NATO’s autumn test may stay deniable

US intelligence agencies now assess that Vladimir Putin could probe a NATO country as early as autumn 2026. The scenarios range from cyberattacks to a small-scale land incursion (WSJ, CNN/KEYT). A ground incursion is described as the least likely option. The point of the reassessment is not that Russia would start a war with NATO. It is that Moscow might stage something designed to be disputed — an incident where allies spend days arguing whether an attack happened at all.

The treaty works on agreement, not autopilot

NATO's Article 5 (the collective-defence clause signed in 1949) says an armed attack on one ally is an attack on all. It does not trigger an automatic military response (NATO). Each government decides individually what action to take.

The alliance runs on consensus: all members must agree on what occurred, who was responsible, and whether the threshold for collective defence was crossed. A conventional invasion is easy to classify. A cyberattack that blacks out a Baltic power grid, unmarked personnel near a border facility, or drones that could be Ukrainian strays leave allies debating attribution while Moscow watches.

Lithuania and Romania are already living this

Lithuania's Defence Minister Robertas Kaunas said last week that military intelligence sees Russia considering Baltic provocations, possibly using Ukrainian-made drones as false-flag tools (LRT). He stressed there is no decision or date. Vilnius responded by deploying troops to guard the Klaipėda LNG terminal, the LitPol Link electricity switchyard and the Kruonis pumped-storage plant, and asked NATO and the EU to strengthen critical-infrastructure protection (Delfi).

Romania shows what the first minutes of an ambiguous probe look like in practice. Between 24 and 26 July, Romanian forces shot down three drones near the Ukrainian border. On 2 August, the defence ministry tracked a target over territorial waters for roughly 20 minutes; fragments fell at Periprava, about a kilometre from the frontier (Libertatea, Digi24). Tulcea residents received shelter warnings. The airport closed. Before anyone in Brussels could discuss Article 5, Romania's chain of radar detection, civilian alert and F-16 scramble had already been tested under pressure.

Finland offers the calm end of the spectrum. Helsinki maintains there is no immediate military threat and assesses that Russia would need years to build forces near its border (Yle).

Where agreement could break

Hungary shows how an ambiguous incident becomes a framing fight before it becomes a military question. Hungarian coverage of the US assessment focuses on whether cyber or sabotage would politically qualify for collective defence at all (Portfolio). Budapest's government maintains pragmatic ties with Moscow, linked to Russian oil, gas and the Paks II nuclear project (Blikk). None of this proves Hungary would block Article 5 after a clear armed attack. But energy dependence and a domestic "stay out of war" stance could slow the attribution debate in exactly the kind of murky incident the US report describes.

The intelligence shift does not forecast a NATO war. What it confirms is what Lithuania's infrastructure deployments and Romania's drone shootdowns have shown for weeks: NATO's guarantee depends on whether capitals can detect, attribute and decide fast enough for the treaty to matter. Each allied government should be pressed to answer a specific question: what cyberattack, sabotage operation, drone strike or border incident would it treat as an armed attack, and how quickly would it say so?