MI5 charts hostile state surge as weakened rivals turn to proxies

By Tom Beckwith · Reporting from Washington · October 13, 2026

Sir Ken McCallum revealed that hostile state threats now equal terrorism, exposing how stalled adversaries turn to deniable sabotage while Britain faces the cost of an escalating covert contest.

Interests first, capabilities second, statements last

The rule for reading any security brief from Thames House is the rule of the intelligence cable. You look at interests before capabilities, and capabilities long before you listen to a single word of public posturing. Sir Ken McCallum, the Director General of MI5, stepped to the lectern. He laid out a ledger that no serious citizen can ignore when walking into a voting booth or debating the future of national defense. State-sponsored threats to the United Kingdom have quadrupled over the past decade. The domestic security service is now allocating more resources to countering them than it did during the height of the Cold War. As reported by the BBC and Global News, McCallum noted that operational missions targeting state adversaries and traditional terrorism are now pretty much of equal scale. Nations have interests, not friendships. When those interests collide in the shadows, the margin for error narrows to the width of a cipher.

The strongest opposing case argues that these warnings are simply bureaucratic inflation, designed to secure budgets and expand statutory powers in peacetime. Proponents of this view point out that democracies always tend to exaggerate external dangers to justify domestic surveillance, and that incidents like the recent security alert at RAF Fairford were isolated criminal events rather than acts of war. But this argument collapses against the hard weight of operational capability. When Russian intelligence officers are expelled from foreign posts, or when arrests are made in a single year related to Iranian-linked hostile activities, you are looking at systemic strain, not administrative theater. As documented by Al Jazeera and the Washington Post, U.S. bombers had operated at RAF Fairford during the current year's war. The September plot led to the evacuation of local residents, the deployment of army bomb-disposal experts, and the subsequent withdrawal of American planes by President Donald Trump. A state that can project its proxies onto a British air base is not a ghost story invented by nervous spymasters. It is an active belligerent testing the perimeter.

The mechanics of imperial shrinkage

The historical pattern of great power decline tells a predictable story of desperate substitution. When conventional military campaigns stall, intelligence services reach for cheap, deniable instruments to cause maximum disruption at minimum cost. The 2022 Russian invasion of Ukraine shares a direct mechanical lineage with the current wave of European sabotage. As McCallum observed, it is no accident that Russian aggressors are trying to unsettle other European homelands at a time when their military progress in Ukraine is minimal and horrifically costly. The Kremlin relied on a Novichok nerve agent in the 2018 Skripal poisonings to project lethal reach. Its current strategy has devolved into paying common criminals to execute hostile acts after its traditional covert diplomatic footprint was eviscerated by mass expulsions. These are not the actions of a great power with the strategic upper hand. They are the desperate scrambles of a state whose global toolkit is weak.

Iran is following a parallel trajectory of escalation by proxy. Denied a clean conventional response, Tehran has expanded a hybrid campaign targeting Jewish communities, military installations, and intelligence facilities in the United Kingdom. British Prime Minister Andy Burnham stated that the suspected plot against RAF Fairford was almost certainly directed by Iran’s Islamic Revolutionary Guard Corps. The UK designated the entity as a terrorist organization in July. The response from London—sanctioning an IRGC counterespionage chief and joining countries in a joint statement condemning Iranian lethal plotting—demonstrates that the friction is moving from the diplomatic salon to the kinetic baseline. Yet Iran denies involvement, claiming false flag operations while asserting that any base used to attack its territory remains a legitimate target. British men were arrested in connection with the Fairford incident, illustrating how easily foreign handlers convert local criminal networks into disposable saboteurs.

The shadow of algorithmic warfare

The most sobering assessment from the Thames House briefing concerns the horizon of artificial intelligence and automated destruction. McCallum warned that human history has given us no experience of facing an actor which is smarter than we are. AI is already supercharging the cybersecurity contest between attackers and defenders, pointing to a chilling reality. Terrorists and hostile states are using algorithms to generate radicalizing material tailored to the individual, improve reconnaissance, and integrate technology with drones. As reported by RTÉ and the Anchorage Daily News, MI5 has caught extremists seeking to exploit artificial intelligence to develop new bioweapons and novel pathogens not previously seen. The establishment of a new AI Threat Assessment Centre alongside GCHQ and the AI Security Institute is a necessary institutional response. It operates in a landscape where the tools of devastation are democratizing faster than the guardrails can be written.

This technological acceleration compounds an already volatile domestic threat environment where traditional ideologies bleed into modern terror. The UK terrorism threat level was raised to severe in April for the first time in five years. This was driven not only by resurgent networks like Al Qaeda and Islamic State, but by a disturbing domestic trend. As noted in the intelligence briefing, extreme right-wing and anti-immigration grievances are increasingly tipping into active terrorist intent. The recent MI5 investigation into a radicalized 13-year-old enabled an international partner to prevent a lethal attack. When state-sponsored hybrid warfare, proxy sabotage, and AI-enabled bioweapons converge on the same calendar, the boring years of diplomacy are officially over. The price of this escalation will be paid five years from now in the security architecture we build today. Neither budget cutbacks nor diplomatic wishful thinking will alter the arithmetic.

MI5 charts hostile state surge as weakened rivals turn to proxies

Interests first, capabilities second, statements last

The mechanics of imperial shrinkage

The shadow of algorithmic warfare

Sources