Center for Cyber Diplomacy and International Security

By Vladimir Tsakanyan, Ph.D.
Center for Cyber Diplomacy and International Security (CCD-IS)

On November 10, 2026, Stanford’s Institute for Human-Centered Artificial Intelligence and the Max Planck Society published institutional accounts of the third One Hundred Year Study on Artificial Intelligence report. Their central policy challenge is international: AI capabilities are spreading through societies whose governments disagree about how those capabilities should be governed. For cyber diplomacy, the implication is that shared exposure to risk does not automatically produce shared authority or common rules.

The new assessment, AI Goes Mainstream: The Scaling Era and the Rise of Generative AI, belongs to a longitudinal research project administered at Stanford HAI. It is an expert study, not a treaty, regulatory decision or government intelligence finding. The verified same-day development is the institutions’ November 10 presentation of the report and its findings. [Stanford HAI, November 10] [Max Planck Society, November 10]

A longer historical lens

AI100 was launched in 2014 and has produced assessments in 2016, 2021 and now 2026. An international panel draws on computer science, philosophy, sociology and related disciplines to examine AI’s effects on people and institutions. The five-year interval provides a useful historical comparison: a technology once discussed principally as a specialised research capability has become a pervasive social and political force. [Max Planck Society]

That perspective changes the policy question. Forecasting whether a capability might someday matter is different from deciding how responsibility should work when organisations already depend on it. Governments must now consider the institutions through which AI is purchased, deployed, evaluated and challenged. The quality of those institutions can matter as much as the performance of a model.

Historical comparison also encourages caution. A report that documents rapid change cannot establish that every forecast will materialise at the same pace or with the same consequences. A responsible reading separates observations, interpretations and expectations, and asks what evidence would warrant revising each of them.

Security risks cross institutional boundaries

Stanford’s account identifies cybersecurity as an area in which AI can support both attack and defence, and describes agent-based capabilities as a growing concern. These are research assessments of an evolving capability landscape. They do not establish that every available agent can independently compromise defended infrastructure, or that a specific state directed a particular incident. [Stanford HAI]

For policymakers, the important inference is organisational. If a system combines planning, software execution and access to external services, oversight must address the authority it receives and the consequences of its actions. Evaluating an isolated model is therefore only part of the task. Operators also need to understand who authorises deployment, who can interrupt it and who preserves the evidence needed after a failure.

Those questions become international when a developer, service provider, customer and affected institution operate in different jurisdictions. A national regulator may possess legal authority over one participant without practical access to the others. Cooperation on evaluation and incident information can reduce that gap, provided it respects confidentiality, security and the differing responsibilities of each participant.

Competition and public accountability

The Max Planck Society’s summary highlights the concentration of frontier development among a small number of U.S. and Chinese actors, limited public participation and fragmented international governance. These are the panel’s diagnoses, rather than evidence that all states or companies share an identical interest. [Max Planck Society]

The strategic difficulty is that governments can pursue technological autonomy while remaining dependent on external models, chips or services. Sovereignty cannot be assessed solely by the location of an office or a server. It also depends on whether institutions can evaluate the systems they use, change suppliers when necessary and investigate consequential failures.

Public participation deserves an equally practical interpretation. Consultation has value when it can influence deployment conditions, procurement priorities and routes for redress. A broad statement of concern achieves less if affected communities cannot discover who made a decision or how to contest it. This is a policy conclusion drawn from the report’s themes, not a new obligation created by its publication.

The international security significance of AI100 lies in connecting capabilities with the institutions that must govern them. Its November 10 presentation supplies a research-based occasion to assess that relationship; it does not resolve the underlying disagreements. Progress should be judged by whether governments and developers make responsibilities clearer, evidence more usable and cross-border cooperation more effective as AI becomes embedded in everyday systems.

Cover: AI-generated illustration of fictional researchers; not a photograph of the AI100 panel.