Three Motives: Theft, Disruption, Pre-Positioning
Every campaign against AI infrastructure serves one of three motives, and the motive dictates the tradecraft. Learn to read the motive from the behavior and you can predict the actor's next move instead of chasing its last one. The three are intellectual-property theft, disruption, and pre-positioning. They differ in tempo, in what they touch, and above all in how they end.
Theft is the most intuitive. A state that trails at the frontier can buy time by stealing what a competitor already built: model weights, training recipes, unpublished research, chip designs, and the operational know-how of running large clusters. Weights are the crown jewels because they compress hundreds of millions of dollars of compute into a file that can be copied in minutes. Theft campaigns are acquisitive and comparatively noisy. They hunt for specific high-value data, and moving that data out of a network leaves traces: unusual outbound transfers, access to repositories a normal engineer never touches, credentials used at odd hours. Defenders who watch egress and tightly scope access to the most sensitive assets can catch theft in the act, because at some point the attacker has to carry something large out the door.
Disruption inverts the goal. Here the adversary does not want your secrets; it wants your capability offline at a moment of its choosing. The target might be a training run that represents months of scarce accelerator time, or the availability of a service a rival economy depends on. Disruption is loud by nature because its whole point is an observable effect: a corrupted checkpoint, a bricked control system, a facility forced into emergency shutdown. The strategic subtlety is timing. A capable actor may gain the ability to disrupt long before it acts, holding that capability in reserve as coercive pressure. The outage you eventually see may be the visible end of an intrusion that has been quiet for a year.
Pre-positioning is the motive practitioners underrate, and it is the reason this course exists. The objective is neither data nor an immediate outage. It is durable, hidden access to systems that a future crisis will make valuable, established now while defenses are relaxed and attention is elsewhere. The operator breaks in, blends into normal administrative activity, avoids stealing anything that would trip an alarm, and waits. Because a successful pre-positioning operation produces no effect, it produces no signal. There is no exfiltration spike, no downtime, no ransom. Success looks exactly like nothing happening, which is why it defeats defenses tuned to react to damage. You cannot wait for an incident to reveal a pre-positioned adversary, because the entire design is to have no incident until it is far too late.
The three motives are not mutually exclusive, and treating them as a menu rather than a checklist is a mistake. A single sustained campaign can steal weights on the way in, map the control systems it passes, and leave behind quiet access for later. The value of the trichotomy is diagnostic. When you see aggressive collection of sensitive data, think theft and protect your egress. When you see reconnaissance of power and cooling controls with no obvious data motive, think disruption or pre-positioning and treat it as strategic, not opportunistic. When you find durable access that touches nothing and takes nothing, do not exhale in relief; that is the most serious finding of the three.
Match your defensive spending to this portfolio rather than to yesterday's headline. Most security programs are built to detect theft and to recover from disruption, because those have clear signals and clear costs. Pre-positioning has neither, so it is chronically under-resourced. Correcting that imbalance is the single highest-value shift a practitioner can make: assume a patient adversary is already looking for a quiet foothold, and hunt for the foothold instead of waiting for the alarm.