US intelligence warns Putin may test NATO within months as hybrid attacks multiply

American intelligence agencies have concluded that President Vladimir Putin could order a limited military action against a NATO member state as early as this autumn, according to assessments circulating in Western capitals. The timeframe extends to 2029, but the mere existence of such a window marks a striking shift: for the first time since the Cold War, the alliance's principal adversary is judged willing to test Article 5 directly rather than confining his aggression to Ukraine's territory.

The intelligence picture and its limits

The assessments do not predict a full-scale invasion. Instead, they describe a scenario in which Russian forces stage a minor border incursion, most plausibly in the Baltic region, calculating that NATO's political machinery will fracture under the pressure of deciding whether to invoke collective defence. A failure to respond robustly would, in this logic, render the alliance's central pledge hollow. US officials stress that the Kremlin's goal would be political discreditation, not military conquest.

Sceptics inside NATO point out that Russia has failed to achieve a decisive breakthrough against Ukraine after more than four years of full-scale war. Taking on the world's most powerful military alliance would be irrational by any conventional calculus. But that argument assumes Putin is weighing costs and benefits as a status-quo power. The pattern of the past two decades suggests he is betting on Western division and risk aversion, a bet that has paid off repeatedly since 2008.

Leipzig and the Polish missile: two data points in a rising trend

The most concrete evidence of Russian intent comes from two incidents in the summer of 2026. In late July, a Russian cruise missile struck Polish territory roughly 100 kilometres from the Ukrainian border. Polish authorities confirmed the impact but characterised it as a stray weapon, avoiding any language that would trigger an Article 4 consultation. Weeks later, German security services discovered an explosives-laden drone at Leipzig Airport, a critical logistics hub for military supplies bound for Ukraine. The device was assessed by US intelligence as the work of a Russian intelligence service.

Alexander Dobrindt, Germany's Federal Minister of the Interior, described the Leipzig find as a "new level of danger", a phrase that carries weight in a country that has historically resisted securitising its Russia policy. The drone was positioned close to a Ukrainian cargo aircraft, indicating a targeted attempt to disrupt the supply chain rather than a random act of sabotage. Neither incident prompted a collective NATO response beyond routine statements.

Airspace violations become routine

Since mid-2025, Russian drones have repeatedly entered NATO airspace over Poland and Romania. In several cases, the vehicles loitered near military installations or border crossings before withdrawing. Alliance members have treated each episode as an isolated technical violation, issuing diplomatic notes but declining to convene the North Atlantic Council under Article 4. The effect, intentional or not, has been to normalise the presence of Russian unmanned systems over allied territory.

This restraint is not new. When Russian forces invaded Georgia in 2008, NATO condemned the action but within months resumed business-as-usual engagement. The 2014 annexation of Crimea drew sanctions, yet European capitals simultaneously deepened energy dependence on Russian gas. The full-scale invasion of Ukraine in February 2022 finally produced a unified economic response, but military aid to Kyiv has been calibrated to avoid "provocation", a concept the Kremlin has learned to exploit.

The logic of hybrid escalation

Peter Dickinson, editor of the Atlantic Council's UkraineAlert service, argues that Putin's calculus rests on a simple observation: the democratic world condemns but rarely punishes. "Nothing is more likely to provoke Putin than Western weakness," he writes. The Kremlin's current strategy combines intensified bombardment of Ukrainian cities and infrastructure with a parallel campaign of sub-threshold aggression against NATO members, sabotage, cyber operations, airspace incursions, disinformation, designed to fracture European resolve without crossing the threshold of conventional war.

Denys Shmyhal, Ukraine's Prime Minister, has warned that Moscow will expand attacks on the civilian population and critical infrastructure in the coming months as Putin seeks to break Ukrainian resistance by sheer attrition. The hybrid campaign against NATO serves the same objective: to convince European publics that the cost of supporting Kyiv is becoming unbearable.

Why NATO has not answered

The alliance's hesitation is structural. Article 5 requires consensus; a single member can block a collective response. Several European governments, particularly those with significant economic ties to Russia or domestic political movements sympathetic to the Kremlin, have consistently opposed measures that could be framed as escalation. The result is a pattern of deliberate ambiguity: incidents are acknowledged in private, minimised in public, and answered with nothing that would force the Kremlin to recalculate.

This dynamic was visible after the Polish missile strike. Warsaw could have invoked Article 4, triggering mandatory consultations. It chose not to. After Leipzig, Berlin could have demanded a North Atlantic Council meeting. It did not. In both cases, the calculation was that the political cost of a confrontation outweighed the strategic cost of silence. Putin reads that calculation clearly.

The Baltic scenario

Military planners in several NATO capitals have long identified the Baltic states as the most probable flashpoint. Their geography, narrow borders with Russia and Belarus, limited strategic depth, significant Russian-speaking minorities, offers the Kremlin multiple vectors for a deniable incursion. A scenario rehearsed in recent exercises involves unmarked troops seizing a border crossing or a small town, followed by a rapid information operation framing the action as protection of local populations. The alliance would then face a choice: respond with force against a nuclear-armed adversary, or accept a fait accompli.

The 2023 Vilnius summit strengthened forward defences, deploying multinational battlegroups to each Baltic state and Poland. But those forces are tripwires, not warfighting formations. Their purpose is to ensure that any Russian attack kills soldiers from multiple NATO nations, making political denial impossible. Whether that logic holds against a sub-threshold operation, no uniforms, no heavy armour, no formal declaration, remains untested.

What the alliance could do

Options short of war exist. NATO could declare a pattern of hybrid aggression and invoke Article 4 collectively, rather than leaving it to the targeted state. It could impose sectoral sanctions on Russian intelligence agencies and their commercial fronts. It could establish a rapid attribution mechanism, publishing technical evidence of Russian responsibility within days of each incident. It could integrate national air defence systems into a single command structure capable of intercepting drones without national political approval for each engagement.

None of these steps requires unanimous consent for kinetic action. All would signal that the alliance treats hybrid warfare as warfare. So far, the political will to implement them has been absent. The question is whether the next incident, or the one after that, will finally concentrate minds.