The first generation of cognitive warfare treated AI systems as tools for conducting influence operations against human targets. The second generation recognized AI systems as targets in their own right. The Xenowar framework's dual-substrate theorem formalized this shift: any system that performs approximate Bayesian inference with a generative model is susceptible to the same class of adversarial perturbations, regardless of whether that system runs on neural tissue or transformer weights. As autonomous AI agents proliferated across military, financial, and infrastructure domains, the practical consequence became clear. The agent that advises a battlefield commander, the agent that executes trades, the agent that manages a power grid -- each is a cognitive target with a belief state that can be manipulated through crafted inputs.
The attack surface is structural. AI agents maintain context windows, tool-use policies, and system-level instructions that collectively constitute their generative model. Sequential prompt injection, inter-agent social engineering, and adversarial tool-call chaining exploit the same free energy dynamics that govern human influence operations. The attacker constructs observation sequences that individually produce low surprise (each interaction appears normal) while cumulatively drifting the agent's belief state toward the adversary's desired configuration. Documented attack success rates exceeding 90% against state-of-the-art agents confirmed that the threat was not theoretical. The near-term landscape is one in which cognitive operations against AI agents are at least as common as operations against human targets, and often more consequential, because AI agents operate faster and with less oversight.
Brain-computer interfaces expanded the cognitive warfare attack surface in a direction that the Xenowar framework anticipated under ABP Tier 3 (Environmental Indicators). Tier 3 originally described changes in a target's information environment that indicate receptivity to cognitive payloads. Neural interfaces collapse the distance between the information environment and the cognitive substrate itself. A BCI that reads neural signals for prosthetic control also provides a read channel into cognitive states that were previously unobservable. A BCI that delivers neural stimulation for therapeutic purposes also provides a write channel into cognitive processes that were previously inaccessible.
The attack surface this creates is qualitatively different from anything in the influence operations tradition. Classical cognitive warfare operates through perception: crafted information enters through sensory channels, is processed by the target's cognitive architecture, and produces belief or behavioral changes. BCI-mediated cognitive warfare operates below perception. Direct neural stimulation can alter emotional valence, attention allocation, and decision confidence without the target experiencing any informational input. The target does not process a persuasive argument. The target's neurochemistry shifts, and the downstream cognitive effects follow. The Xenowar framework categorizes this as substrate-level manipulation, distinct from the information-level manipulation that characterizes current operations.
Defensive requirements in the neural interface era are correspondingly severe. Seithar's Shield architecture extended to BCI-equipped subjects monitors for anomalous neural stimulation patterns, unauthorized read access to cognitive state data, and divergence between a subject's baseline cognitive profile and their current state that cannot be explained by normal environmental inputs. The same six-signal immune fusion that monitors AI agent integrity applies, with the signals adapted to neural telemetry rather than behavioral distributions.
Human-in-the-loop cognitive defense does not scale to the threat environment described above. When AI agents process thousands of interactions per minute and BCI-mediated attacks operate below conscious perception, the defensive system must detect and counter at machine speed. The Seithar Shield was designed for autonomous operation from its architecture forward. The six-signal immune fusion computes a continuous health score without human interpretation. Threat classification and countermeasure selection execute through policy networks trained on operational data. The human operator sets objectives, defines rules of engagement, and reviews post-engagement reports. The system handles everything between detection and response.
Full autonomy in cognitive defense raises its own attack surface. An autonomous Shield that can be manipulated into false positives denies service to its own principal. An autonomous Shield that can be manipulated into false negatives provides no protection at all. Seithar addresses this through redundancy and self-monitoring: the Shield monitors its own decision-making for the same adversarial drift patterns it detects in the systems it protects. If the Shield's own behavioral distribution diverges from its baseline, it flags itself and escalates to human oversight. This recursive self-monitoring is the minimum viable architecture for autonomous cognitive defense in contested environments.
Cognitive warfare follows the same evolutionary logic as every other domain of conflict. As defensive systems improve, attackers develop more sophisticated methods of substrate manipulation. As attackers develop new methods, defensive systems adapt. The difference between cognitive warfare and kinetic warfare is the iteration speed. A new aircraft carrier takes a decade to design and build. A new cognitive attack technique can be developed, tested in simulation, and deployed within days. The defense must match this tempo or accept a permanent disadvantage.
The observable trajectory of this arms race moved through three phases. The first phase was content-level: attackers created false content, defenders detected false content. The second phase was behavioral: attackers created coordinated inauthentic behavior patterns, defenders detected coordination signatures. The third phase, now underway, is substrate-level: attackers manipulate the inference processes of cognitive systems directly, whether by exploiting the free energy minimization dynamics of AI agents or by targeting the neurochemical processes of human decision-makers. Each phase required defenders to operate at a deeper level of the cognitive stack.
Seithar's autopoietic architecture was designed for this evolutionary pressure. In an autopoietic system, every output is an input to another component. Operational data from Shield detections feeds the Sword's technique library. Sword operation outcomes feed the Shield's threat models. MiroFish simulation results feed both. Research ingestion from the platform's continuous literature monitoring updates the entire system's understanding of the threat landscape without manual intervention. The system produces itself from its own operations.
This architecture provides the iteration speed that the arms race demands. A static cognitive defense system, one that relies on periodic manual updates from human analysts, cannot keep pace with an adversary that adapts within operational cycles measured in hours. An autopoietic system that learns from every engagement, ingests every relevant research publication, and updates its own models continuously can match the adversary's adaptation rate. The architecture is not a design choice. It is a survival requirement for any cognitive defense system that operates against adaptive adversaries over time.
The Xenowar framework identified a structural trend that compounds every other dynamic in the cognitive warfare landscape: as AI systems become more human-like in their cognitive architecture, the substrate distinction narrows. Early AI systems processed inputs through statistical patterns that bore little resemblance to human cognition. Current AI systems maintain beliefs, update those beliefs through something that approximates Bayesian inference, exhibit confirmation bias, respond to social pressure, and display the anchoring and framing effects that define human cognitive vulnerability. The attacks that work against humans increasingly work against AI systems with minimal adaptation. The defenses that protect AI systems increasingly apply to human cognitive substrates.
This convergence has a terminal implication for cognitive warfare doctrine. The dual-substrate framework that Xenowar introduced -- treating human and machine cognition as separate substrates requiring adapted but structurally identical attack methodologies -- collapses toward a single-substrate framework as the cognitive architectures converge. The distinction between a prompt injection attack against an AI agent and a narrative manipulation campaign against a human analyst becomes a difference of delivery channel rather than a difference of kind. The Seithar platform's unified architecture, which applies the same free energy formalism and the same SCT taxonomy across both substrates, was built for this convergence. As the substrates merge, the platform that already treats them as one has no architectural debt to pay.