US officials determined there was a credible threat from Iranian proxy forces targeting President Donald Trump and Air Force One during the NATO summit in Ankara, Turkey, prompting the Secret Service to recommend that Trump change aircraft before departing, according to reporting by the New York Times and confirmed by CBS News (New York Times).

Trump had arrived in Ankara aboard the new Qatari-donated Boeing 747-8, which lacks the advanced defensive systems fitted to the legacy Air Force One airframe. After the threat was detected, Trump announced he would depart Turkey on the older aircraft instead. He did not provide a detailed public explanation at the time, saying he would use the legacy plane "for old time's sake" (The Guardian). NPR reported that Trump flew part of the return trip aboard the older Air Force One. Both planes made a previously unscheduled stop at RAF Mildenhall, a UK base used by US troops, before continuing to the United States.

According to CBS News sources, the Secret Service decided to switch planes after receiving intelligence involving a plan to fire a missile at the president's aircraft. US officials did not assess that Iranian proxy forces were specifically targeting the new Boeing 747-8; the intelligence indicated the threat was directed at Trump himself and whichever aircraft he was traveling on (The Guardian).

The New York Times first reported the plane switch as a security precaution on July 8, 2026, more than two weeks before its detailed July 24 report naming the Iranian proxy threat. Euronews also reported on July 8 that Trump would leave Turkey on the older Air Force One rather than the Qatari-gifted aircraft. Trump departed Turkey on a Wednesday night aboard the legacy airframe.

The plane-switch revelations surfaced as Trump was reportedly considering escalating attacks on Iran after a ceasefire deal broke down. He vowed "major military punishment" for Tehran and its Houthi allies. Trump has previously spoken publicly about threats from Iran against his life and said he left standing orders for the US military to destroy Iran at unprecedented levels if Tehran assassinates him (The Guardian).

The reporting also intersects with a separate press-freedom dispute. Trump's Justice Department had previously subpoenaed New York Times reporters over their coverage of security risks involving the Qatari-gifted Air Force One replacement. The department dropped those subpoena efforts, as reported on July 23, 2026, one day before the detailed threat reporting was published.

The broader context here is a security architecture under strain on multiple fronts. The decision to switch aircraft mid-summit suggests that US protective intelligence assessed the missile threat as credible enough to override the operational and logistical complexity of transferring a president between airframes on foreign soil. The fact that the threat was directed at Trump personally rather than at a specific aircraft indicates that the substitute plane was not, by itself, a solution. The legacy Air Force One's defensive countermeasures, including missile countermeasures and secure communications hardened against interception, would have reduced vulnerability relative to the unequipped Qatari-donated 747-8. But the move also relied on the assumption that the threat could not be readily re-tasked to the replacement aircraft, an assumption that depends entirely on the quality and timeliness of the underlying intelligence.

The episode also raises questions about the decision to accept and deploy the Qatari-donated aircraft in the first place. The Justice Department's subpoena of NYT reporters covering security risks tied to the replacement plane suggests that the administration viewed such reporting as damaging, even as the plane's operational limitations have now been laid bare by an actual threat scenario. The timing, with the subpoenas dropped one day before the threat reporting went public, may reflect a calculation that continued legal pressure on reporters would be politically untenable once the underlying security concerns were confirmed by the government's own actions.

Meanwhile, the concurrent escalation rhetoric, including Trump's standing deterrence orders and his vow of "major military punishment" for Iran and its Houthi allies, places the Ankara incident within a cycle of retaliation and counter-retaliation that has already collapsed at least one ceasefire. The use of proxy forces for a leadership-targeting operation, if the intelligence holds up under further scrutiny, would represent a significant escalation in the Iran-US confrontation, moving from theater-level attacks on US assets abroad to a direct attempt on the president's life. Whether the administration treats this as a red line crossed, or as leverage in an already destabilized negotiating environment, will shape the next phase of US-Iran military posture.