AI Governance

On the night of 11–12 October 2026, cyberattacks on supermarket refrigeration systems in France pushed temperatures in some cold-storage units to 50°C, spoiling food and, in some cases, triggering fires. Hundreds of stores were affected, with reports suggesting that the disruption extended across several major supermarket chains. The financial losses ran into millions of euros. The incident demonstrated how a digital intrusion could damage physical equipment, disrupt commercial operations, and threaten the integrity of the food supply chain without targeting payment systems or customer databases.   The attack came amid growing concerns about the security of connected devices. In September, allegations concerning data collection by LG smart TVs raised questions about privacy and the risks associated with consumer electronics. On 12 October, Anthropic published research warning that AI models could be approaching the capabilities required to replicate across vulnerable Internet of Things (IoT) devices without access to a central data centre. These developments point towards a broader transformation in cybersecurity. As physical infrastructure becomes more connected and AI systems become more capable, the potential consequences of digital vulnerabilities are expanding. The central concern is no longer limited to stolen data or disrupted computer networks, but extends to the possibility that insecure devices could become entry points for attacks on physical operations, essential services, and interconnected supply chains.

In early June, 28 officers and experts from 11 countries gathered in Tunis to extract more than 108,000 facial images from jihadist propaganda and sort them with AI tools. When INTERPOL, the international police cooperation organisation, announced the results on 18 September, the tools had narrowed the pile to 6,362 usable images, and 126 foreign terrorist fighters had been identified. Operation Shams II was billed as the first operation of its kind.   Terrorist groups have rarely been technological pioneers, yet they have repeatedly proved to be capable adopters of tools built by others. AI, which now writes, translates, speaks, and generates images on demand, is the latest example, and governments are working to turn the same technology against the people using it. This is not a story of one side pulling ahead. Because AI is dual-use, meaning the same capability serves attackers and defenders, every advance by one side reshapes the options of the other.   The common assumption is that the winner will be whoever deploys the best tools first. However, that assumption overlooks how differently the two sides adapt. Terrorists move cheaply and largely in the information space, where failure costs them little. States move slowly, at high expense, and under legal and public scrutiny. Adapting faster therefore depends less on who adopts a tool first than on who can sustain its use where violence actually happens, without losing the trust that gives state action its authority. That is where the contest will be won or lost.

On 23 September 2026, the United Nations Security Council confronted an unusual development in international security. The people warning governments about the dangers of AI were not only diplomats or military officials, but the executives building the technology itself. OpenAI CEO Sam Altman, Anthropic CEO Dario Amodei, and Hugging Face co-founder Clément Delangue briefed the 15-member Council as governments grapple with increasingly capable AI systems that can write code, operate autonomously, interact with external systems, and potentially improve their own capabilities. Amodei warned that, if poorly managed, “AI could be a risk to humanity as a whole”, while Altman argued that decisions about AI could not be left to technology companies alone.   The meeting was significant because AI is rapidly moving from a technology-policy issue into the domain of international security. Yet the deeper question is not simply how dangerous AI may become. It is who will establish the rules governing a technology increasingly concentrated in the hands of a small number of states and companies. The UN is attempting to become the forum where those rules are debated, but it is entering a contest in which technological capabilities, economic power, national security interests, and competing visions of governance are already shaping the outcome.

Congress now has a lobbyist that never registers, never discloses a client, and never leaves a paper trail, and it sits open in a browser tab on nearly every staffer's desk. The House Office of Legislative Counsel, the institution responsible for turning policy ideas into legally binding text, has reportedly been inundated with AI-generated bill proposals so riddled with incorrect statutory references and sloppy drafting that its lawyers now spend more time fixing them than they would spend writing the bills from scratch. Around the same time, it became clear how far this had spread. Members of Congress and their staff are increasingly using systems such as ChatGPT, Claude, Copilot, and Gemini for policy research, legislative drafting, speeches, and constituent replies.   On the surface, this looks like any workplace chasing efficiency. But Congress is not any workplace. The information lawmakers receive, the way problems get framed, and the exact language that ends up in statute can affect millions of people. So the real question is not whether chatbots make congressional offices faster. It is what happens once the systems helping policymakers research, frame, and write legislation become an active participant in the political process itself.

Cybersecurity has always favoured the attacker, but AI is widening that advantage. By compressing complex operations into automated decision loops, autonomous agents let a small human team delegate the bulk of an attack's tactical work, reconnaissance, exploitation, lateral movement, to machine tempo, in at least one documented case shifting 80–90% of that labour onto the AI itself. That doesn’t make attacks free, but it does mean cost scales far more slowly with the number of targets than it used to. Enterprises, meanwhile, face the opposite trend: breach costs are climbing, and a new governance-driven Shadow AI tax is compounding them. As automation lowers the labour cost of offense while recovery expenses and regulatory demands rise on defence, the balance of cybersecurity economics is being forced to overhaul itself.

Smart glasses are no longer an experimental technology waiting to prove whether consumers will adopt them. They are already spreading rapidly, with Meta having sold more than 7 million pairs of its Ray-Ban smart glasses and daily use reportedly tripling year over year in early 2026. At the same time, the technology is becoming more capable, combining cameras, microphones, AI, translation, navigation, audio, and visual recognition in an object designed to remain on the user's face throughout the day. As manufacturers expand the technology and the market continues to grow, restaurants, theatres, workplaces, conferences, and other venues are increasingly questioning whether existing rules governing photography and recording are adequate.   The question, therefore, is no longer whether smart glasses will become part of everyday life, but what their expanding adoption will do to privacy and public space. Unlike smartphones, which normally require a visible gesture to record, smart glasses can capture and interpret their surroundings while their wearer continues to behave normally. As adoption expands, surveillance power is consequently shifting beyond governments, companies, and security systems towards ordinary individuals. This raises broader questions about who controls the information collected, who owns it, how it can be used after capture, and whether privately generated recordings could become another source of institutional surveillance.