China Prepares for an AI Cyber Crisis as “Mythos” Shifts from Power to Protection

Foreign Affairs zeroes in on a coming threat: an AI cyber crisis. The piece argues that China is preparing for that kind of moment not just with technical capability, but with a story, what it calls a “mythos” that reframes AI power as something that must be defended and managed. In other words, the crisis is the destination, the narrative is the route.

Why this matters right now: AI is not waiting for governments, regulators, or corporate risk frameworks to catch up. When “AI cyber crisis” becomes the default scenario in national thinking, the ripple effects show up everywhere, including procurement rules, incident response expectations, and how leadership teams communicate risk internally. Foreign Affairs presents this as a preparation phase, which is a big deal because preparation is when organizations can still choose their architecture, contracts, monitoring strategy, and governance model, instead of scrambling after the first major breach.

To understand the logic, it helps to zoom out on how cybersecurity planning typically works. Most organizations treat cyber risk as an operational threat model: vulnerabilities, threat actors, patches, and monitoring. But an AI cyber crisis is different in kind. It is not only about software vulnerabilities. It is about how intelligent systems can be targeted, how data and decisions can be manipulated, and how automated behavior can multiply the speed of harm. In that environment, “security” becomes inseparable from governance. The board is no longer just asking, “Are we patched?” It also has to ask, “Do we have guardrails for how AI systems are used, tested, monitored, and escalated when something goes wrong?” Foreign Affairs is essentially pointing to a world where these questions become harder because governments are already planning for them.

This is where China’s “mythos” framing becomes more than rhetoric. A mythos is a narrative that shapes behavior across institutions. If the story is “AI power requires security,” then security investment is not just compliance. It is framed as necessary to preserve legitimacy, stability, and capability. That is exactly the kind of positioning that can accelerate policy action. When states build a public and institutional narrative around a threat, they can justify tighter rules, stronger enforcement, and faster deployment of capabilities. Even companies that would normally prefer slower, case-by-case regulation can find themselves operating inside a policy tempo that is driven by worst-case planning.

Now connect the dots to second-order implications for decision-makers. When an AI cyber crisis becomes part of national preparation, vendors and partners feel it first. Contract language shifts. Audit expectations increase. Incident reporting timelines get stricter. Internal controls get formalized, sometimes earlier than executives would have chosen. Board dynamics change too. Cyber risk debates stop being purely IT-led and become enterprise-led. Finance, legal, and compliance get pulled into decisions about model access, data governance, logging, and vendor oversight because the operational footprint of AI is now a security footprint. Foreign Affairs’ emphasis on preparation signals that these changes are not hypothetical.

There is also an international angle, even if the immediate story is framed around China. The “mythos” strategy suggests that security competition will not only be about faster defenses. It will also be about shaping norms and expectations. If one major player is investing in narrative-driven security preparation, other governments and companies will respond, either by aligning their own planning to avoid being caught unready, or by designing countermeasures that assume accelerated escalation. That is how crises get pre-built into industry roadmaps before the crisis ever happens.

For peers managing AI products, platforms, or infrastructure, the takeaway is blunt. You cannot treat AI cybersecurity as a one-time project or a checklist activity. Foreign Affairs frames the moment ahead as a crisis that organizations should assume is coming. That means leadership teams should treat AI security planning as a continuous governance system with escalation paths, not a static set of controls. If China is preparing by combining capability with a security-focused mythos, then the operational environment for everyone else is likely to harden around similar expectations. Boards that plan now get choices. Boards that wait get constraints.