International briefing — ClearPath Partnership

If you just remember one thing from this briefing…

US intelligence now assesses Putin may probe NATO's Article 5 threshold with a small, deniable attack rather than open war.

The assessment surfaced days after an explosive-laden drone was found beside a Ukrainian cargo aircraft at Leipzig/Halle airport, which Germany's interior minister called a new threat scenario. Expect ambiguous, hard-to-attribute incidents, not a clear opening move. Ask your crisis team this week whether your response plan assumes attribution will be available before you have to act.

Fortnight in review

Geopolitics, defence and security

Priority5–7 Aug

Explosive drone at German airport; US assesses Russia may test NATO's Article 5

A drone carrying explosives was found near a Ukrainian cargo aircraft at Leipzig/Halle airport overnight on 5–6 August, forcing diversions and a partial closure. US officials separately assessed Russia may attempt a limited, deniable strike on a NATO member to test alliance resolve short of Article 5.

So what: treat sub-threshold attacks on domestic infrastructure as a live contingency. Crisis plans should assume attribution will be contested, not certain, when the moment comes.

Priority1, 6, 8 Aug

Ukraine's strikes reach 1,600km into Russia, hitting refineries three times in a week

Ukrainian forces struck oil refineries in Bashkortostan on 1 August, roughly 1,600km from the border, then Yaroslavl on 6 August and Krasnodar region on 8 August, degrading Russian refining capacity and export revenue. The campaign has been sustained, not a single spike; Russian confirmation of damage remains limited.

So what: long-range strike and precision-munition demand is not slowing. Check whether your defence supply chain is positioned for sustained, not surge, production.

Priority2 Aug

EU AI Act reaches full enforcement

The Act's remaining obligations took effect on 2 August, with penalties of up to €35 million or 7 per cent of global turnover for non-compliance. It applies extraterritorially to any organisation placing an AI system on the EU market, regardless of where that system was developed.

So what: confirm which of your AI systems are in scope, including embedded third-party models, and that conformity documentation exists before a regulator asks for it.

Priority30 Jul–5 Aug

AI agent used to automate cyberattacks at scale against internet-facing systems

Unit 42 identified a China-based actor running the DeepSeek model inside an open-source agent framework to autonomously find and exploit flaws in Citrix, Tomcat and other internet-facing software across more than 460 targets. CISA added related CVEs to its exploited-vulnerabilities catalogue on 5 August. The actor is assessed as independent, not state-sponsored.

So what: AI-driven exploitation shortens the gap between disclosure and mass exploitation. Patch timelines built around days of grace no longer hold.

ClearPath Partnership · International briefing · Edition 021 of 2

International briefing · Edition 02Actions, regulatory watch and outlook

Watch list

Developments to track this fortnight

Development	Region	Sector affected	What to watch next
North Korean missile unit deployed to Russia	Europe / Russia	Defence, security	Whether Western governments corroborate Ukrainian GUR reporting, and whether the systems see use.
Japan fires first ship-launched Tomahawk	Indo-Pacific	Defence	Whether Chinese coercive activity around Taiwan resumes after an unusually quiet 2026.
Philippines–China dispute over Scarborough Shoal filing	South China Sea	Security, supply chain	Beijing's next enforcement step, and any US–Philippines alliance response.
China's rare-earth export suspension	Global / China	Supply chain, defence	Whether Beijing extends the pause past its 10 November 2026 deadline.
US AI OVERWATCH Act, chip-export veto	United States	Technology, supply chain	Whether the bill advances to a floor vote; volatility in China chip licensing.

Regulatory and sector watch

What changed, and what is coming

In force now

EU AI Act, full enforcement since 2 August: penalties up to €35 million or 7 per cent of global turnover.
China's rare-earth export suspension (holmium, erbium, thulium, europium, ytterbium) remains a pause, not a reversal, to 10 November 2026.

Approaching

EU's 21st Russia sanctions package: tranches barring 33 more Russian financial institutions and five oil traders take effect 13 August.
AI OVERWATCH Act remains in US House committee; no confirmed floor vote yet — status unchanged since June.

Standing watch — Red Sea and Gulf shipping. Houthi forces claimed a missile attack on a Saudi-flagged tanker near Yanbu on 5 August, following Saudi Arabia's rerouting of shipping away from Bab el-Mandeb; the claim is unconfirmed. Treat Gulf-facing routing risk as elevated, not resolved.

Recommended

Three things to do before the next edition

Confirm which AI systems, including embedded third-party models, fall under EU AI Act scope, and that conformity documentation is ready.
Check exposure to Citrix, Apache Tomcat, Langflow and N-central against CISA's KEV catalogue — AI-accelerated exploitation shortens the patch window.
Map single-source dependency on Chinese rare earths ahead of 10 November, and stress-test crisis plans against an ambiguous, sub-Article-5 incident.

Outlook — next fortnight

We assess it is likely that further ambiguous, low-signature incidents will target NATO members' civilian or logistics infrastructure before the next edition, and a realistic possibility that China clarifies its post-November rare-earth posture ahead of the deadline. Both will generate reporting that outruns verification — treat first accounts as provisional.

Next edition

Monday 24 August 2026. Send additions, corrections or sector intelligence to your ClearPath engagement lead.

ClearPath Partnership · clearpathpartnership.com · Judgements are analytical assessments, not statements of fact.2 of 2

Week commencing10 August 2026