Chinese or Russian APTs will be publicly attributed probing Pentagon AI vendor supply chains within 90 days
Following the unprecedented public disclosure of IL6/IL7 AI contracts to Microsoft, Google, Amazon, Nvidia, OpenAI, Oracle, and SpaceX, threat actors APT41, Volt Typhoon, and Cozy Bear will conduct observable probing of these vendors' defense divisions. Resolution requires a public threat-intel report (MSTIC, Google TAG, Mandiant, or equivalent) attributing such activity to Chinese or Russian state-linked actors within the window.
Today's outlook is dominated by structural inertia in active conflicts: the US-Israel-Iran theater holds in aftermath despite escalatory rhetoric, while Russia's grinding Donetsk offensive is unlikely to seize Pokrovsk or Kostiantynivka within 90 days. Cyber and information-warfare risks rise as Pentagon AI contracts publicly disclose a high-value attack surface to APT actors.
The Global Cybersecurity chain is in ESCALATION (44 days, 132 clusters), with dominant 'Security Sovereignty Realignment' interpretation (40%). Public IL6/IL7 contracting essentially advertises a high-value attack surface to state APTs that already maintain persistent collection against US defense-tech vendors. SolarWinds (2020) and 3CX (2023) are direct supply-chain analogs. The 90-day window is the binding constraint, not capability or intent — published attribution reports typically lag intrusions by months, which is what limits probability ceiling. My cybersecurity sector shows extreme overprediction (+57pp) but n=3, so the bias estimate is unreliable; nonetheless I compressed analyst's 0.63 to 0.60 to respect the warning. Skeptic risk 82 supports the structural argument. Note: this is essentially baseline APT behavior; the forecast is really about whether public reporting catches it within the window.