25 April 2026, Assassin tries to kill President Trump and cabinet at Washington Hilton during White House Correspondents dinner

Note: This analysis is based on current open-source reporting. The US Secret Service (USSS) is expected to release an official report on the attack that may add to, clarify, or contradict information presented here. Muir Analytics will adjust its analysis accordingly.

On 25 April 2026, an assassin driven by extremist left-wing ideology, Cole Tomas Allen, a 31-year-old from Torrance, California, tried to kill President Donald J. Trump, Vice President JD Vance, and members of the cabinet at the Washington Hilton during the White House Correspondents Dinner. The attacker breached the USSS’ outer perimeter in a foyer adjoining the ballroom and fired a shotgun as he advanced. A uniformed USSS agent opened fire, causing the gunman to trip and fall before other agents physically apprehended him. It was another close call for the president — and one that offers significant lessons for hotel and VIP security.

Bottom line up front

  1. The attacker successfully infiltrated the Washington Hilton through standard hotel operations, but failed to penetrate the USSS’ layered inner security.
  2. The attack exposed persistent vulnerabilities in hotel-based VIP protection such as stairwells and Trojan-horse infiltration tactics.
  3. The perpetrator’s manifesto reflected a dehumanizing far-left ideological framework that morally justified assassination and civilian collateral damage.
  4. The incident reinforces that the United States is operating in a persistent low-level political violence environment.
  5. Future attackers will study this incident and adapt – more sophisticated tactics, techniques, and procedures (TTPs) — including coordinated assaults, diversions, drones, explosives, and multi-attacker operations — are possible, reinforcing the growing importance of hotel threat intelligence for security, law enforcement, and insurance risk mitigation.

Justification of violence

The New York Post published the would-be killer’s full manifesto on 26 April 2025. The document outlined both his justification for murder and his targeting regimen:

  • He believed one person could change — or improve — the world through assassination of perceived oppressors. He wrote, “What my representatives do reflects on me” and “I am no longer willing to permit a pedophile, rapist, and traitor to coat my hands with his crimes.”
  • He framed the administration as oppressors and said he would not be complicit “in the oppressor’s crimes.” Oppressor-versus-oppressed ideology was therefore a clear driver.
  • He also argued the United States was ruled by law, not by “one or several people,” and claimed he was not obligated to follow what he viewed as illegally formed laws imposed by “a king and his court.”
  • He further claimed he was motivated by revenge for, or protection of, people allegedly raped in detention camps, Latin American fishermen “executed without trial,” schoolchildren “blown up,” starving children, and teenage girls “abused by the many criminals in this administration.”

Targeting regimen

The same manifesto dictated who the gunman wanted to kill in specific order:

  • Primary targets: President Donald J. Trump and his cabinet. The assassin stated FBI Director Kash Patel was not on the target list.
  • Secondary targets: Any law-enforcement personnel — including USSS agents — or hotel security personnel who attempted to stop him.
  • Tertiary targets: Civilians or bystanders who got in his way. In the would-be killer’s words: “If it were absolutely necessary (on the basis that most people chose to attend a speech by a pedophile, rapist, and traitor, and are thus complicit) but I really hope it doesn’t come to that.”

The manifesto concluded with expressions of affection toward his family, friends, and students.

He signed the document: “Cole ‘coldForce’ ‘Friendly Federal Assassin’ Allen.”

Weapons procurement

According to the United States District Court for the District of Columbia’s indictment of the perpetrator and an FBI affidavit in support of the indictment, the perpetrator secured the following weapons well before his attack:

  • On or about 17 August 2025, Allen purchased a Mossberg Maverick 88 12-gauge pump shotgun from a firearms dealer in California. When arrested, he possessed 45 rounds of buckshot ammunition for the weapon.
  • On or about 6 October 2023, Allen purchased a Rock Island Armory 1911 .38 Super semi-automatic pistol from a different California firearms dealer. Interestingly, this caliber is mostly associated with competition shooting, and certainly still lethal. When arrested, he possessed 55 rounds of ammunition for the pistol.
  • WJLA further reported that Allen also carried two knives, four daggers, multiple sheaths and holsters, needle-nose pliers, wire cutters, a Samsung cellphone, extra magazines, and additional ammunition.

Movement to target

According to the FBI affidavit supporting the indictment, the perpetrator’s movement to target was as follows:

  • 2 March 2026: President Trump publicly announced on Truth Social that he would attend the White House Correspondents Dinner. The announcement was widely reported by the media.
  • 6 April 2026: The perpetrator reserved a room at the Washington Hilton for 24-26 April 2026.
  • 21 April 2026: Allen traveled by Amtrak from Torrance, California, to Chicago, arriving on or about 23 April 2026.
  • 23-24 April 2026: After arriving in Chicago, he boarded a train to Washington, D.C., departing at approximately 1:00 p.m. on 24 April.
  • 24 April 2026: Allen checked into a room on the 10th floor of the Washington Hilton at approximately 3:00 p.m., according to the Hindustan Times, and remained there overnight.

The perpetrator’s hotel reconnaissance and perception of security

As later revealed by CCTV footage, reports CNBC and KATV, the perpetrator conducted multiple reconnaissance walks through the hotel after checking in, surveying both his planned attack point and other areas of the property.

In his manifesto, the assailant also commented on what he perceived as weak USSS security. Among his observations:

  • “I walk in with multiple weapons and not a single person there considers the possibility that I could be a threat.”
  • “The security at the event is all outside, focused on protestors and current arrivals, because apparently no one thought about what happens if someone checks in the day before.”
  • “Like, this level of incompetence is insane, and I very sincerely hope it’s corrected by the time this country gets actually competent leadership again.”
  • “Like, if I was an Iranian agent, instead of an American citizen, I could have brought a damn Ma Deuce* in here and no one would have noticed s–t.” *A “Ma Deuce” is military slang for a .50-caliber heavy machine gun used against infantry, vehicles, equipment, and aircraft.
  • The perpetrator also checked the website “Presidential Schedule – CivicTracker” on his cellphone to confirm the president’s whereabouts.

Movement from hotel room to attack launch point

  • Just before 8:40 p.m., according to the FBI and reports by the Los Angeles Times, the perpetrator took a selfie of himself fully armed and emailed his manifesto justifying the attack to family members before leaving his room.
  • The perpetrator then left his room and entered an interior stairwell, says CBS News, to access the Washington Hilton’s Terrace Level, which connected via another staircase to the White House Correspondents Dinner one floor below. CBS described the area as “the same level as the foyer leading to the dinner’s red carpet, just yards from an access point to the ballroom.”
  • ABC 3340 reported — based on widely released CCTV footage captured just before and during the attack — that the perpetrator walked down a hallway toward a USSS checkpoint that was being dismantled before peeling off into a room off-camera. The footage also clearly shows him carrying a case under his right arm.
  • At that juncture, a USSS K-9 dog noticed the perpetrator and twice moved toward him, but the handler disengaged.

The attack

  • Photographic and video analysis indicates the checkpoint was staffed by one suited USSS agent, five uniformed USSS officers — two of whom were dismantling a walk-through magnetometer — and four additional uniformed personnel wearing what appeared to be Department of Homeland Security uniforms.
  • The security posture was mixed. Three DHS-looking officers stood against a wall, while three uniformed USSS officers clustered around the magnetometers. One officer — later identified by the FBI as “US Secret Service Officer V.G.” — was facing the threat area.
  • The suited agent had his head on a swivel but was not facing the threat when the attack began.
  • At approximately 8:40 p.m., according to the FBI and widely released video footage, the perpetrator charged out of the room firing his shotgun as he passed the checkpoint.
  • Within roughly two seconds, Officer V.G. drew his pistol and fired at least three rounds. One shot was fired while the assailant stood point-blank between V.G. and the suited agent.
  • According to the FBI, Officer V.G. was struck in the ballistic vest by a single buckshot pellet.
  • Several uniformed officers moved off-camera, while the suited agent — seemingly momentarily shocked by the gunfire — instinctively drew his weapon, tracked the assailant, and moved left.
  • The two officers dismantling the magnetometer immediately drew their weapons and faced the threat, with one joining the suited agent.
  • The assailant then apparently tripped and fell, where multiple USSS agents, off-camera, swarmed and arrested him.
  • Moments later, three suited agents with pistols drawn burst through a nearby doorway and moved toward the threat alongside the previously mentioned uniformed officers.
  • Newsweek says that USSS Director Sean Curran confirmed that only two individuals fired weapons during the incident: Allen and a Secret Service agent.

As a side note, video analysis and on-scene reporting indicate there were at least five visible or reported layers of USSS security — plus additional law enforcement personnel — protecting the president and other VIPs at the White House Correspondents Dinner:

  • Secret Service personnel outside the hotel facing protesters.
  • A second layer on the Terrace Level near the magnetometers.
  • Another layer at the ballroom entrance area.
  • Individual VIP close-protection teams inside the ballroom.
  • The Counter Assault Team (CAT), equipped with military-style tactical gear and M4-style rifles.

When the perpetrator launched his attack, at least nine-armed personnel were seen responding on camera.

At the same time, video posted by USA Today showed at least 30 armed agents swarming the ballroom, including four CAT personnel with M4-style rifles, as they secured their principals and moved them off the X.

Based on the Washington Hilton Terrace Level floor plans (again, one floor above the target ballroom) and an on-scene account of the White House Correspondents’ Dinner security setup, the assailant’s sprint spanned an estimated 15–30 yards. The entire melee unfolded in roughly 15 seconds.

A Heightened Threat Environment

Muir Analytics has warned about this exact scenario — and similar attack models — in numerous briefs, including:

The United States is experiencing a persistent low-level political violence environment, technically, a Low Intensity Conflict (LIC), marked by assassinations, raids, and strike/riot/civil commotion (SRCC) events that have caused billions in property damage and numerous deaths and injuries. Current violence has been driven primarily by far-left extremists and Islamist jihadists, though far-right political violence, while less frequent, remains present and could expand rapidly.

Sustained political dehumanization rhetoric is a major contributing factor. Language portraying political opponents as dictators, fascists, Nazis, racists, rapists, kings, and existential threats has become commonplace in parts of the political and media environment. Public rhetoric advocating violence against President Trump has likewise become increasingly normalized in some circles.

Far-left attackers’ manifestos, slogans, and operational rhetoric demonstrate that these sentiments are real and actively in play. For example, the far-left unit that attacked the Prairieland ICE Detention Center in Alvarado, Texas, on 4 July 2025 operated under a flag reading “Resist Fascism, Fight Oligarchy” and distributed flyers stating “Fight ICE terror with class war” and “Free all political prisoners,” according to The Dallas Express. Charlie Kirk’s assassin invoked anti-fascist justification rhetoric, while the would-be Washington Hilton assassin echoed similarly.

Additionally, recent polling reflects acceptance for political violence in the United States.

  • YouGov reports that 72% of Americans say violence to achieve political goals is never justified, while just 11% say it can be, with the remainder, 17%, undecided or not responding. This means 28% did not say no.
  • The Hill reported that 25% of self-described “very liberal” respondents told YouGov that political violence may sometimes be warranted.
  • A fall 2025 Harvard Youth Poll, reported by The Crimson, found that 39% of Americans aged 18-29 believed political violence is acceptable under certain circumstances, while 56% said it is never acceptable.

Takeaways

There are 10 takeaways. First, the perpetrator’s tactics were partly successful and partly unsuccessful.

His planning, reconnaissance, and venue infiltration worked. The attacker demonstrated methodical operational planning, including low-security travel selection (Amtrak), target reconnaissance, venue familiarization, and deliberate exploitation of hotel and USSS security gaps, particularly via the stairwell. He also successfully entered and operated inside the hotel as a normal guest — effectively a Trojan-horse infiltration consistent with standard hotel operations.

His assault TTPs, however, failed. The attack was stopped by the USSS’ layered security, including multiple belts of protection, large numbers of armed personnel, and significant separation from the principal targets. To breach that depth of security, the attacker would have required more sophisticated and more forceful TTPs.

Second, the perpetrator failed to achieve his strategic end goal. He believed assassinating President Trump and members of the administration would end perceived tyranny, murder, and corruption. There is no indication that killing individual political leaders would have altered the broader policies or political system he opposed.

Third, regarding justification of violence, the perpetrator’s manifesto suggests he adopted a far-left ideological framework that morally justified violence against President Trump, senior officials, security personnel, and potential bystanders. Echoing rhetoric used by some left-wing politicians and pundits, he dehumanized these individuals as illegitimate threats to America and his moral worldview, leaving violence, in his mind, as the only solution – the final solution.

This dehumanization process mirrors ideological justification frameworks historically used by violent extremist movements and regimes, including the Nazis, Leninists, Maoists, al-Qaeda, ISIS, and others.

Fourth, and related to the previous point, the attacker’s ideology defined his targeting regimen — who morally deserved death (the president and cabinet), who did not (FBI Director Kash Patel), and who was considered acceptable collateral damage, including security personnel, civilians who got in his way, and attendees he viewed as complicit supporters of an “illegitimate” president.

The logic mirrors a longstanding extremist mindset in which civilian casualties are rationalized as necessary to achieve ideological ends — summarized by New York Times Moscow bureau chief Walter Duranty’s infamous justification of Stalinist mass violence of those who resisted communism in 1932-1933 (quoted by NPR): “You can’t make an omelet without breaking eggs.”

Fifth, the USSS’ layered security worked, but the attack exposed vulnerabilities that can be corrected for future hotel events. At least five visible or reported protective layers — possibly more — were in place:

  1. Outer hotel perimeter security.
  2. Terrace-level screening.
  3. Ballroom-access security.
  4. Close-protection teams near their principals.
  5. CAT.

Security at the terrace level stopped the assassin.

At the same time, the incident suggests potential gaps in:

  1. Screening hotel guests during high-risk VIP visits.
  2. Protective posture for a repeatedly targeted principal.
  3. Internal hotel movement control, including stairwell coverage.
  4. Suspicious-behavior detection.

The stairwell appears to have been a key vulnerability. Hotels contain multiple vertical movement routes, and attackers routinely exploit stairwells because they provide concealment, rapid movement, and access between guest, public, and event spaces. In a high-threat presidential venue, stairwells near protected movement routes should be priority control points.

Likewise, the attacker carrying a case under his right arm near the magnetometer checkpoint should have triggered immediate scrutiny in a presidential-security environment. It is a small tactical detail, but an important one.

More broadly, the threat environment against President Trump was already elevated due to repeated assassination attempts and sustained extremist political rhetoric. This incident suggests a possible disconnect between strategic threat awareness and tactical venue hardening.

Sixth, hotels are uniquely difficult protective environments because they are semi-public spaces combining public access and event venues with guest privacy, private rooms, multiple entrances, stairwells, back-of-house areas, and parking facilities. Accordingly, when hotels host high-risk political principals, the entire property becomes part of the security environment. Security cannot be limited to the ballroom, checkpoint, or immediate VIP bubble. Hotel management, private security, and government protective teams must jointly account for all of these spaces.

Seventh, hotels — in this case, Hilton Worldwide Holdings Inc — also have a direct interest in preventing such incidents to protect their brand and revenue. A major assassination attempt or mass-casualty event can create reputational damage, civil litigation, insurance exposure, operational disruption, and long-term brand harm.

Even when government security is present, the hotel may still face scrutiny following an attack.

Eighth, this attack reinforces that the United States is operating in a light LIC environment. The polling data and the attack frequency confirm it. It is not comparable to Northern Ireland during the Troubles, nor to Iraq, Afghanistan, or El Salvador during the 1980s. The US has also experienced more sustained political violence in past decades. In 1971-1972 alone, says Time, the country suffered roughly 2,500 bombings in 18 months — nearly five per day — by groups including the Weather Underground, New World Liberation Front, and the Symbionese Liberation Army. The Ku Klux Klan bombed Birmingham, Alabama so frequently between 1947-1965 that it became known as “Bombingham.”

Still, the US experienced nearly 20 politically motivated attacks in 2025-2026 alone that could legally qualify as terrorism. Most were carried out by far-left extremists or Islamist jihadists, though far-right extremists were responsible for two attacks that could be categorized as terrorism.

Ninth, looking forward, and unfortunately, far left-wing news pundits and top-ranking politicians will not stop their violent, dehumanizing rhetoric. Further political violence can be expected in the immediate and intermediate term. Retaliatory or reactive far-right violence can occur at any juncture.

Current indicators suggest continued risk from Islamist jihadists, too. And, as ever, Iran-aligned Shia extremist networks and other jihadist actors can also be expected to seek opportunities for violence.

More sophisticated TTPs from all sectors remain possible.

As with past incidents, some of this violence will inevitably spill over into hotels and other semi-public venues.

Tenth, foreign and domestic terrorists, political assassins, and violent extremist groups will study this incident for a SWOT analysis — strengths, weaknesses, opportunities, and threats. A more capable attacker, or coordinated assault team, could adapt with more aggressive TTPs, including diversions, multiple assailants, explosives, drones, or heavier weapons.

A key tool for improving hotel event and VIP security is hotel threat intelligence — data, statistics, trends, and case studies. This intelligence directly informs mitigation measures for hotel security, law enforcement, and both private and government VIP protection teams such as the USSS. It also helps hotel insurance risk managers, brokers, and underwriters better understand violence risks and peril trends, supporting stronger client advisory and more effective policy language.

Muir Analytics runs the world’s largest, most sophisticated hotel violence database – the SecureHotel Threat Portal – with over 3,600 hotel attacks (and growing). We can provide the hospitality, insurance, and law enforcement/government sectors with intelligence that facilitates full-spectrum risk reduction, which helps hotels protect guests, staff, buildings, brands, and revenues. Contact us for a consultation:  1-833-DATA-444.

Sources and further reading:

“Cole Tomas Allen shooting: Reporter flags major security lapses at Washington Hilton, says he spent night next to assassin,” Hindustan Times, 9 May 2026.

“VIDEO: K-9 appears suspicious moments before Secret Service officer is shot at WHCD,” ABC 3340, 1 May 2026.

“VIDEO: K-9 appears suspicious moments before Secret Service officer is shot at WHCD,” KATV, 1 May 2026.

“Video shows Cole Allen casing hotel, storming checkpoint in alleged Trump assassination attempt,” CNBC, 1 May 2026

“Secret Service Director discusses how Cole Allen went down unshot as new video released,” Newsweek, 30 April 2026.

“Court document shows new details, pictures of accused gunman Cole Tomas Allen,” WJLA, 28 April 2026.

“Investigators say Allen boarded a Los Angeles Amtrak train bound for Washington,” NewsNation, 28 April 2026.

“Mystery surrounds Cole Tomas Allen and frantic moments of D.C. attack,” Los Angeles Times, 28 April 2026.

“Court document reveals new details about correspondents’ dinner,” CBS, 27 April 2026.

“White House Correspondents’ Dinner Suspect Rode Train Across Country,” AOL, 27 April 2026.

“Who is Cole Allen? WHCD suspect charged with attempting to assassinate President Trump,” 13WHAM ABC News, 27 April 2026.

“Read White House Correspondents’ Dinner suspect Cole Allen’s full anti-Trump manifesto,” New York Post, 26 April 2026.

“What I saw and felt inside the ballroom during the WHCD shooting,” New York Magazine’s Intelligencer, 26 April 2026.

“What we know about the suspect in shooting at White House Correspondents’ Dinner,” CBS News, 25 April 2026.

“White House Correspondent’s dinner shooting: Surveillance and suspect arrest video + ballroom scenes,” USA Today, 26 April 2026.

“Nearly 40% of young Americans say political violence Is acceptable in certain circumstances, Harvard poll finds,” The Harvard Crimson, 3 December 2025.

“Liberals more likely to say political violence sometimes justified,” The Hill, 15 September 2025.

“What Americans really think about political violence,” YouGov, 12 September 2025.

“‘Ambush’: Anti-enforcement militants allegedly shot officer, targeted detention center,” Dallas Express, 6 July 2025.

“‘The New York Times‘ can’t shake the cloud over a 90-year-old Pulitzer Prize,” New York Times, 8 May 2022.

“The bombings of America that we forgot,” Time, September 20 September 2016.

United States District Court for the District of Columbia, indictment of Cole Thomas Allen, 25 April 2026.

US Department of Justice, AFFIDAVIT IN SUPPORT OF A CRIMINAL COMPLAINT, Case 1:26-mj-00080-MJS, Document 1-1, 27 April 2026.

“Floor plan Washington Hilton – Lobby Level, Terrace Level, Concourse Level,” Washington Hilton (event floor plan PDF).

Copyright©Muir Analytics 2026

Picture of Jeff Moore

Jeff Moore

Dr. Jeff Moore is a globally recognized expert in threat analysis, intelligence, terrorism, insurgency, and conventional warfare. He leads the world’s largest hotel violence database, the SecureHotel Threat Portal, now an advanced, AI-powered risk intelligence tool. Need a custom threat or risk assessment for travel, hotels, or corporate operations? Contact Jeff today.