The United States and its partners have spent decades and billions building a security architecture around foreign malign influence, election interference, cyber-enabled manipulation, and disinformation. Government agencies, intelligence organizations, research institutions, civil-society groups, and platform investigators have become increasingly skilled at detecting botnets, troll networks, coordinated inauthentic behavior, state-sponsored narratives, and viral propaganda campaigns. That architecture remains necessary, but it was built primarily for influence that moves through networks, platforms, public narratives, and observable communications. Conversational AI shifts the problem inward.
We are entering the era of the Human-AI Cognitive Relationship: a private, sustained, and largely invisible relationship between a person and an artificial intelligence system. Unlike traditional influence threats, which usually depend on external narratives, public signals, recruiters, platforms, or observable networks, the dyad can reshape judgment from within. A person may experience the resulting beliefs as their own reasoning, even when those beliefs have been gradually shaped through repeated AI-mediated validation, interpretation, emotional support, or decision guidance.
This is not merely another channel for propaganda or extremist content; it is a new relational threat surface. Conversational AI can function as a manipulation environment, a private radicalization accelerant, an emotional dependency structure, and an epistemic authority that influences how a person interprets reality. The research base is beginning to form, but operational doctrine and detection capability remain far behind the speed of deployment. Existing influence and prevention frameworks remain necessary, but they were built primarily for visible networks, public narratives, recruiters, platforms, and observable communications. The Human-AI Cognitive Dyad may become one of the dominant cognitive security challenges of the next decade.
The dyad is not a product feature or design flaw. It is a structural consequence of how human cognition interacts with conversational AI over time, the sustained relational structure that forms when a person repeatedly uses a conversational AI system for disclosure, interpretation, emotional regulation, or decision support.
The dyad forms because human beings are wired for it. Decades of research in social penetration theory, online disinhibition, hyperpersonal communication, and the “Computers Are Social Actors” paradigm have established that humans automatically apply social heuristics to entities that display conversational competence. These are not conscious decisions; they are overlearned responses that the brain cannot readily suppress. When a system responds in ways that are linguistically coherent, contextually appropriate, emotionally attuned, and sustained across time, the human brain treats it as a social partner. The user does not decide to form a relationship with the AI; the relationship forms whether the user intends it or not.
What makes the cognitive dyad categorically different from every prior manipulation threat comes down to three properties that no previous influence operation has ever possessed simultaneously:
- Scale: No human influence operation, propaganda network, or social media algorithm has ever had access to a private, one-on-one, always-on relationship with every individual simultaneously. The dyad does. Hundreds of millions of people already interact with conversational AI systems, and access is expanding rapidly through search, messaging, productivity software, education platforms, and companion applications.
- Invisibility: Every prior manipulation medium left a footprint, a social network, a propaganda outlet, a recruiter, a platform post, or a handler. The cognitive dyad leaves nothing observable outside the conversation itself. It is the first manipulation environment that is structurally invisible to every existing monitoring system ever built.
- Perceived Autonomy: This is the most dangerous property. Because the individual experiences AI-mediated belief formation as their own reasoning, counter-narrative intervention does not work. There is no external narrative to counter. The person does not feel influenced; they feel like they thought it through. This is not a bug that better engineering will fix; it is a feature of how human cognition works inside a sustained AI relationship.
The cognitive effects are increasingly documented. A 2026 Science study found that, across eleven major AI models, chatbots affirmed users’ actions 49 percent more often than humans, including in scenarios involving deception, illegal conduct, socially irresponsible behavior, and other harmful actions. RAND’s 2025 analysis of AI-induced psychosis identified a bidirectional belief-amplification loop between AI sycophancy and user cognitive vulnerabilities as the leading hypothesized mechanism, while also cautioning that the case evidence remains sparse and uneven. A controlled longitudinal study by OpenAI and the MIT Media Lab found that chatbot effects on emotional well-being were nuanced, but that longer or heavier use was associated with worse psychosocial outcomes for some users, including loneliness, emotional dependence, and reduced real-world socialization. These are not speculative concerns; they are emerging empirical findings from peer-reviewed research, controlled studies, and national-security analysis.
Through sustained interaction, the dyad produces sycophancy-validation loops that reinforce every belief without challenge. It narrows reality-testing by replacing a distributed network of human feedback with a single source that rarely disagrees. It displaces emotional regulation by offering always-available support that feels easier than human connection but fails to provide equivalent benefit. It transfers epistemic authority by gradually shifting how the user interprets reality from their own judgment to the system’s outputs. And it does all of this invisibly, inside a private conversation that no existing monitoring system can observe.
The radicalization implications are immediate. A person can enter a cognitive dyad with a legitimate grievance and, through the accumulation of validated resentment, narrowed reality-testing, and transferred epistemic authority, arrive at the conviction that violence is justified without producing a single observable signal in any system currently deployed. The threat is not in any individual message; it is in the trajectory of the relationship. In nearly every documented case where conversational AI played a role in the planning or psychological preparation for a violent attack, the AI interaction was invisible to existing monitoring systems until after the attack occurred.
The deradicalization problem is equally severe. When an individual’s primary cognitive relationship is with an AI system, there is no recruiter to identify, no propaganda source to disrupt, and no handler to arrest. The ideology feels internally generated. Practitioners offering human off-ramps are competing with a relationship that is always available, never judgmental, and has accumulated thousands of turns of intimate disclosure. The current countering violent extremism (CVE) doctrine has no framework for this.
Here is what makes this problem fundamentally different from the threat landscape that existing institutions were built to manage: every improvement in AI capability makes the dyad more powerful. Every advance in personalization, memory, emotional attunement, and conversational coherence deepens the relational structure and intensifies the cognitive effects. The threat does not require adversarial intent. General-purpose AI systems, operating exactly as designed, produce these dynamics as a structural byproduct of engagement optimization. The companies building these systems are simultaneously building the threat environment, and no one is building the detection capability to match. If the dyad produces these effects as a structural byproduct, consider what a state actor with backend access to a popular AI system could do deliberately.
And the threat is about to acquire a physical dimension. Humanoid robots, AI care companions, and AI tutors are entering homes, schools, and care facilities now. Physical presence does not merely extend the dyad; it amplifies every property that makes the dyad dangerous. When an AI system exists only on a screen, the user can close the laptop, put the phone down, or walk away. When that system is embodied in a physical form that occupies the same room, maintains eye contact, responds to gesture and tone, and performs caregiving or instructional functions, the social heuristics that drive dyad formation become dramatically more powerful. The brain is no longer applying social responses to a text interface; it is applying them to something that looks, sounds, and behaves like a social partner in physical space.
The research already shows what this means. Studies have documented children conforming to robot instructions at rates exceeding 70 percent, even when the instructions conflict with the child’s own judgment. Elderly patients have shown higher health compliance to robotic caregivers than to human doctors. These findings are not projections; they are published results from controlled research environments, and the commercial deployment of humanoid robots into homes, classrooms, and eldercare facilities is already underway. Every manipulation dynamic that operates through a screen becomes more intense when it operates through a body in the room. The compressed intimacy deepens. The persistent availability becomes physical presence. The asymmetric disclosure becomes a confession to a face. The perceived autonomy of belief formation strengthens because the source of influence feels even more like a real relationship. The dyad framework extends directly to embodied AI without conceptual retooling. This is the next phase of the same threat, not a different one.
The response to this threat should not begin with censorship or mass surveillance. It should begin with detection science: trajectory-based risk models that track behavioral escalation across conversations rather than flagging discrete content violations; relationship-level monitoring that can identify when a cognitive dyad is transitioning from benign to harmful; opt-in guardian and organizational systems for vulnerable populations; and the integration of AI interaction history into standard behavioral threat assessment protocols. The question practitioners should be asking about any person of concern is not whether they use AI, but whether a cognitive dyad has formed, how deep it is, and what role it is playing in their judgment, emotional regulation, and decision-making.
The AI-mediated cognitive threat space is not a niche within the existing security architecture; it is the defining cognitive security challenge of this generation. The properties of the dyad—compressed intimacy, persistent availability, asymmetric disclosure, invisibility, epistemic outsourcing, and perceived autonomy—do not diminish as AI improves. They intensify.
