Iran has “substantially increased efforts to target U.S. personnel,” Director of National Intelligence Jay Clayton told Secretary of State Marco Rubio in a memo on Friday, Oct. 23, and its “lethal plotting efforts” against U.S. citizens “have reached advanced stages in both the Middle East and certain other countries.” CIA Director John Ratcliffe was copied. Axios reported the memo first, CBS News and The New York Times obtained or confirmed it, and a U.S. official confirmed to NBC News that it is authentic.
The memo is unclassified and does not name targets, countries or a timeline, CBS reported. It doesn’t say whether an attack is imminent.
A warning written for people who can’t read the intelligence
The most unusual line in the memo is about clearances. Clayton told Rubio the risk is “relevant to more individuals than are currently cleared to receive this information,” according to the text NBC News published, and promised that the intelligence community would downgrade as much of the underlying reporting as it could so Rubio could share it with State Department staff at his discretion.
That puts a classification problem at the center of the threat. The people most exposed, diplomats and other U.S. government employees at posts across the region, mostly can’t see the reporting that describes the danger to them. The memo’s own subject line, per the Times, is “lethal plotting against Americans in the Middle East and certain other countries.” Downgrading usually means stripping out the details that would reveal how the intelligence was gathered, so that people with lower clearances can be told what it says. Clayton’s office and the CIA declined to comment to the Times.
Operatives in the U.S.? One official says so, another urges caution
The Times added detail the memo itself doesn’t contain. U.S. officials told the paper that agencies rate the threat to Americans in the Middle East and several other countries at its highest level since the war began on Feb. 28, and that President Trump and his aides have been getting regular briefings on it. Analysts have spent the past three weeks examining intelligence on threats to U.S. officials, ambassadors among them.
One official told the Times that some material indicates Iran may have operatives in the United States. Officials also said Iran’s plans include potential targets in Europe. Both points come from unnamed officials quoted by the Times, and neither appears in the memo’s published text. Another official in the same report cautioned that Iran’s ability to strike inside the United States and elsewhere abroad is limited, and that its ambitions exceed its capability.
The White House did not respond to the Times. As of Saturday, Iran had not publicly responded to the memo.
Restricted operations, and a drawdown officials now tie to Iran
On Wednesday the State Department ordered non-emergency employees and their families out of Saudi Arabia, and at the time its spokesperson pointed only to Houthi attacks on the kingdom. The explanation has since widened. “The threat of Houthi attacks and of Iranian terror plots targeting U.S. officials are informing our decisions,” a U.S. official told CBS News on Friday, describing staffing at embassies on restricted operations status.
That status, which the department now applies to almost all U.S. missions in the Middle East according to the Times, lets a post shrink its staff without issuing a public departure order. A State Department official told NBC News that posts in Lebanon, the United Arab Emirates, Qatar and Jordan were ordered to cut staff further. Officials told the Times the drawdown is a direct result of the new intelligence. The military has also been quietly reducing its presence at posts in the region, a U.S. official and a senior military official told CBS.
Earlier this month the Air Force pulled all 12 B-1 bombers from RAF Fairford in southern England after commanders received information about Iranian threats to the base, the Times reported.
Three cases already in the court record
The memo gives no details, but U.S. prosecutors have laid out what earlier Iranian plots against Americans looked like.
In August 2022, the Justice Department charged Shahram Poursafi, identified as a member of Iran’s Revolutionary Guard, with trying to arrange the murder of former national security adviser John Bolton. According to an FBI affidavit, Poursafi offered $250,000 to people in Maryland and Washington to carry out the killing, in presumed retaliation for the January 2020 U.S. strike that killed Quds Force commander Qassem Soleimani, the Associated Press reported. He was wanted by the FBI when the charges were announced, and we found no record of an arrest since.
In November 2024, prosecutors in New York charged Farhad Shakeri and two New York men in a plot to kill a U.S. citizen of Iranian origin, a journalist, in New York. Then-Attorney General Merrick Garland said Shakeri had been tasked with directing criminal associates to advance Iran’s assassination plots, “including President-elect Donald Trump.” The department said Shakeri was at large and believed to be living in Iran.
The only one of the three cases to reach a verdict is Asif Merchant’s. A Brooklyn jury convicted the Pakistani businessman on March 6 of murder for hire and attempted terrorism transcending national boundaries. Merchant testified that a Revolutionary Guard handler sent him to arrange a political assassination in 2024 and raised names including Trump, then-President Biden and Nikki Haley, according to the AP. He paid undercover FBI agents posing as hit men $5,000 in cash and was arrested on July 12, 2024, as he prepared to fly to Pakistan. He faces up to life in prison.
Iran has denied such plots. It called U.S. claims of an Iranian threat to Trump’s life in 2024 “unsubstantiated and malicious,” the AP reported.
“Another little Epic Fury”
The warning comes as the administration weighs whether to resume strikes. The same day the memo was sent, Trump told a rally in Florida, “We may do another little Epic Fury, or they’ll agree,” CBS reported, referring to the campaign that began the war in February. The Times reported Wednesday that U.S. and Israeli planners have drawn up a new wave of strikes for after the Nov. 3 midterm elections, and that Trump has not made a final decision.
We covered the Saudi order and the dispute over a wider Gulf pullout in U.S. Orders Diplomats Out of Saudi Arabia, the bomber withdrawal in our RAF Fairford report, and the shipping war in our Hormuz Tanker Attack Tracker. The memo’s text is quoted in CBS News and NBC News. The Justice Department’s releases on the Poursafi, Shakeri and Merchant cases are on its website.
Sources
- Axios, “Scoop: U.S. intel memo warns of ‘advanced’ Iranian plots to kill officials abroad” (Oct. 24, 2026). Used for: first report of the memo.
- CBS News, “Iran has ‘increased efforts to target U.S. personnel,’ intel chief warns” (Oct. 24, 2026). Used for: the memo’s wording, its unclassified status, Ratcliffe, the missing targets and timing, the U.S. official’s staffing statement, the military drawdown and Trump’s rally remark.
- NBC News, “Iranian plots to kill U.S. officials in Middle East have reached ‘advanced stages,’ intel memo warns” (Oct. 24, 2026). Used for: authenticity, the clearance and downgrade passage, and further staff cuts in Lebanon, the UAE, Qatar and Jordan.
- The New York Times via Oman Observer, “Iran in ‘advanced stages’ of planning attacks against Americans, US officials say” (Oct. 24, 2026). Used for: the threat level, briefings, possible operatives in the U.S., targets in Europe, the capability caveat, the subject line, comment requests, restricted operating status, the drawdown link and RAF Fairford.
- Al Jazeera, “Is Iran planning attacks on Americans; why is the US on alert?” (Oct. 24, 2026). Used for: no Iranian response to the memo.
- Associated Press via NBC New York, “Iranian operative charged in plot to murder former national security adviser John Bolton” (Aug. 10, 2022). Used for: the Poursafi case.
- U.S. Department of Justice, “Member of Iran’s Islamic Revolutionary Guard Corps (IRGC) Charged with Plot to Murder Former National Security Advisor” (Aug. 10, 2022). Used for: the Poursafi charges.
- U.S. Department of Justice, “Justice Department Announces Murder-For-Hire and Related Charges Against IRGC Asset and Two Local Operatives” (Nov. 8, 2024). Used for: the Shakeri case and Garland’s statement.
- Associated Press via News4JAX, “Man convicted in political assassination plot he tied to Iranian paramilitary” (March 6, 2026). Used for: the Merchant trial, testimony, payment and arrest.
- U.S. Attorney’s Office, Eastern District of New York, “Iranian Intelligence Agent Convicted of Terrorism and Murder-for-Hire in Connection with Foiled Plot” (March 6, 2026). Used for: the Merchant verdict and charges.