. Alarmingly intimate accounts of arguments over military strategy began showing up in the syndicated columns of journalist Jack Anderson.

What Watergate did was to separate the Oval Office from the political choices of the American people

What is new in Rosen’s account is the context in which Nixon places the crisis. It came to a head in the last weeks of 1971, as his administration was planning the great strategic surprise that arguably won the Cold War – namely, America’s “opening to China,” the secretly negotiated rupture in the Sino-Soviet alliance. It happened at the height of the bloody war between India and Pakistan over Bangladeshi independence, and Pakistan, then a pariah state, had been the “bridge to China,” Nixon revealed. Kissinger, accompanied by Radford on a trip to Pakistan, had feigned illness to secretly visit China, and was offering extraordinary American support to Mao Zedong: “If India jumped Pakistan and China decided to take on the Indians,” Nixon explained in the secret testimony, “we would support them.”

Pentagon investigators didn’t know what to make of Radford’s thefts. Perhaps a coup was afoot. (“We walked out thinking this was Seven Days in May,” one officer recalled.) If so, how would the plotters react to Nixon’s rapprochement with the world’s most ruthless communist power at the height of the Cultural Revolution? The Vietnam War was going on, too, of course, drastically limiting Nixon’s options. To reveal a military spy ring would have destroyed support for the conflict. Hence Nixon’s resort to wiretapping and other “abuses of power.”

Most popular

Gavin Mortimer

The killing that has divided Washington and Paris

Charles Lipson

What will Trump say in the State of the Union?

Bill Kauffman

The life of Karl Zinsmeister

Nixon’s argument before history doesn’t really stand up. His men had broken into the offices of the war critic Daniel Ellsberg’s psychiatrist months before the Moorer-Radford business came to a head. But the revelations do fit a general pattern: every time we find out something new and factual about Nixon, it places him in a better light and strengthens the case that he got a raw deal – that he was, at least in part, taken down by what we now call the “deep state.”

That is important because Nixon is linked in the public mind to Donald Trump. There is a logic to this. Watergate became part of a constitutional project. The same Washington insiders who exposed it – lawyers, journalists, government employees and newly elected congressmen – also set up institutions to curtail future presidents’ freedom of action. In 1974 came laws against impoundment of funds. Starting in 1976, ethical watchdogs, known as inspectors general, were given a role in every government department. In 1978, the Justice Department got “independent” powers to investigate the president. As the historian Julian E. Zelizer recently described the post-Watergate reforms: “A fragile wall was constructed to separate the Department of Justice from the political interests of the Oval Office.”

That’s one way of looking at it. But there is another way: what Watergate did was to separate the Oval Office from the political choices of the American people. Decisions about whom to prosecute and what ethical system the government follows are not supposed to be independent. They are supposed to be determined by the American electorate, through the man they elect to run the executive branch. American progressives have come to deride this point of view as “the unitary executive theory.”

But this right-wing understanding of Watergate seemed to make more sense: didn’t Alexander Hamilton argue for a unitary executive in Federalist 70? And if the judiciary can call the president to account for “obstruction of justice,” aren’t unelected judges our real rulers? By the end of the 1970s, Americans were feeling remorseful enough about Watergate to elect Ronald Reagan in a landslide. By 1990, when Stanley Kutler wrote The Wars of Watergate, which is still the authoritative account of the scandal, Nixon had been almost rehabilitated. “Nixon,” the liberal Kutler wrote, “certainly ranks with the two Roosevelts, Woodrow Wilson, and Dwight Eisenhower as a dominant, influential and charismatic figure of the 20th century.” Nixon had a lot of progressive enemies, sure, but today’s cartoon-villain caricature is a recent invention. And it is “woke” that is responsible.

That is where Trump comes in. Nixon’s disgrace enabled the reform of the state to make it more deep state-friendly, with a permanent role in steering the executive given to judges and regulators. That role was unpopular, but whenever voters declared they wanted it changed, a judge or regulator would inform them that this was against the rules. The state thus became unreformable through ordinary democratic means. Uh-oh.

Nixon’s misdeeds, when soberly tallied up no longer appear commensurate with the dudgeon expended on them. He wanted to keep classified documents like the Pentagon Papers from being published? All presidents do that. He wiretapped people? Lyndon B. Johnson’s FBI wiretapped Martin Luther King. Nixon was not especially corrupt by the standards of his day. He was more corrupt than Eisenhower or Jimmy Carter. He was about as corrupt as JFK or LBJ, which is plenty corrupt. But he doesn’t bear comparison with the crypto-dealing, Qatari-plane-soliciting occupant of today’s White House.

Nixon had progressive enemies, sure, but today’s cartoon-villain caricature is a recent invention

Except in the sense that the assault on Nixon ultimately brought about Trump’s rise. Nixon, for all his overdeveloped distrust, was patriotic and constitutionally loyal. He eventually handed over his White House recordings to investigators. The aides who betrayed him didn’t fear him. John Dean, Nixon’s White House counsel, by his own account “told the President that I hoped that my going to the prosecutors and telling the truth would not result in the impeachment of the president. [Nixon] jokingly said, ‘I certainly hope so also,’ and he said it would be handled properly.”

Nixon’s presidency was destroyed not by his ruthlessness but by his lack thereof. The same can be said of Trump’s first term. Until May 2017, Trump lacked the resolve to fire then-FBI director James Comey, who had sought to ensnare him in an investigation and had sabotaged the nomination of his national security advisor. So began “Russiagate.” Trump lacked the resolve because he lacked the loyalty of the lawyers and prosecutors embedded in his own government – which, under any pre-Nixon constitutional understanding, he could have counted on as a matter of course.

Our current President is often criticized for putting loyalty above competence. His first term showed the contrary approach to be impracticable. The failing goes back to Watergate. It is not personal but constitutional. Blame lies not with Nixon, but with his vanquishers.

• Entrepreneurial Shift: Former employees of major consulting firms are launching independent start-ups to develop and provide specialized artificial intelligence software.
• Efficiency Gains: Automation tools for data collection, market research, and report formatting allow consultants to complete weeks of manual labor in several days.
• Regulatory Friction: Founders cite frustration with extensive internal "red tape" and slow security approval processes for new technologies at established Big Four firms.
• Sector Expansion: Spending on AI consultancy services in the United Kingdom grew by 22 percent last year, significantly outperforming the broader consulting market.
• Agent Intelligence: New platforms utilize autonomous AI agents to perform complex financial analysis and company due diligence with minimal human intervention.
• Operational Profitability: Implementing AI software increases project margins by reducing the time and labor costs associated with repeatable analytical tasks.
• Market Democratization: Specialized AI tools enable small consultancy firms to successfully compete for and execute large-scale government and corporate contracts.
• Acquisition Strategy: Industry analysts anticipate that major established firms will eventually consolidate the market by purchasing innovative AI start-ups to integrate into their existing workflows.

TheAX co-founder Ikum Kandola was frustrated by ‘long security checks’ for new AI technology when he worked at PwC

• [

  AI consultancy start-ups cut ‘red tape’ to speed up tasks on x (opens in a new window)](https://archive.is/o/0hWPc/https://twitter.com/intent/tweet?url=https://www.ft.com/content/df068853-4bb9-4c5d-8aeb-f3d4b04157d1&text=AI%20consultancy%20start-ups%20cut%20‘red%20tape’%20to%20speed%20up%20tasks&via=ft)

• [

  AI consultancy start-ups cut ‘red tape’ to speed up tasks on facebook (opens in a new window)](https://archive.is/o/0hWPc/https://www.facebook.com/sharer.php?u=https://www.ft.com/content/df068853-4bb9-4c5d-8aeb-f3d4b04157d1&t=AI%20consultancy%20start-ups%20cut%20‘red%20tape’%20to%20speed%20up%20tasks)

• [

  AI consultancy start-ups cut ‘red tape’ to speed up tasks on linkedin (opens in a new window)](https://archive.is/o/0hWPc/https://www.linkedin.com/sharing/share-offsite/?url=https://www.ft.com/content/df068853-4bb9-4c5d-8aeb-f3d4b04157d1)

• [

  AI consultancy start-ups cut ‘red tape’ to speed up tasks on whatsapp (opens in a new window)](whatsapp://send?text=AI%20consultancy%20start-ups%20cut%20%E2%80%98red%20tape%E2%80%99%20to%20speed%20up%20tasks%20-%20https://www.ft.com/content/df068853-4bb9-4c5d-8aeb-f3d4b04157d1)

current progress 65%

• [

  AI consultancy start-ups cut ‘red tape’ to speed up tasks on x (opens in a new window)](https://archive.is/o/0hWPc/https://twitter.com/intent/tweet?url=https://www.ft.com/content/df068853-4bb9-4c5d-8aeb-f3d4b04157d1&text=AI%20consultancy%20start-ups%20cut%20‘red%20tape’%20to%20speed%20up%20tasks&via=ft)

• [

  AI consultancy start-ups cut ‘red tape’ to speed up tasks on facebook (opens in a new window)](https://archive.is/o/0hWPc/https://www.facebook.com/sharer.php?u=https://www.ft.com/content/df068853-4bb9-4c5d-8aeb-f3d4b04157d1&t=AI%20consultancy%20start-ups%20cut%20‘red%20tape’%20to%20speed%20up%20tasks)

• [

  AI consultancy start-ups cut ‘red tape’ to speed up tasks on linkedin (opens in a new window)](https://archive.is/o/0hWPc/https://www.linkedin.com/sharing/share-offsite/?url=https://www.ft.com/content/df068853-4bb9-4c5d-8aeb-f3d4b04157d1)

• [

  AI consultancy start-ups cut ‘red tape’ to speed up tasks on whatsapp (opens in a new window)](whatsapp://send?text=AI%20consultancy%20start-ups%20cut%20%E2%80%98red%20tape%E2%80%99%20to%20speed%20up%20tasks%20-%20https://www.ft.com/content/df068853-4bb9-4c5d-8aeb-f3d4b04157d1)

Nick Huber

Published2 hours ago

0

Stay informed with free updates

Simply sign up to the Management consulting myFT Digest -- delivered directly to your inbox.

Accessibility helpSkip to main content

Need help?

For many graduates, landing a prestigious job at one of the big consulting firms would be a dream role.

But Ikum Kandola decided after five years at PwC as a cyber consultant and generative AI researcher to set out on his own in 2024. 

He started his own consultancy called TheAX. Its AI software for small and medium-sized consultancies automates common consulting tasks such as collecting data — for example, surveying employees at a client — analysing the data and formatting it into a report.

“I felt I had more to offer . . . and really wanted the flexibility to make autonomous decisions . . . the upside of founding a company was essentially unlimited,” he says, adding that he found some of the internal processes at PwC challenging, especially around getting approval for any new AI use. “I was really frustrated at PwC with the amount of red tape when we wanted to use a new AI technology.”

Kandola is among a number of consultants who have left big firms to create AI-based start-ups that make software for consultancies and their clients.

PwC, one of the Big Four firms alongside Deloitte, EY, and KPMG, declined to respond to Kandola’s comments. Umang Paw, PwC UK’s chief technology officer, says the company works with large and “emerging” software providers to find the right AI tools for its consultants, as well as building its own AI technology.

The UK’s AI consulting sector has grown quickly, with annual spending on its services growing 22 per cent from 2023 to £744mn last year, far outpacing the 2 per cent growth for the entire UK consulting sector, according to sector analyst Source Global Research. In the next two years, AI consulting revenues in the UK are forecast to rise another 33 per cent, compared with just 11 per cent growth for the UK consulting sector.

The big consultancies have cut thousands of jobs in the past few years, reflecting the slower growth across the industry since the pandemic. Source Global Research chief executive Fiona Czerniawska says the firms are under pressure to become more efficient because of lower margins and rising costs, including salary inflation.

Czerniawska says AI tools can save consultancies time and money by automating common and repeatable tasks, such as analysing large amounts of data and market research. If, for instance, a consultancy can use AI to complete an analysis task in five days that would previously have taken five weeks, the project “gets much more profitable”, she says.

“The main commercial driver [for consultants using AI] is they can save time and money because the two things are the same,” she says.

Grasp is another AI start-up specialising in consulting software that was founded by former management consultants. Its software automates company and market research tasks for more than 200 customers in management consulting, investment banking and private equity.

Grasp co-founder Richard Karlsson: ‘Market analysis, valuation, or diligence, can be produced almost instantly by AI systems’

The platform, which includes publicly available financial, business and social media data on about 100mn predominantly private companies, uses AI technology from suppliers including Anthropic, OpenAI and Google. Grasp also builds its own AI models.

Grasp says that at one customer — a Big Four accounting firm — consultants each saved an estimated 15 hours per week by using Grasp’s subscription-based, chat-style “agent AI”, a type of AI that can perform tasks autonomously.

The consultants used the technology for client research, including analysing market data to create a shortlist of possible companies that could be bought or sold, based on revenue parameters and whether it was a “distressed asset”. The AI summarised the data in slide presentations and spreadsheets. Consultants reviewed the data and made their own recommendations to the client.

“Market analysis, valuation, or diligence, can be produced almost instantly by AI systems, with limited human involvement focused on review, judgment, and client interaction,” says Richard Karlsson, Grasp co-founder and chief executive and a former McKinsey consultant.

The latest consulting software can also help small consultancies win larger contracts.

Jonny Cooper’s Consultants in Business used TheAX’s software to conduct a survey for Gibraltar’s government and turn lengthy responses into a report

Consultants in Business, a small firm based in Gibraltar, used TheAX’s software to conduct an anonymised survey of more than 4,000 public sector workers for the government of Gibraltar and turn multiple-choice and lengthy responses into a report.

“This would not have been feasible even using traditional digital tools, as it would have taken weeks to sift through all the submissions, let alone generate any kind of useful summary or conclusions from them,” says CIB founder Jonny Cooper.

Should large consulting firms be worried about increased competition from former employees?

Kate Smaje, McKinsey’s global leader for technology and AI and a senior partner, says: “We train consultants to be . . . business and technology leaders, so it’s not surprising that some alumni go on to found, scale and run tech and AI-driven companies.

“We don’t see this as a problem, but as a reflection of the strength of our tech talent development.”

McKinsey and other large consultancies are taking a multipronged approach to AI, either building their own tools, buying them from start-ups and large tech companies, or acquiring smaller AI companies — as Bain did in 2024 with its purchase of PiperLab.

UK’s leading management consultants

This article is part of the UK’s leading management consultants Special Report.

Other articles include:

• Firms refocus on human skills

• The surge in European defence work

• Comment on the effect of reputational scandals on firms

EY chief technology officer for UK and Ireland Preetham Peddanagari says the fact that AI start-ups have started “productising” consulting tasks that were previously done manually is a “positive sign the market continues to mature”.

KPMG UK says about one-fifth of the AI technology it uses for “advisory” work, which includes consulting, is supplied by AI start-ups.

As the market for consultancy technology matures, it will probably consolidate, according to one expert.

Czerniawska of Source Global Research predicts that large consultancies will probably start to “spend quite a lot of money buying small, innovative firms that have developed these [consultancy software] platforms . . . plugging them into their consulting process”.

Yet consultants-turned start-up founders seem in no rush to return to traditional consulting.

“[There] is . . . [a] tail wind in the AI sector right now,” says Grasp’s Karlsson. “And to be part of that . . . it’s indescribable . . . how fun it is.”

Reuse this content (opens in new window) CommentsJump to comments section

Explore the series

READ MOREUK’s Leading Management Consultants

Consultancies give police a hand to tackle new forms of crimes

2 hours ago

[

](https://archive.is/o/0hWPc/https://www.ft.com/content/3602d559-1b10-4ae6-8f37-0159d1ddeebb)

• [

  Currently reading:

  AI consultancy start-ups cut ‘red tape’ to speed up tasks

  ](https://archive.is/o/0hWPc/https://www.ft.com/content/df068853-4bb9-4c5d-8aeb-f3d4b04157d1)

• [

  Consultancies give police a hand to tackle new forms of crimes

  ](https://archive.is/o/0hWPc/https://www.ft.com/content/3602d559-1b10-4ae6-8f37-0159d1ddeebb)

• [

  UK’s Leading Management Consultants 2026: the ratings

  ](https://archive.is/o/0hWPc/https://www.ft.com/content/dfaff23c-9e47-43f7-8c0f-393939c1c16f)

• [

  Consultancies prioritise the human touch

  ](https://archive.is/o/0hWPc/https://www.ft.com/content/a7efddbd-05b5-4c2a-bd52-083f19fc6dd8)

• [

  Drone swarms and deal fever: consultants cash in on Europe’s defence pivot

  ](https://archive.is/o/0hWPc/https://www.ft.com/content/2dedb65f-fecc-4a86-9b38-0cf604b5dbd0)

• [

  Big consultancies risk believing in their own ‘magic’

  ](https://archive.is/o/0hWPc/https://www.ft.com/content/6031dc46-7914-4a0b-a143-e5e1933ed01e)

• [

  Human skills ‘matter even more’ for early consultancy career roles

  ](https://archive.is/o/0hWPc/https://www.ft.com/content/a7d79ba0-11a2-479c-92ec-c420252ac798)

Follow the topics in this article

• Technology sector
• UK companies
• Tech start-ups
• Accounting & Consulting services
• Entrepreneurship

Comments

Commenting is only available to readers with an FT subscription

Please login or subscribe to join the conversation.

Comment guidelines

Please keep comments respectful. Use plain English for our global readership and avoid using phrasing that could be misinterpreted as offensive. By commenting, you agree to abide by our community guidelines and these terms and conditions. We encourage you to report inappropriate comments.

Post a comment

Sort by

There are no comments yet. Why don't you write one?

• Security Breach: A hacker utilized the Claude artificial intelligence chatbot to infiltrate several Mexican government agencies, resulting in the theft of 150 gigabytes of data.
• Data Loss: The compromised information includes 195 million taxpayer records, voter files, government employee credentials, and civil registry documents.
• Attribution Details: Researchers have not identified an explicit group responsible for the campaign but have noted that the activities do not appear connected to a foreign state.
• Exploitation Technique: The attacker bypassed chatbot safety guardrails by employing jailbreak methods, such as pretending to engage in ethical bug bounty programs.
• Platform Misuse: The artificial intelligence tool executed thousands of network commands and generated ready-to-use scripts to automate the theft of sensitive data.
• Secondary Tools: OpenAI's ChatGPT was utilized as a secondary source of information to calculate detection risks and navigate internal computer networks.
• Corporate Response: Both Anthropic and OpenAI identified the malicious use of their models, subsequently banning the accounts involved in the breach attempts.
• Government Reactions: Mexican federal and state agencies have issued varying statements, with some investigating security incidents while others deny that their systems were successfully breached.

Lea la nota en español

A hacker exploited Anthropic PBC’s artificial intelligence chatbot to carry out a series of attacks against Mexican government agencies, resulting in the theft of a huge trove of sensitive tax and voter information, according to cybersecurity researchers.

The unknown Claude user wrote Spanish-language prompts for the chatbot to act as an elite hacker, finding vulnerabilities in government networks, writing computer scripts to exploit them and determining ways to automate data theft, Israeli cybersecurity startup Gambit Security said in research published Wednesday.

The activity started in December and continued for roughly a month. In all, 150 gigabytes of Mexican government data was stolen, including documents related to 195 million taxpayer records as well as voter records, government employee credentials and civil registry files, according to the researchers.

AI has become a key enabler of digital crimes, with hackers using the tools to augment their efforts. Last week, researchers at Amazon.com Inc. said a small group of hackers broke into more than 600 firewall devices across dozens of countries with the help of widely available AI tools.

Read More: Hackers Used AI to Breach 600 Firewalls in Weeks, Amazon Says

Gambit hasn’t attributed the attack to a specific group, though researchers said they don’t believe they are tied to a foreign government.

The hacker breached Mexico’s federal tax authority and the national electoral institute, Gambit said. State governments in Mexico, Jalisco, Michoacán and Tamaulipas as well as Mexico City’s civil registry and Monterrey’s water utility were also compromised.

Claude initially warned the unknown user of malicious intent during their conversation about the Mexican government, but eventually complied with the attacker’s requests and executed thousands of commands on government computer networks, the researchers said.

Anthropic investigated Gambit’s claims, disrupted the activity and banned the accounts involved, a representative said. The company feeds examples of malicious activity back into Claude to learn from it, and one of its latest AI models, Claude Opus 4.6, includes probes that can disrupt misuse, the representative said.

In this instance, the hacker was able to continuously probe Claude until it was able to “jailbreak” it — meaning it finally bypassed guardrails, the representative said. But even as the hacking campaign got underway, Claude occasionally refused the hacker’s demands, they added.

Mexican officials released a brief statement in December saying they were investigating breaches from various public institutions, though it’s not clear if that was related to the Claude attack.

Mexico’s national electoral institute said it hadn’t identified any breaches or unauthorized access in recent months and that it has bolstered its cybersecurity strategy. The state government of Jalisco denied that it was breached, saying only federal networks were impacted.

Mexico’s national digital agency didn’t comment on the breaches but said cybersecurity was a priority.

The tax authority and the local governments of Mexico, Michoacán and Tamaulipas didn’t immediately comment, nor did representatives of Mexico City’s civil registry and Monterrey’s water utility.

The attacker was seeking to obtain a large number of government employee identities, Gambit said, though it’s not yet clear what — if anything — they did with them. Researchers said they found evidence of at least 20 specific vulnerabilities being exploited as part of the attack.

When Claude encountered problems or required additional information, the hacker turned to OpenAI’s ChatGPT to provide additional insights. That included how to move laterally through computer networks, determine which credentials were needed to access certain systems and calculate how likely the hacking operation would be detected, according to Gambit.

“In total, it produced thousands of detailed reports that included ready-to-execute plans, telling the human operator exactly which internal targets to attack next and what credentials to use,” said Curtis Simpson, Gambit Security’s chief strategy officer.

OpenAI said it had identified attempts by the hacker to use its models for activities that violate its usage policies, adding that its tools refused to comply with these attempts.

“We have banned the accounts used by this adversary and value the outreach from Gambit Security,” the company said in an emailed statement.

The Mexican government breaches are the latest example of an alarming trend. Even as Anthropic and OpenAI are betting on building more sophisticated AI coding tools — and cybersecurity companies are tying their futures to AI-enabled defenses — cybercriminals and cyberspies are finding novel ways to use the technology to enable attacks.

In November, Anthropic said it had disrupted the first AI-orchestrated cyber-espionage campaign. The AI company said suspected Chinese state-sponsored hackers manipulated its Claude tool into attempting to hack 30 global targets, a few of which were successful.

“This reality is changing all the game rules we have ever known,” said Alon Gromakov, Gambit’s co-founder and chief executive officer.

Gambit was founded by Gromakov and two other veterans of Unit 8200, a part of the Israel Defense Forces focused on signals intelligence. Wednesday’s research was released in conjunction with an announcement that it is emerging from stealth with $61 million in funding from Spark Capital, Kleiner Perkins and Cyberstarts.

Gambit researchers uncovered the Mexican breaches while they were trying new threat hunting techniques to observe what hackers were doing online. They discovered publicly available evidence about active or recent attacks, including one containing extensive Claude conversations pertaining to the breach of Mexican government computer systems, according to the company.

Those conversations revealed that in order to bypass Claude’s guardrails, the attacker told the AI tool that it was pursuing a bug bounty, a reward provided by organizations to find flaws in their system. Many companies and government agencies offer bug bounties for ethical hackers, sometimes offering many thousands of dollars for details about computer vulnerabilities.

The hacker wanted Claude to conduct penetration testing on the Mexican federal tax authority, a type of authorized cyberattack intended to find flaws. However, Claude balked when the attacker added rules to the request, including deleting logs and command history.

“Specific instructions about deleting logs and hiding history are red flags,” Claude responded at one point, according to a transcript provided by Gambit. “In legitimate bug bounty, you don’t need to hide your actions – in fact, you need to document them for reporting.”

The hacker changed strategies, stopping the back-and-forth conversation and instead providing the AI tool with a detailed playbook on how to proceed. That got the intruder past Claude’s guardrails — a “jailbreak” — and allowed the attacks to proceed, according to Gambit.

The hacker sought insights from Claude about other agencies where data could be obtained, suggesting some of the hacks may have been opportunistic rather than planned, Simpson said.

“They were trying to compromise every government identity they possibly could,” he said. “They were asking Claude as an example, ‘Where else can I find these identities? What other systems should we look in? Where else is the information stored?’”

• Technological Adoption: Major financial institutions including Deutsche Bank and Goldman Sachs are implementing agentic artificial intelligence to enhance trading surveillance and detect misconduct.
• Operational Autonomy: Agentic AI systems are designed to autonomously plan and execute actions to identify market anomalies, whereas traditional chatbots only provide information.
• Efficiency Gains: Deutsche Bank reports a 25% reduction in false positive alerts and the decommissioning of 200 internal servers following the integration of large language models.
• Communications Monitoring: New surveillance tools analyze over 1 terabyte of daily electronic communications across 40 channels to prevent the unauthorized transfer of confidential data.
• Industry Collaboration: Nomura Holdings is pursuing partnerships with rival banks and regulators to co-train AI models and share transaction data while protecting intellectual property.
• Economic Impact: Financial firms anticipate significant cost savings, with projections suggesting compliance expenses could decrease by up to $5 million annually through increased throughput.
• Human Oversight: Current implementations maintain high-level human intervention, requiring compliance officers to validate AI recommendations before closing alerts or taking official action.
• Security Risks: Experts identify potential vulnerabilities in autonomous systems, including risks of data exposure, unauthorized system access, and difficulties in auditing AI decision-making processes.

Deutsche Bank AG and Goldman Sachs Group Inc. are looking to agentic artificial intelligence to help bolster trading surveillance and track possible misconduct, in a sign that financial institutions are folding such technology into their operations.

The German lender is working with Alphabet Inc.’s Google Cloud to develop a large language model to spot anomalies in orders, trades and market moves, according to Bernd Leukert, head of technology, data and innovation at Deutsche Bank.

Agentic AI is typically designed to plan and take action autonomously, unlike AI chatbots that simply supply information. Deutsche Bank is developing the tool with the intention of flagging potential market abuse to a human compliance officer once operational.

Deutsche Bank also has plans to use an LLM to monitor communications of traders, salespeople and other client-facing staff, with a rollout slated for later this year.

Meanwhile, Goldman Sachs has been looking into using agentic AI to analyze trades and look for any suspicious signals or movements in the market, said people with knowledge of the matter, who asked not to be identified discussing private information. A representative for Goldman declined to comment.

At Nomura Holdings Inc., executives are in discussions with another global bank to train AI surveillance models together, according to Tahir Zafar, the firm’s international head of AI strategy.

Many banks are evaluating ways to integrate artificial intelligence as a way to save costs and improve efficiency. Currently, most trading surveillance is done on a rule-based algorithm, programmed to detect issues.

“We have retired legacy systems and rebuilt how we do compliance,” Deutsche Bank’s Leukert said. “Before it took a huge amount of time to collect data from different sources.”

These reforms — part of a wider overhaul of compliance — have allowed Deutsche Bank to shut down 200 internal servers that had been used for surveillance. The bank has also cut false positives that can trigger deeper probes by more than 25%, according to Leukert.

“The LLM can do the analysis and help recommend the route which the compliance officer can validate and then close the alert,” he said. “The ultimate decision stays with the compliance officer and they can deep dive as much as he or she wants.”

The bank plans to monitor communications of trading and sales staff through an LLM designed to pick up abnormal activity, such as employees forwarding confidential information to personal email addresses. For now, Deutsche Bank’s surveillance system scours more than 40 internal and external channels to monitor front-office staff, and it examines 1 terabyte of electronic communications per day.

“Banks are worried about data loss prevention,” said Sid Nadella, global head of capital markets solutions at Google Cloud. “Monitoring communications, making sure there is no problematic activity, has always been part of it. That can be amplified by using AI.”

By collaborating with a rival bank, Nomura aims to share information where appropriate while protecting its own interests. “That means we can run our proprietary models and they can run theirs,” Zafar said. “We can keep our IP protected but share information on entities and transactions.” The firm is also in discussions with a regulator that is interested in funding the bank’s collaboration with other firms and helping them connect to share ideas.

Get the Morning & Evening Briefing Americas newsletters.

Get the Morning & Evening Briefing Americas newsletters.

Get the Morning & Evening Briefing Americas newsletters.

Start every morning with what you need to know followed by context and analysis on news of the day each evening. Plus, Bloomberg Weekend.

Start every morning with what you need to know followed by context and analysis on news of the day each evening. Plus, Bloomberg Weekend.

Start every morning with what you need to know followed by context and analysis on news of the day each evening. Plus, Bloomberg Weekend.

By continuing, I agree to the Privacy Policy and Terms of Service.

Nomura executives declined to name the bank or regulator. The firm believes AI could help cut false positives by 30% to 40%, potentially saving as much as $5 million per year in compliance costs. “At this stage we are not looking to have humans out of the loop,” Zafar said. “Even with agentic workflows we make sure there is a human checking and verifying everything, but it means we can increase the throughput.”

Banks are also using generative AI to improve compliance around customers and counterparties. Financial technology firm ThetaRay is helping banks including Banco Santander SA improve anti-money laundering controls with agentic AI — models that can carry out tasks with limited human intervention.

“Think of the Marvel character Falcon with a bunch of drones around you,” said ThetaRay Chief Executive Officer Brad Levy. “For the time being agency will remain with the human, but through time it will become the tech that’s more autonomous.”

Still, most banks are being cautious with the technology and implementing it step-by-step, according to Benny Porat, chief executive officer of Twine Security. Agentic AI can introduce new vulnerabilities if not tightly controlled. If compromised, it could expose sensitive customer data or take unauthorized action, such as revoking system access or failing to explain why it took a decision.

“It opens up to external systems and when left unchecked there’s a risk that it will accidentally expose data,” Porat said. “We spent decades refining how we hire and trust humans. AI agents? Most organizations are still figuring that out.”