Why has the European Union been able to craft a unified sanctions policy against Russia but failed to rein in Russia's ‘Trojan horses’ within the EU that pursue pro‐Putin foreign policies? We argue that the EU suffers from a specific type of disaggregation in its foreign and security policy. While the EU's Common Foreign and Security Policy has increased its capacities over time, the EU still lacks the power to prevent Member States from pursuing their own independent policies. In the face of the Ukraine crisis, for instance, the EU marshaled a surprisingly strong sanctions regime, but could not prevent Member States from pursuing divergent pro‐Russia policies, such as signing new energy deals or granting port access for Russian naval forces. As EU foreign and security powers grow, foreign powers face increasing incentives to cultivate Trojan horses among the EU Member States.