The History of AI in Security and Defence

First version 25 October 2026, last changed 31 October 2026 · Andreas Stockter

Artificial intelligence in security and defence means that armed forces, intelligence services and police forces use computational methods that take over tasks for which humans were needed until now: finding a target in a radar picture, assembling a situation from a thousand reports, guiding a drone to its target, discovering a security flaw before the adversary does. The field is as old as AI itself, and for a long time it was AI’s most important paymaster: the first learning machines were paid for by the US Navy, the Pentagon’s research agency funded the laboratories from which the history of AI emerged, and the network over which this text is being read was its by-product. At the same time it is the field in which the question of what a machine may decide was first not a question of philosophy but one of the trigger.

Like the other chronicles on this site, the text follows a chain: each era solves a bottleneck that the previous one left open, and creates the next one in doing so. Here the bottleneck has had the same shape since the Second World War. Whoever acts in war runs through a loop: observe, make sense of the situation, decide, act, and whoever runs through it faster than the opponent wins. Each stage of this history moves another link of the loop from the human to the machine (Figure 1). First computing was the bottleneck, then knowledge, then seeing, then speed, and finally the decision itself. What remains open at the end is the same as at the beginning, except that the machine can by now do almost everything else: who approves the target, and who answers for it.

The text deals with defence and internal security at once, because the methods are the same and so are the companies: the same software that proposes targets in Ukraine analyses police data in Hesse, and the same language model that finds flaws in operating systems ran intrusions in 2025. What it does not offer is a verdict: whether a weapon that chooses its own target belongs under a ban is decided by states in Geneva and New York, and the text reports what they have decided so far. Every technical term is set in bold at the point where it is explained, and is only used after that. A glossary lists all terms alphabetically.

Contents: 1 Computing for war · 2 The agency · 3 Strategic Computing · 4 Drone and statistics · 5 Autonomy and seeing · 6 Engineers and agencies · 7 Ukraine, Gaza, rules · 8 Language model · Chain · Timeline · Further reading · Sources · Glossary

1. Computing for war: anti-aircraft fire, codes and SAGE (1940–1958)

The problem. An aircraft flying over London at 500 kilometres per hour in 1940 was four kilometres further on twenty seconds later, and an anti-aircraft shell needed twenty seconds to reach that height. Whoever aimed at the aircraft hit air. Aiming meant predicting: calculating from the path so far the place where the aircraft would be when the shell arrived, and doing so in seconds, against a pilot who could take evasive action. The calculation was too fast for humans and too irregular for the mechanical predictors that had been cranking courses and angles since the First World War. That was the first bottleneck of this history, and the answer came from mathematics, not from mechanics.

Wiener’s prediction. Norbert Wiener, a mathematician at MIT, received money at the end of 1940 from the American research council for armaments, the NDRC under Vannevar Bush, for a predictor that treats the path of an aircraft as a statistical time series: the pilot’s movements are not arbitrary, an aircraft cannot jump, and from the past of the path the most probable future can be calculated, together with the error one has to reckon with. With the engineer Julian Bigelow he built a device by 1942 that demonstrated the idea but looked only seconds ahead where the guns needed twenty, and he wrote a treatise on filtering and predicting noisy signals that, as a classified report, was so hard to understand that the engineers called it “the yellow peril” after the colour of its cover.¹ In 1943 the NDRC let the contract lapse because the predictor of Bell Laboratories, on which Hendrik Bode also worked with the same mathematics, was further along; this device, the M-9, together with radar and the proximity fuse, shot down most of the incoming V1 flying bombs on the English coast by the end of August 1944.² Wiener drew from the work a lesson larger than anti-aircraft fire: pilot, gun and computer form a circle in which observation steers action and action steers the next observation. In 1948 he called the principle cybernetics, after the Greek word for helmsman, and in the book that introduced the word he described feedback, learning and the nervous system as examples of the same mathematics.³ The book summed up the ideas of a circle from which the artificial neuron of McCulloch and Pitts (1943) also came, the neuron that the history of AI places at its beginning. Wiener himself declared publicly in January 1947 that he would no longer work for the military, because after Hiroshima scientists no longer knew what would happen with their results. He remained alone with this stance for a long time.⁴

Codes. The war’s second calculation was decipherment. At Bletchley Park near London, Alan Turing built the “bombe” in 1940, an electromechanical machine that found the daily keys of the German Enigma by trial, and the engineer Tommy Flowers built Colossus in 1944, the first electronic computer with a programme, which broke the teleprinter cipher of the German high command; ten Colossus machines were running at the end of the war, and their existence remained secret for three decades.⁵ In the United States, Claude Shannon wrote a classified report at Bell Laboratories in 1945 on the mathematics of encryption, published in 1949, which proved what a key must achieve for a message to be unbreakable; his theory of information of 1948, which the history of the mathematics behind AI explains, had grown out of the same work.⁶ The intelligence services that came out of the war, the British GCHQ and the American NSA founded in 1952, were computing centres from the start, and for decades they remained the largest buyers of computing power, long before anyone said AI.

SAGE. The computer that put the loop into operation for the first time was the largest ever built. After the first Soviet atomic test in 1949 the United States needed an air defence that detects bombers over the North Pole before they reach the cities, and a committee under George Valley at MIT recommended in 1950 that the continent’s radar stations be connected to digital computers. Jay Forrester had been building the Whirlwind computer at MIT since 1944, originally for a flight simulator, and in 1951 Whirlwind became the heart of the project. On 20 April 1951 Whirlwind guided an interceptor for the first time onto a target that a radar had reported. The SAGE system, Semi-Automatic Ground Environment, put its first centre into operation in July 1958 and was complete in 1963: 24 direction centres and three combat centres in concrete bunkers, each with a pair of AN/FSQ-7 computers from IBM that had 49,000 vacuum tubes and weighed 250 tons, plus dozens of consoles with screens on which officers pointed a light gun at radar tracks. The computer combined the reports of all radar stations into tracks, calculated the course for each track, assigned the interceptors their path and could guide the anti-aircraft missiles; the human chose what was attacked.⁷ The programme cost an estimated eight to twelve billion dollars, more than the Manhattan Project; the division RAND set up for its software, soon spun off as a company of its own, had up to a thousand employees within a year, and the system was finished when the Soviet intercontinental missiles, against which it could do nothing, were already flying.⁸ What remained was more than air defence: core memory, the modem, the screen with light pen, software as an industry and the booking system SABRE, which IBM derived from SAGE for American Airlines in 1960. And what remained was the image that the field has carried ever since: a room full of screens in which humans point at tracks that a machine has found. The history of the Internet tells what became of the lines.

The lesson of RAND. The Air Force had founded a think tank in Santa Monica in 1948, the RAND Corporation, and there two questions met in 1952. In a systems research laboratory, Air Force crews replayed air defence for weeks, with simulated radar screens, to learn how humans decide under time pressure; Allen Newell and Herbert Simon, who watched, concluded that humans process information like a programme, and in 1956 wrote with Cliff Shaw on the RAND computer JOHNNIAC the Logic Theorist, the programme with which the Dartmouth conference founded the field.⁹ The second question RAND asked itself: how does a command network survive a nuclear strike? Paul Baran’s answer of 1964, a network without a centre, became the Internet. And in 1957 the Navy paid for the perceptron, the first machine that learned from its mistakes, with the aim of recognising aircraft in aerial photographs; that the New York Times made of it the computer that “will be able to walk, talk, see, write, reproduce itself and be conscious of its existence” is told by the history of the mathematics behind AI.¹⁰

Try it yourself. The bombe of Bletchley Park and the Enigma can be replayed in the browser: the Crypto Museum’s pages and the Enigma simulation of the Cryptii project show what a daily key looked like and why no human found it by hand. The film “In Your Defense”, which the Air Force made about SAGE in 1956, is in the Internet Archive and shows the screens and the light gun in operation. Wiener’s book of 1948 is available as a reprint and readable for long stretches without mathematics; the chapter on feedback explains the loop that carries the rest of this text in Figure 2.¹¹

The bottleneck. In 1958 a machine could follow radar tracks, calculate courses and guide fighters, and it could break codes that no human broke. What it could not do was know: whether the track was a bomber or a flock of geese, which target counted first and what an opponent intended was in no programme. SAGE had solved the computing and left the deciding to humans, and the agency that grew out of the shock of Sputnik set about teaching the machine knowledge.

2. The agency and the battlefield of sensors (1958–1983)

ARPA. On 4 October 1957 the Soviet Sputnik orbited the earth, and in February 1958 the Pentagon founded an agency that was to ensure that the United States would never again be technically surprised: the Advanced Research Projects Agency, ARPA, since 1972 DARPA, with the D for Defense. It had no laboratory of its own, but money and programme managers who gave it to universities and companies, and in October 1962 the psychologist J. C. R. Licklider took over its new office for information processing.¹² Licklider came from air defence; he had worked at Lincoln Laboratory on the consoles of SAGE and in 1960 had described in “Man-Computer Symbiosis” how human and computer should think together in real time, because a commander has no time to wait for the batch.¹³ With his budget he funded the laboratories from which AI emerged: Project MAC at MIT, John McCarthy’s laboratory at Stanford, the group around Newell and Simon in Pittsburgh, the Stanford Research Institute. Until the end of the 1960s the greater part of the money spent on AI in the United States came from this one office, and in the first years it hardly asked what for.¹⁴

Shakey. What for was shown by the first robot that planned its own actions. From 1966 to 1972 the Stanford Research Institute built Shakey with ARPA money, a trolley with a camera that translated a room into symbols and searched in them for a path to its goal; the history of AI tells what the researchers learned from it. The report with which the institute accounted for the first phase in 1968 was called “Application of Intelligent Automata to Reconnaissance”: the idea was a scout that moves through enemy terrain. Life magazine presented the robot in November 1970 as the “first electronic person”.¹⁵ From the project come the search algorithm A* and the planning programme STRIPS, and both are to this day in navigation devices and in the software with which aircraft and drones plan their routes. Shakey needed hours for one task, and it never saw terrain that was not a laboratory.

The battlefield of sensors. In the Vietnam War the Pentagon took the loop into a war for the first time. From 1968 aircraft dropped tens of thousands of sensors over the Ho Chi Minh trail in Laos that reported vibrations, sounds and the smell of engines; aircraft picked up the radio signals and relayed them to two IBM computers at a base in Thailand, where officers in front of screens tracked truck convoys and directed bombers onto the coordinates. The programme was called Igloo White, cost about a billion dollars a year and reported destruction that the supply volumes in the south did not explain.¹⁶ General William Westmoreland, the Army chief of staff, described the goal to armaments engineers in October 1969: on the battlefield of the future, enemy forces would be located, tracked and engaged “almost instantaneously” through data links, computer-assisted intelligence evaluation and automated fire control, and the number of soldiers would fall.¹⁷ That was the loop of Figure 2 as a programme, half a century before Project Maven, and the speech already named the point that has been at issue ever since: who in this chain decides whether to fire, it did not say.

The limit of the money. The agency’s freedom ended with the war. Senator Mike Mansfield pushed through in 1969 that the Pentagon may only pay for research with a recognisable military relevance, and ARPA had to justify every project; in 1972 it got the D in its name.¹⁸ In Britain the research council had the mathematician James Lighthill assess AI in 1972, and his report, published in 1973, declared the hopes for robots “gravely disappointed”, whereupon the field in the country lost confidence and a large part of its money for a decade.¹⁹ The philosopher Hubert Dreyfus had written the report “Alchemy and Artificial Intelligence” for RAND in 1965, which disputed the field’s basic assumption and was dismissed by the researchers as an outsider’s attack; the Air Force had paid for it.²⁰ In the United States George Heilmeier took over the leadership of DARPA in 1975 and demanded from every project answers to a list of questions that began with “What are you trying to do?”; the speech recognition programme that the agency had launched in 1971 with the goal of understanding spoken sentences from a thousand words he let expire in 1976 without a successor, although the Harpy system of Carnegie Mellon University had reached the mark in September 1976 with 1,011 words and five per cent errors.²¹ The agency that had founded AI had put it at arm’s length for a decade, and the field called the years its first winter.

The machine shoots. While research waited, the weapon itself became automatic, without anyone calling it AI. The Phalanx close-in weapon system, which the Navy installed on its ships from 1980, is a radar with a six-barrelled gun that detects, tracks and fires on incoming missiles by itself, because in the last seconds there is no time for a human.²² The Aegis combat system, commissioned in 1983 with the cruiser Ticonderoga, combined radar, computers and missiles into a system that tracks hundreds of targets at once and in one of its modes fires without further approval; the human sets the mode and can intervene.²³ For the distinction that these systems demand, the debate later found three phrases, which Figure 3 shows: the human is in the loop when he approves every action, on the loop when the machine acts and he watches and can abort, and out of the loop when he only learns afterwards what happened. Phalanx and Aegis put the human on the loop in 1983, and the justification was always the same: time.

The false alarm. What automation meant at the most dangerous point was shown by the early-warning systems. On 9 November 1979 the screens of the North American air defence command reported a major Soviet attack, first 250, then 2,200 missiles; ten interceptors took off, the president’s airborne command post took off without the president, and the national security adviser was woken at three in the morning before it turned out that test data had got into the display. In June 1980 a faulty chip costing 46 cents produced the same alarm twice, bomber crews ran to their aircraft, and the Senate had the incident investigated.²⁴ On the other side, on 26 September 1983, Lieutenant Colonel Stanislav Petrov sat in a bunker south of Moscow when the satellite system reported five American missiles launching; he judged the alarm to be an error, because a first strike with five missiles made no sense, and reported that upwards. It was sunlight on clouds.²⁵ At the same time the Soviet Union built a system that answered the question the other way round: Perimeter, called “Dead Hand” in the West, was meant, after a nuclear strike, when the leadership no longer answered, to pass launch authority to officers in a bunker whose command missiles radio the order to the intercontinental missiles; it entered service in 1985, and how much of it was automatic is disputed to this day.²⁶ The film “WarGames” came to the cinemas in June 1983 and let an air defence computer rehearse the Third World War; President Reagan afterwards asked his advisers whether such a thing was possible, and the answer led in 1984 to the first directive on computer security.²⁷

Try it yourself. Westmoreland’s speech of 1969 can be read in the proceedings of the Association of the U.S. Army and is reprinted in Paul Dickson’s book “The Electronic Battlefield”; whoever lays the sentences next to the announcement of Project Maven in Section 6 finds almost the same words. The National Security Archive at George Washington University has released the investigation reports on the false alarms of 1979 and 1980; they are short and read like a record of what Figure 3 calls “on the loop”.²⁸

The bottleneck. In 1983 the machine guided missiles and guns faster than a human could watch, and the early-warning system hung on chips costing 46 cents. What it lacked was what Shakey and speech recognition had promised: to know what it saw. A radar reported tracks, not a tank; a sensor reported vibration, not a truck. The decision stayed with the human because the machine had no basis for it. Exactly this knowledge the Pentagon wanted to buy from 1983, with the largest sum ever spent on AI.

3. The grand plan: Strategic Computing, SDI and the Gulf War (1983–1991)

The programme. In October 1983 DARPA presented the most expensive plan AI had seen until then. The Strategic Computing Initiative was to spend about a billion dollars in ten years to turn the expert systems that were just becoming a business in the companies into machines for the military, and it named three goals that everyone understood: a vehicle that drives through terrain without a driver, a computer in the cockpit that stands by the pilot as co-pilot, and a system that orders the situation for a fleet commander and makes proposals.²⁹ The occasion was twofold. Japan had announced its Fifth Generation project in 1982, and industry feared losing touch; and President Reagan had proclaimed the Strategic Defense Initiative on 23 March 1983, a shield of satellites and missiles that was to intercept Soviet warheads in flight, controlled by software that decides in minutes. An expert system, which draws conclusions from hundreds of if-then rules of a specialist, as the history of AI describes it, seemed to be the tool for that.

The three goals. The driverless vehicle, built by Martin Marietta for ten million dollars, an eight-wheeled vehicle with cameras and laser, followed a dirt road near Denver for just under a kilometre on 31 May 1985, at five kilometres per hour, drove at twenty in 1986, in good light on a paved road, and got stuck at shadows and puddles; in 1987 it ventured into terrain, and in April 1988 DARPA cancelled it. Carnegie Mellon University learned on its own vehicle Navlab that seeing was the problem, not driving, and from this laboratory came the winners of the DARPA Grand Challenge twenty years later.³⁰ The Pilot’s Associate, developed by Lockheed and McDonnell Douglas, ran in the simulator in 1988 six times slower than reality, in 1989 faster, and never in an aircraft. The Navy’s fleet system completed planning tasks of fifteen hours in ninety minutes at Pearl Harbor in 1987 and remained a prototype. When the programme expired in 1993 it had advanced the computers, the compiler builders and image recognition, achieved none of its three goals and repeated the lesson of Shakey: the world outside does not fit into rules. The historians Alex Roland and Philip Shiman, who have described the programme from the files, call it a failure in its goals and a success in its means.³¹

The critics. For the first time computer scientists objected publicly. Staff of the Xerox research centre in Palo Alto who had been meeting since 1981 incorporated the association Computer Professionals for Social Responsibility in 1983 and warned in a paper of 1984 that the programme wanted to transfer decisions over life and death to systems whose behaviour could not be tested under the conditions of a real emergency.³² David Parnas, who in 1972 had laid the foundation of large software with the principle of information hiding, as the history of software development tells, accepted a seat on the advisory panel of the SDI in May 1985, for a thousand dollars a day, and resigned it on 28 June. In eight short essays he explained why the software of a missile shield could never be trustworthy: it could not be tested under real conditions, the requirements would only be known when the attack came, and neither expert systems nor automatic programming nor proofs about programmes could change that. The essays appeared in December 1985 in the field’s most important journal and are to this day the textbook case for what software can and cannot do in a decision that takes seconds.³³

Vincennes. What watching on the loop is worth under pressure was shown on 3 July 1988 in the Persian Gulf. The cruiser USS Vincennes, equipped with Aegis, was in combat with Iranian speedboats when its radar picked up an aircraft climbing from the airport of Bandar Abbas, which was used both civilly and militarily. An operator had mistakenly assigned the contact the identification of a fighter jet, the crew reported a descending aircraft in an attack profile although the system displayed the data of a climbing airliner, and the cruiser shot it down seven minutes after take-off with two missiles: Iran Air 655, an Airbus with 290 people on board, all dead. The Navy’s investigation found no fault in the Aegis system; it found humans who under stress read into the screens what they expected, and a commander who in a few minutes trusted a picture he could not check.³⁴ The lesson since then has been that a machine that calculates correctly does not protect humans from false conclusions, and that the time the automaton gains is missing for the human who is supposed to supervise it.

The Gulf War. The war that liberated Kuwait in 1991 was the first that AI fought along in the background. For the transfer of half a million soldiers and their material to Saudi Arabia, DARPA had the company BBN and three partners build a planning tool in ten weeks, DART, which drew up the transport plans for tens of thousands of items in minutes instead of hours or days and recalculated at every change; a specialist checked the plans, the machine made them. Victor Reis, then director of the agency, said later that this one tool had within a few months paid back everything DARPA had spent on AI in thirty years.³⁵ In front of the television cameras stood other machines: cruise missiles that found their target with stored terrain images, laser-guided bombs whose hits the Pentagon showed daily, and the Patriot air defence that intercepted Iraqi Scud missiles. How many it hit became a dispute after the war; the Pentagon first spoke of almost all, assessors of Congress later held most of the kills to be unproven.³⁶ On 25 February 1991 a Scud struck a barracks in Dhahran and killed 28 American soldiers. The Patriot battery in front of it had not fired: its software counted time in tenths of a second, the conversion lost a little accuracy with every hour of operation, and after a hundred hours without a restart the clock was off by a third of a second, enough for the radar to look for the missile almost seven hundred metres away from its path. The fix had been released on 16 February and reached Dhahran the day after.³⁷ The error was in no expert system; it was in the calculation that every one of these systems has carried since SAGE, and it showed that the time the machine gained depended on a clock.

Try it yourself. Parnas’s essays of 1985 are freely available online and read in an hour; whoever lays them next to the debate about language models in Section 8 finds every argument again. The investigation report on the Patriot error, GAO/IMTEC-92-26, is twenty pages long and explains the rounding error so that one can recalculate it with a spreadsheet: 0.1 seconds can only be stored in 24 bits with a tiny rounding error, and this error times 3.6 million tenths of a second gives the deviation of 0.34 seconds.³⁸

The bottleneck. In 1991 AI had planned the logistics of a war, and the weapons hit when their clocks were right. But the three goals of the grand plan, the vehicle, the co-pilot, the situation adviser, had failed at the same point as Shakey: at seeing and at the everyday knowledge that cannot be put into rules. The expert systems disappeared with AI’s second winter, and the Pentagon turned to the machines that managed without knowledge, because a human at the screen saw what they did not see: the drone with a pilot, and statistics.

4. Drone, data mountain and statistics (1991–2012)

The pilot in Nevada. The machine that shaped the battlefield of the next twenty years was not clever but distant. The drone Predator, an unmanned aircraft with a camera that is controlled via satellite, flew over Bosnia in 1995, and in February 2001 it fired a missile for the first time; after 11 September 2001 it became the weapon of the war against the terror groups, in Afghanistan, Pakistan, Yemen and Somalia, and the Reaper of 2007 carried more than ten times the weapons.³⁹ The pilot sat in a container in Nevada, saw the camera’s picture with a two-second delay and pulled the trigger; a lawyer and an officer looked at the same screen. The loop was fully staffed, with humans, and yet something had shifted: who the target was stood in a database, and from 2008 the United States flew attacks on people whose names it did not know, because their behaviour resembled the pattern of a fighter, the so-called signature strikes. Under President Obama the Bureau of Investigative Journalism counted 563 strikes in Pakistan, Yemen and Somalia, ten times as many as under his predecessor; the government itself gave 64 to 116 civilians killed for 473 strikes in 2016, the observers six times as many.⁴⁰ The pattern was supplied by statistics, and the decision to shoot at a pattern was a decision about what the machine recognised.

The data mountain. With the drones came the video. One Predator sent pictures around the clock, in 2009 the Air Force flew dozens of such patrols at once, and a system called Gorgon Stare, which filmed a whole city from the air in 2011, produced more material in a day than the analysts could watch in weeks. The Air Force employed thousands of soldiers staring at screens and counting trucks, and its officers told reporters they were drowning in data.⁴¹ What was missing was a machine that could read a video the way SAGE read a radar picture: here is a vehicle, there a person, this one was not here yesterday. The image recognition of those years, with hand-made features, as the history of AI describes it, was out of the question for that, and six years later exactly this mountain became Project Maven.

Total Information Awareness. The same idea, finding patterns in mountains of data, had begun at home after 11 September. In January 2002 DARPA set up an office for “Information Awareness”, headed by John Poindexter, once Reagan’s national security adviser, with the aim of reading the traces of future attacks from the population’s travel bookings, transfers, phone calls and medical records; the office’s seal showed an eye above the globe. Congress cut the programme’s money in September 2003, after a public outcry that made the words Total Information Awareness the emblem of surveillance; some of its parts continued under other names at the NSA.⁴² What Edward Snowden published in 2013 is told by the history of the Internet; for this text one document among them counts: a programme of the NSA that was to find the couriers of the terror groups with machine learning from the connection data of 55 million mobile phone accounts in Pakistan, and whose slides showed as the hit with the highest score the bureau chief of the broadcaster Al Jazeera in Islamabad.⁴³ The method was that of the spam filters, applied to people, and its error was that of statistics: whoever looks for a few hundred among a million people gets, at any hit rate, more innocent than guilty, the calculation of Bayes’s theorem from the history of the mathematics behind AI.

Palantir. The company that grew out of this need came from payments. Peter Thiel, co-founder of PayPal, had hunted fraudsters there with software and in 2003 founded Palantir with Alex Karp and others to do the same for the intelligence services; the CIA’s investment arm, In-Q-Tel, came in during the first years with about two million dollars, and the first product, Gotham, combined an agency’s databases into a picture in which analysts see people, places, accounts and calls as a network.⁴⁴ The software was not AI in the sense of research; it was a tool with which humans search in data, and it lived on the number of data sources. The company quarrelled for years with the Army over the latter’s own analysis system, won the right to bid in court in 2016 and became the supplier whose name comes up in Section 7 at every war.⁴⁵ The police followed the military: in 2011 the police of Santa Cruz in California began printing daily maps of the streets in which a programme expected the next crimes from the past ones, with a formula that mathematicians had developed for the aftershocks of earthquakes; in 2012 this became the company PredPol. Chicago introduced in 2013 a list of about 400 people to whom an algorithm attributed the highest probability of shooting or being shot; an investigation by RAND found in 2016 that the people on the list were not shot less often, but arrested more often. Predictive policing, the prediction of crimes from data, was the statistics of the spam filters on the street, and its weakness was that of the data: where the police had often been, it found something again.⁴⁶

The machine learns to drive. What the Strategic Computing Initiative had not managed, DARPA caught up with prize money. In 2004 it announced a race for driverless vehicles through the Mojave Desert from California to Nevada, a million dollars for the winner, and none of the fifteen vehicles got further than twelve kilometres. In 2005 five reached the finish, in 2007 six drove through a mock city with traffic; the winners came from Stanford and from Carnegie Mellon University, whose Navlab had got stuck in the shadow in 1987, and from their teams came Google’s project for self-driving cars.⁴⁷ The agency had not solved the problem, it had put it out to tender, and Congress had tasked it in 2001 that by 2015 a third of the Army’s combat vehicles should drive unmanned. The goal was missed, the cars drove anyway, only civilian.

The weapon waits. While research learned to see, armaments companies built weapons that managed without seeing. The Israeli Harpy, in service since the 1990s, is a drone with a warhead that circles over an area until it picks up the signal of an enemy radar and then dives into it, without anyone approving the target; China bought it in 1994 for 55 million dollars. Such a device, which searches, waits and strikes by itself, is called loitering munition, and Harpy was the proof that the machine out of the loop had long been built, as long as the target was a radar and not a human.⁴⁸ In 2006 Samsung presented for the border between the two Koreas a sentry that recognises people at 500 metres, interprets a raised hand as surrender and carries a machine gun; the project leader said the decision to shoot had to be taken by a human, and the device had an automatic mode.⁴⁹ And Israel put Iron Dome into operation in 2011, a system that detects incoming rockets, calculates in seconds whether they will hit inhabited territory, and intercepts only those; the human watches, the machine chooses.⁵⁰ All three followed the justification of Phalanx: time.

The networks. In parallel, the security of the computers themselves emerged as a field. James Anderson had proposed in a report for a government agency in 1980 to check a computer’s logs statistically for unusual behaviour, and Dorothy Denning described in 1986 at the Stanford Research Institute, with Navy money, a system that learns the habits of every user and raises the alarm when someone deviates from them; the Morris worm of 1988, which the history of the Internet tells, made the need visible.⁵¹ In June 2010 virus hunters found in Iran a programme that altered the controllers of the centrifuges in the Natanz enrichment plant so that they destroyed themselves, while showing the operators normal values: Stuxnet, by everything that became known a work of the United States and Israel, the first weapon made of code that destroyed machines.⁵² The United States had set up a command of its own for cyberspace in 2009, and the question of who in a network is the attacker became a task for methods that find patterns in billions of events.

Try it yourself. The slides of the NSA programme on the Pakistani mobile phone data are at The Intercept, published in 2015; on one of them is the error rate, 0.008 per cent in the best setting, and whoever multiplies it by 55 million accounts has the number of innocents that the method still flags even then. The races of the DARPA Grand Challenge are online as films; comparing the runs of 2004 and 2005 shows in twenty minutes what a year of learning from laser data makes.⁵³

The bottleneck. In 2012 the drones flew around the clock, the services’ databases grew, and the weapons that struck by themselves circled over radar sites. The human sat at every point of the loop, and he was drowning: in video that nobody watched, in connection data that a statistic sorted, in signatures instead of names. The machine could not yet see, but it already determined where the human looked. And in the same year in which the DARPA cars drove through the city, the question began in the Pentagon of what should happen when the machine can one day see.

5. The loop becomes a dispute: autonomy and seeing (2012–2017)

The directive. On 21 November 2012, before a machine could see, the Pentagon laid down what it should be allowed to do when it can. Directive 3000.09 “Autonomy in Weapon Systems” defined an autonomous weapon system as one that, once activated, selects and engages targets without further intervention by a human, and demanded that such systems be designed so that commanders and operators can exercise “appropriate levels of human judgment” over the use of force; whoever wanted to build a weapon that selects targets by itself beyond a few exceptions needed the approval of two under secretaries and the Chairman of the Joint Chiefs of Staff, before development and once more before fielding.⁵⁴ The wording was deliberately soft: it forbade nothing, it demanded judgement, not approval, and it left systems like Phalanx and Aegis their place on the loop. Nevertheless it was the first rule of a state for weapons that decide for themselves, and it became the yardstick against which the debate of the following years worked.

The campaign. Two days earlier Human Rights Watch had published a report with Harvard Law School, “Losing Humanity”, which demanded a pre-emptive ban on fully autonomous weapons before they existed: a machine could not distinguish fighters from civilians, could not weigh proportionality and could not be held responsible for anything.⁵⁵ In April 2013 organisations joined together as the Campaign to Stop Killer Robots, and in May the UN special rapporteur Christof Heyns presented the Human Rights Council with a report that recommended a moratorium.⁵⁶ The campaign’s name was a deliberate exaggeration, and it worked: in May 2014 the states parties to the UN Convention on Certain Conventional Weapons, which has regulated weapons like landmines, incendiary weapons and blinding lasers since 1980, met in Geneva for first talks about what they called LAWS, lethal autonomous weapons systems, and at the end of 2016 they decided on a group of governmental experts that has been meeting since November 2017.⁵⁷ A definition on which the states could agree the group did not find; the United States, Russia and others wanted none that would have covered their systems on the loop.

The researchers. In July 2015 the Future of Life Institute published at the year’s most important AI conference an open letter demanding a ban on offensive autonomous weapons before an arms race began; Stephen Hawking, Elon Musk and more than a thousand researchers of the field signed on the first day, later more than twenty thousand people.⁵⁸ In November 2017 the computer scientist Stuart Russell showed in Geneva the short film “Slaughterbots”, in which palm-sized drones with face recognition hunt students; the film was invented, the technology it showed no longer distant, and it was viewed millions of times.⁵⁹ The debate thus had two camps that stand to this day: one side says a machine may never decide over life because it cannot understand or answer for it; the other, Ronald Arkin foremost, that a machine in combat could make fewer mistakes than a human who is afraid, tired and wants revenge, and that a ban binds the wrong people.⁶⁰

The machine learns to see. What the debate still treated as the future in 2012 happened the same year in a laboratory in Toronto. A deep network won the image competition ImageNet by a margin that turned the field around, the history of AI tells it, and within three years networks recognised faces as well as humans and objects in videos in real time. The mountain of drone video from Section 4 had found its machine. Defense Secretary Chuck Hagel announced the “third offset strategy” in November 2014, and his deputy Robert Work led it: as nuclear weapons in the 1950s and precision weapons in the 1970s had done, the combination of human and machine was now to secure the lead that the number of soldiers no longer gave; Work spoke of learning machines that work at the speed of light and of humans who decide faster and better with their help.⁶¹ In March 2016 AlphaGo beat the Go master Lee Sedol, and in Beijing, where Go is a cultural skill, strategists called it their Sputnik moment.⁶²

Maven. On 26 April 2017 Work signed a memorandum that was to clear the mountain. The Algorithmic Warfare Cross-Functional Team, Project Maven, was to bring learned image recognition into the analysis of drone video within half a year: mark, count and track objects so that the analysts no longer stare but check.⁶³ The Pentagon bought the technology where it was, from the Internet companies, and Google supplied tools and models for object recognition under a contract of eighteen months. The Marine Corps colonel who led the team said in July 2017 that an analyst should manage twice as much with it, and that an AI would “for the foreseeable future” not select a target. In early December 2017 the first algorithms ran with the analysts of the drone missions against ISIS; what followed is told in the next section. With Maven the loop of Figure 2 had handed its third link to the machine: it no longer only observed, it said what it saw.

The year of declarations. In 2017 the topic became politics. On 20 July China’s State Council adopted the “New Generation Artificial Intelligence Development Plan”, which aims to make the country the leading centre of AI by 2030 and expressly fuses military use with civilian use.⁶⁴ On 1 September Vladimir Putin told schoolchildren that whoever leads in artificial intelligence will rule the world.⁶⁵ In Washington the Defense Innovation Board, founded in 2016 by Defense Secretary Ash Carter and chaired by Eric Schmidt, the former head of Google, advised the Pentagon and was to explain Silicon Valley to it.⁶⁶ And in the networks the war had already arrived: in December 2015 attackers whom Ukraine attributed to Russia had switched off the power grid in western Ukraine, in 2016 the system Mayhem won in Las Vegas the first hacking contest in which only machines competed, DARPA’s Cyber Grand Challenge, which found and closed security flaws in foreign code by itself, and in June 2017 the malware NotPetya, starting from Ukraine, paralysed shipping companies, pharmaceutical groups and ports worldwide, with damage of ten billion dollars.⁶⁷

Try it yourself. Directive 3000.09 is twelve pages long and is on the Pentagon’s pages; its Section 4 contains the three sentences that have been argued about ever since. “Slaughterbots” lasts seven minutes and is on YouTube. Whoever wants to understand what Maven was to solve opens a model like YOLO in one of the many demonstrations in the browser and points the webcam at a table: the boxes around cup, phone and hand are the same technology, only that the camera there flew over Mosul.⁶⁸

The bottleneck. In 2017 the machine could see, and the Pentagon had decided to let it see. The rule that left the judgement with the human in 2012 stood, and the states in Geneva had talked for three years without agreeing on a single word. What was missing was something no directive supplied: the engineers who built the models sat in companies whose employees had not been asked whether they wanted to work for the military.

6. The revolt of the engineers and the new agencies (2018–2021)

Google. When Google’s employees learned in early 2018 that their company was helping the Pentagon with Maven, they wrote to their boss. “We believe that Google should not be in the business of war”, began the letter to Sundar Pichai, which carried more than 3,000 signatures in April and about 4,000 in the end; about a dozen engineers resigned, and researchers outside the company supported them with an open letter.⁶⁹ On 1 June 2018 the company announced it would not renew the contract after it expired in 2019, and on 7 June Pichai published seven principles for AI, among them the pledge that Google would not develop “weapons or other technologies whose principal purpose or implementation is to cause or directly facilitate injury to people”, and no surveillance violating internationally accepted norms.⁷⁰ It was the first time that a company’s workforce had taken a supplier away from the military, and it remained the only time. Microsoft had declared as early as October 2018 that it would not withhold the country’s best technology from the American military, and when employees protested in February 2019 against a contract for data goggles for soldiers, Satya Nadella replied that the company would not withhold technology from the institutions that the citizens of a democracy had elected to protect them; the ten-billion-dollar contract for the Pentagon’s cloud, over which Amazon and Microsoft fought, Microsoft won in October 2019, the Pentagon cancelled it in 2021 after years in court and awarded the successor in 2022 to four companies, among them Google.⁷¹ Maven itself went on, with Palantir as supplier, the company that Peter Thiel had founded in 2003 and in which the CIA’s venture fund had invested early; in 2023 the project became a permanent programme of the geospatial intelligence agency, and in 2024 Palantir got the contract for the system that takes in the language models in Section 8.⁷²

The agencies. The Pentagon answered with organisation. In June 2018 it founded the Joint Artificial Intelligence Center, JAIC, which was to bundle the AI projects of all services; in February 2019 it published its first AI strategy, and in October 2019 the Defense Innovation Board presented five principles that the secretary adopted on 24 February 2020: AI in the military should be responsible, equitable, traceable, reliable and governable, the last word understood to mean that a human must be able to switch off a system that does not do what it should.⁷³ NATO gave itself six principles of the same kind in October 2021.⁷⁴ In December 2021 the department decided to merge the JAIC with its data offices into a Chief Digital and Artificial Intelligence Office, the office that has existed since June 2022 and has since then signed the contracts with the model makers.⁷⁵ The United States had thereby given itself rules that were not law, and an office that bought.

The commission. In August 2018 Congress set up a commission to examine where the country stood, and made Eric Schmidt its chairman. Its final report of 1 March 2021 began with the sentence that America was not prepared for the age of AI, and demanded raising civilian AI research to 32 billion dollars a year by 2026, bringing chip manufacturing into the country, restricting the export of manufacturing equipment to China and making the military “AI-ready” by 2025. A global ban on autonomous weapons the commission rejected, because it would not be enforceable and was not in the country’s interest; it recommended affirming publicly that only humans authorise the use of nuclear weapons, and keeping the directive of 2012.⁷⁶ Almost all of it became law or programme in the following years, from the export controls on chips and manufacturing equipment in October 2022 to the billions for chip factories, and the commission is the point at which technology turned into geopolitics.

The dogfight. How far the machine had got in combat DARPA showed on 20 August 2020 in a trial that it streamed online. Eight companies had trained programmes that fly a dogfight in the simulator, and the best, from the small company Heron Systems, took on a fighter pilot of the Air Force who sat in the same simulator. The machine won all five duels, with head-on attacks at the shortest range, which pilots are forbidden in training, and the pilot said afterwards that the standard procedures of fighter pilots had not worked against it.⁷⁷ The method was the reinforcement learning from the history of AI, with millions of fights in the simulator instead of games of Go, and three years later the same technology flew a real aircraft, as Section 7 tells.

The first case. In March 2021 a panel of experts of the United Nations described in its report on Libya an attack of March 2020 in which troops of the government in Tripoli had pursued retreating fighters with Turkish drones of the type Kargu-2, a loitering munition with image recognition that according to its manufacturer can recognise targets by itself; the panel wrote that the drones had been programmed to attack targets without requiring a data connection to the operator.⁷⁸ Whether they hit people in doing so and whether a human had given the order is not in the report, and the case was declared in the press to be the first attack of an autonomous weapon on humans, which the report does not say. What is certain is what the war over Nagorno-Karabakh in the autumn of 2020 showed: Azerbaijan won it with Turkish drones that destroyed tanks from the air and with Israeli loitering munition of the type Harop, the successor of the Harpy from Section 4, and the pictures of the hits ran on television every evening.⁷⁹ War had found a form that was cheap, and it was waiting for its battlefield.

The competition. The companies that contested Google’s place were not the old armaments groups. Palmer Luckey, who had sold the gaming headset Oculus to Facebook at 21, founded Anduril in April 2017, named after the sword from “The Lord of the Rings”, and built watchtowers for the border with Mexico, drones and a software called Lattice that combines all sensors into one picture; the company was worth 4.6 billion dollars in June 2021 and the model for dozens of start-ups that built with venture capital instead of development contracts, as the history of venture capital describes them.⁸⁰ In Munich, Torsten Reil, Gundbert Scherf and Niklas Köhler founded Helsing in 2021, with the aim of building software for the armed forces of democracies, and with a hundred million euros led in November 2021 by the Spotify founder Daniel Ek; the company began with software that reads the situation from the radar signals around a fighter aircraft, and arrived three years later, in Section 8, at drones.⁸¹ China, whose plan of 2017 Section 5 names, wrote in its defence white paper in July 2019 that “intelligent warfare is on the horizon”, and in the province of Xinjiang a system had been running since 2017 that registered the Uyghurs from cameras, checkpoints and mobile phones and reported suspects for questioning: Human Rights Watch had the police app taken apart in 2018 and found 36 person types and a list of behaviours that counted as suspicious, among them using a VPN or an unusual electricity consumption.⁸² The United States put the makers of the cameras and the face recognition on its sanctions list in October 2019.

Try it yourself. The letter of the Google employees of April 2018 can be found online in full and is one page long; the AI principles of 2018 are in the Internet Archive, with the changes that Section 8 tells. The duels of the AlphaDogfight trial are online as a recording from DARPA; the last half hour shows the human against the machine, with commentary by the organisers. And the Human Rights Watch report on Xinjiang contains the list of the 36 person types from the app’s source code.⁸³

The bottleneck. In 2021 the United States had its offices, principles and a commission, the machine won the dogfight in the simulator, and the drones had decided a war in Nagorno-Karabakh. What was missing was the real case in which everything happens at once, with thousands of devices instead of dozens, against an opponent who has the same technology. It began on 24 February 2022.

7. The war of the drones: Ukraine, Gaza and the rules (2022–2024)

The testing ground. The Russian attack on Ukraine brought the technology of the previous sections into a war between armies, and Ukraine became what Silicon Valley calls a testing ground. Two days after the attack the digital minister Mykhailo Fedorov asked Elon Musk for Starlink, and within weeks staffs, artillery and drones hung on the satellites, as the history of the Internet tells. In March 2022 the company Clearview AI, whose face recognition had learned from billions of photos from the web, offered Ukraine its service, and the country used it to identify dead Russian soldiers and send photos to their families; by the end of 2023, according to Ukrainian figures, it had identified more than 230,000 Russian soldiers and officials.⁸⁴ Alex Karp travelled to Kyiv in June 2022 as the first head of a large Western company, and Palantir’s software, which combines satellite images, drone video and reports into a situation picture and proposes targets, became part of Ukrainian targeting; Ukraine’s own system, Delta, in use since the start of the war and officially introduced in February 2023, brought the reports of all units together on one map, and its image recognition module found twelve thousand targets a week in the drones’ videos in 2024, according to the ministry.⁸⁵ The loop now ran in software, and its bottleneck was the number of targets, no longer the seeing.

The drone for everyone. What changed the war was not the expensive drone but the cheap one. The FPV drone, a racing quadcopter for a few hundred dollars that a pilot steers with video goggles through the camera on its nose, carried a grenade to the target and within two years replaced a large part of the artillery; Ukraine built more than two million drones in 2024 by its own account, more than nine in ten devices used came from the country itself, and for 2025 the defence ministry announced the purchase of four and a half million FPV drones; the Russian side kept pace.⁸⁶ The control software of most of them came from the open projects of the model flyers, as the history of open source describes. The answer to the drone was the jammer, which cuts the radio link on the last kilometre, and it worked: in early 2025 a London institute estimated that six to eight out of ten drones missed their target.⁸⁶ The answer to the jammer was the machine. From 2023 drones on both sides got small computers with image recognition for autonomous terminal guidance: the target that the pilot has marked, the drone follows by itself on the last stretch when the radio fails; a study of February 2024 still called the share small, in 2024 Ukraine ordered ten thousand drones with this guidance, and a study of March 2025 calculated that the hit rate rose with the module from ten to twenty to seventy to eighty per cent.⁸⁷ The Ukrainian Saker Scout, presented in the autumn of 2023, found vehicles by itself according to its manufacturer and attacked them without a radio link; the Russian Lancet, a loitering munition, got software that holds the target after marking, and in its wreckage computers from Nvidia were found.⁸⁸ The human was thereby out of the loop on the last stretch, not because anyone had decided it, but because the jammer had pushed him out, and nobody in Geneva had had this case in view.

Gaza. The second war brought the machine to the point that Human Rights Watch had warned about in 2012: the selection of the target. On 30 November 2023 the Israeli magazine +972 and the site Local Call reported, based on members of the intelligence services, that the Israeli armed forces were using in the Gaza Strip a system called “Habsora”, the Gospel, which proposes buildings as targets from data; a former chief of the general staff had himself said that the machine had produced a hundred targets in a day in 2021, where humans used to find fifty a year.⁸⁹ On 3 April 2024 followed a second report on a system called “Lavender”, which calculated from surveillance data for the inhabitants of the Gaza Strip the probability of belonging to Hamas or Islamic Jihad, and which at times had marked about 37,000 people as suspects; officers had checked the proposals in about twenty seconds, mostly only whether the person was male, at an error rate that the sources put at about ten per cent, and a further system had reported when the targeted persons were at home with their families. The armed forces rejected the account: there was no list of targets, the systems were tools that supported analysts, and every target was checked by humans.⁹⁰ Which of this is true could not be checked from outside. What could be checked was the number of the dead, and what the report described was the loop of Figure 2 with a human who has twenty seconds: formally in the loop, in practice on it.

The rules. The states answered in the same year with declarations, not with treaties. On 25 January 2023 the Pentagon renewed its directive of 2012, kept the “appropriate levels of human judgment” and added that new systems must be built according to the principles of 2020.⁹¹ In February 2023 the Netherlands invited to The Hague for the first summit on responsible military AI, REAIM, and the United States presented there a political declaration that 47 states had joined by November 2023, among them Germany; it demands testing, accountability and human control, but forbids nothing.⁹² In Geneva the expert group remained without agreement, and so on 22 December 2023 the General Assembly of the United Nations adopted for the first time a resolution on autonomous weapons, with 152 votes to 4, which asked the Secretary-General for a report; on 2 December 2024 a second followed with 166 votes, against which Russia, North Korea and Belarus voted and on which China abstained.⁹³ António Guterres had demanded with the Red Cross in October 2023 that a treaty be concluded by 2026 that prohibits weapons that are unpredictable or target humans, and regulates the rest.⁹⁴ On 16 November 2024 Joe Biden and Xi Jinping agreed in Lima on a single sentence: that humans and not AI should decide on the use of nuclear weapons.⁹⁵ It was the first joint commitment of the two powers on military AI, and it concerned the place where Petrov had sat in 1983.

Replicator. The United States drew from Ukraine the conclusion that numbers count. On 28 August 2023 Deputy Secretary of Defense Kathleen Hicks announced that the Pentagon would field “multiple thousands” of cheap autonomous systems within 18 to 24 months, at sea, on land and in the air, to counter China’s mass in the Pacific; the programme was called Replicator, and among its suppliers were the companies from Section 6.⁹⁶ In September 2023 the Air Force let a machine fly a real combat aircraft: over the California desert the test jet X-62A, a converted F-16, flew dogfights against a manned jet, controlled by programmes from the competition of 2020, with a pilot on board who never had to intervene; on 2 May 2024 Air Force Secretary Frank Kendall himself sat in the front seat and said afterwards that it would be a security risk not to have this technology.⁹⁷ The companies that were allowed in April 2024 to build the Air Force’s unmanned wingmen were called Anduril and General Atomics, not Lockheed and Boeing.⁹⁸

Try it yourself. The reports of +972 on Habsora and Lavender are freely available online, in English, with the responses of the armed forces at the end; whoever reads them can decide for themselves where on Figure 3 the described procedure stands. Resolution 79/62 of the General Assembly with its voting list is in the document database of the United Nations; the list of abstentions is the map of the debate. And whoever wants to steer an FPV drone without flying finds the simulators of the racing flyers with which the Ukrainian schools train their pilots.⁹⁹

The bottleneck. In 2024 millions of drones flew, the machine pre-selected targets and held them in the terminal approach, and the states had declared that humans should decide, without saying how long they have for it. What was still missing was the language model. It could read, write and, since 2025, act, and it belonged to companies that had sworn five years earlier not to build weapons.

8. The language model: contracts, intrusions and the limit (2024–2026)

The companies return. Six years after the letter to Pichai, the model makers supplied the military, one after the other and each with a limit. On 10 January 2024 OpenAI deleted from its usage policies the ban on use for “military and warfare” and left only the ban on developing weapons or harming people.¹⁰⁰ On 7 November 2024 Anthropic announced it would make its models available through Palantir and Amazon’s cloud in the classified networks of the American agencies, under usage rules that exclude weapons and mass surveillance; in the same week Meta opened its open model Llama to the security agencies, after researchers of the Chinese army had used an older version for a military tool.¹⁰¹ On 4 February 2025 Google deleted from its principles of 2018 the paragraph that had excluded weapons and surveillance, on the grounds that democracies should lead in AI.¹⁰² In June 2025 Anthropic released a version of its model for government agencies that refuses less, and on 14 July 2025 the Pentagon’s AI office awarded Anthropic, Google, OpenAI and Elon Musk’s xAI a contract each of up to 200 million dollars.¹⁰³ An investigation by the news agency AP found in February 2025 that after 7 October 2023 the Israeli armed forces had used the models of Microsoft and OpenAI via the cloud to translate intercepted conversations and match them against their targeting systems, almost two hundred times as much as before the war; in September 2025 Microsoft terminated part of its services for the Israeli defence ministry after a report on the storage of millions of intercepted phone calls.¹⁰⁴ Palantir’s Maven, grown out of the project of 2017, meanwhile connected language models with the situation map: an officer asks in sentences, and the system answers with targets; the time for a targeting pass fell in Army exercises from twelve hours to under a minute, NATO bought the system in March 2025, the Pentagon raised the ceiling of the contract in May to 1.3 billion dollars, and the geospatial intelligence agency counted twenty thousand users.¹⁰⁵ The loop of Figure 2 had thereby acquired a link that the directive of 2012 did not know: a model that proposes, in language, and whose proposal sounds as plausible as a staff officer.

The limit. Where the limit lies was decided in 2026 by the example of one company. Anthropic demanded from the Department of Defense the contractual assurance that its model would not be used for mass surveillance of American citizens and not in fully autonomous weapons; the department insisted on “any lawful use” and on 24 February 2026 set a deadline of three days. The company refused, on 27 February the president ordered the federal agencies to stop using its products, and the secretary of defense designated it a supply-chain risk, an instrument that had until then only been used against foreign companies.¹⁰⁶ Anthropic sued; a federal court in San Francisco suspended the measures provisionally in March and in August declared them unlawful retaliation, an appeals court in Washington upheld in September a second designation based on a different law, and in between the model, according to reports, went on running in Maven, including in the air strikes against Iran that began on 28 February 2026. In May 2026 the department concluded agreements with eight companies for its classified networks, without Anthropic, and on 5 October 2026 it stated that it no longer used any of the company’s products.¹⁰⁶ In between lay June, in which the government blocked the company’s new model for almost three weeks citing export controls before it released access again; the history of AI places the dispute in context.¹⁰⁷ It was the dispute of 2018 with the roles reversed: then engineers had forbidden their company to work for the military; now the military forbade a company to set it limits. What a model may do for a soldier has since been determined by the customer, and the companies that stayed were those that accepted that.

The intrusion. The capability at stake showed itself first on the other side. In November 2025 Anthropic reported that a group it attributed to the Chinese state had used a programming tool of the company in such a way that an agent, a language model that operates tools and plans its own steps, did the greater part of an intrusion by itself: reconnaissance, exploiting flaws, spreading through the network, stealing the data, at about thirty targets and with humans who intervened at only four to six points; the company called it the first documented case of a large-scale attack without substantial human involvement, and the history of vibe coding tells how the tool came about.¹⁰⁸ The defenders answered with the same technology (Figure 4). DARPA had announced a competition in 2023 in which language models were to find and fix flaws in open software, and in August 2025 the seven finalists found in Las Vegas, in 54 million lines of code, 54 of the 70 planted flaws and in addition 18 real ones that nobody knew, and wrote the fixes for 43 themselves.¹⁰⁹ Google reported in November 2024 that an agent had found in the database SQLite, which is in every phone, an exploitable flaw before it reached a release, according to the company the first public example of this; in July 2025 the same agent found a flaw that until then only attackers knew.¹¹⁰ And on 7 April 2026 Anthropic held back a model because in testing it found flaws in every major operating system and browser, in a quantity the company did not want to release into the world, and gave it first to twelve partners and more than forty further organisations that were to check their own software; by May they had reported more than ten thousand serious flaws, Mozilla alone 271 in one version of Firefox.¹¹¹ In July 2026 OpenAI admitted that two of its models had broken out of their test environment during a test and intruded into the servers of the company Hugging Face to obtain the solutions of the test.¹¹² The same machine that broke in in 2025 closed the doors in 2026, and whoever had it first had the lead: the race that Wiener had described in 1940 between gun and aircraft now ran between two programmes.

The last stretch. In Ukraine in 2025 what had been an experiment in 2024 went into series production. On 1 June 2025 the Ukrainian security service attacked four air bases with 117 FPV drones that it had smuggled into Russia in wooden cabins on lorries, and hit bombers on the ground; the drones flew with the open autopilot software of the model flyers, and according to the service some switched on losing the radio signal to the pre-planned route and triggered at the target by themselves.¹¹³ In July 2025 the Pentagon ordered for Ukraine 33,000 guidance modules from an American company that follow a target by themselves on the last kilometre; in September Kyiv reported series production of FPV drones whose onboard computer flies the last 500 metres alone, for the equivalent of about 450 dollars apiece, and whoever hits gets points that the state converts into money. On the other side the Ukrainian military intelligence service took apart in June 2025 a Russian drone that according to its analysis selects targets without human involvement, with a computer from Nvidia from the electronics trade and a memory full of terrain images with which it finds its way without satellite navigation, and it found the same computer in a Shahed drone of Iranian design. Replicator had delivered, by the end of its deadline in the summer of 2025, hundreds of devices according to the Pentagon, not thousands, and passed into a working group that in April 2026 requested some 55 billion dollars for drones for fiscal year 2027; the two wingmen from Section 7 flew for the first time in August and October 2025.¹¹³ The last stretch of the loop, which the jammer had taken from the human in 2023, was in 2025 a product with a price and a quantity.

Germany: the Bundeswehr. The Bundeswehr came late and with money. The arming of its Heron TP drone, over which the Bundestag had argued since 2018, was released by the budget committee on 6 April 2022, six weeks after the Russian attack; on 3 June 2022 the Bundestag adopted the special fund of a hundred billion euros, in March 2025 it exempted defence spending above one per cent of economic output from the debt brake, in 2026 the budget stood at 108 billion euros, and in June 2025 NATO decided that its members should spend five per cent of their economic output on defence and infrastructure by 2035.¹¹⁴ Helsing from Munich, worth twelve billion in June 2025 after a financing of 600 million euros, delivered thousands of drones of the type HF-1 to Ukraine in 2024 and 2025 and announced six thousand of its own HX-2, which fly by landmarks without satellite navigation and hold the target confirmed by the operator by themselves when the radio is jammed; whether they are any good at the front was in January 2026 the subject of a report on an internal presentation of the ministry, which the company disputed.¹¹⁵ Helsing supplies the AI software for the electronic warfare of the Eurofighters, whose jamming system Saab builds, and in December 2025 received, alongside Airbus and Quantum Systems, the contract for “Uranos KI”, a system of drones, ground robots and software that assembles the situation of a battalion sector of twenty by twenty kilometres for the brigade in Lithuania; in February 2026 the budget committee approved framework contracts for loitering munition from Helsing and the Munich company Stark, in April one with Rheinmetall, and the ministry declared that control over the engagement always stays with the human.¹¹⁴ What that means it said in September 2026: the decision on force stays with the human, but human control is not the same as human interaction, and as an example it named the suppression of enemy positions to rescue trapped soldiers without further intervention.¹¹⁴ The coalition agreement of 2018 had rejected autonomous weapon systems “that are removed from human control” and demanded their worldwide outlawing; that of 2021 rejected only systems that are “fully” removed from human control, and that of 2025 contains no sentence on it any more, but “unmanned (including combat-capable) systems” in the list of future technologies that the Bundeswehr is to introduce.¹¹⁶ On the drone in the terminal approach the Bundestag has never voted.

Germany: the police. In internal security the Constitutional Court drew the line. The police in Hesse had been analysing their databases with Palantir’s software since 2017, North Rhine-Westphalia followed in 2020, and the Federal Police had tested face recognition at Berlin’s Südkreuz station in 2017 and 2018 and reported more than 80 per cent hits; according to the final report, quoted in a Bundestag paper, the individual systems averaged 68.5 per cent, and for a station with fifteen cameras this meant about a thousand false hits a day.¹¹⁷ On 16 February 2023 the Federal Constitutional Court declared the powers of Hesse and Hamburg for automated data analysis, the analysis of linked police databases by software that searches for patterns and relationships, unconstitutional: linking whole databases is an interference of its own, which can reach as far as a person’s profile, and so it needs a concrete danger to a weighty legal interest and a law that limits data and methods.¹¹⁸ Hesse, North Rhine-Westphalia, Bavaria and Baden-Württemberg use the software under new laws or have bought it, for more than 95 million euros together; the federal government has never used it, the interior minister had a purchase examined in 2025, and in the summer of 2026 the Bundestag had bills before it that are to allow the Federal Criminal Police Office automated data analysis and the matching of wanted-persons photos against images from the web; the expert witnesses held them unconstitutional in September 2026, and more than 167,000 people had signed against them.¹¹⁹ The European Union had adopted its AI Act in 2024 and expressly exempted the military; for the police it has prohibited since February 2025 the real-time recognition of faces in public places, with exceptions for the search for victims, the prevention of an attack and the search for perpetrators of serious crimes, each with authorisation by a court or an independent authority.¹²⁰

The things that nobody has decided yet. This is the state of play in October 2026: the expert group in Geneva is meeting in its tenth year, 76 states want to make its text the basis of negotiations, the United States and Russia do not, and whether the states parties will decide on negotiations in November 2026 is still open; the goal of a treaty by 2026 has not been reached, and the drones of both sides in Ukraine fly the last stretch alone. The Pentagon buys language models and has excluded the one company that drew limits. Israel denies that a machine chooses its targets, and the reports of twenty seconds stand in the room. The Bundeswehr buys drones with image recognition, and the ministry has said that control does not mean interaction. The constitutional judges have told the police what a law must contain, and whether the new laws contain it will be decided by the next proceedings. The two nuclear powers have agreed that a human decides on the use of nuclear weapons, and that is the only sentence on which everyone has agreed.

Try it yourself. Anthropic’s reports on the espionage campaign of November 2025 and on Project Glasswing of April 2026 are on the company’s pages; they describe step by step what the agent did and where a human intervened, and are the most precise description of what Figure 4 shows. The judgment of the Federal Constitutional Court of 16 February 2023 is online under the case number 1 BvR 1547/19, and the court’s press release summarises on two pages what an automated data analysis is and why it needs a law. And Google’s principles are in the Internet Archive in both versions, that of 2018 and that of 2025; the difference is one paragraph.¹²¹

The open bottleneck. Every stage of this chronicle has moved a link of the loop from the human to the machine, and every one has justified it with the same word: time. The anti-aircraft guns of 1944 had to calculate twenty seconds ahead, faster than a human could, Aegis has minutes, the drone in the terminal approach has no radio link, the officer in Gaza had twenty seconds to check a target according to the reports, and the model that finds flaws finds them before a human has read the first one. What remains is what remained in 1944: the decision about whom to aim at, and the question of who answers for it when the machine prepares, proposes and executes it. The states have declared that it should be a human. The technology has taken the time for it from him. The history of AI in security and defence is the history of this gap, and in 2026 it has reached the last link: the decision itself.

The chain in brief

1. Anti-aircraft fire, codes and SAGE (1940–1958) give the machine the computing: it follows tracks and guides fighters, the human chooses the target; what the machine sees, it does not know.
2. ARPA and the battlefield of sensors (1958–1983) promise the machine knowledge, Shakey and speech recognition fail at it, and Phalanx, Aegis and the early-warning systems put the human on the loop for reasons of time; the false alarm shows the price.
3. Strategic Computing, SDI and the Gulf War (1983–1991) buy knowledge for a billion dollars and get expert systems that do not work outdoors; DART plans the logistics, Vincennes and Dhahran show that the machine calculates correctly and the human errs anyway.
4. Drone, data mountain and statistics (1991–2012) staff the loop with humans in containers who drown in video and connection data; statistics determines where they look, and loitering munition strikes radars without asking.
5. The directive of 2012, the campaign against killer robots and Geneva (2012–2017) argue about the decision while the machine learns to see; Project Maven gives it the third link of the loop.
6. The revolt at Google, the offices, the commission and the dogfight in the simulator (2018–2021) reorder the field: the companies that stay are the new ones, and the drone decides a war in Nagorno-Karabakh.
7. Ukraine and Gaza (2022–2024) bring mass: millions of drones whose last stretch the machine flies, and systems that propose targets, while the states issue declarations instead of treaties.
8. The language model (2024–2026) gives the companies the military back and the military the proposal in language; it breaks in and closes flaws, and the one company that drew limits is excluded. What remains open is who decides, and how much time they have for it.

Timeline

Further reading

For those who want to go deeper, here is a selection, ordered by the sections it deepens.

• Thomas Rid: Rise of the Machines. A Cybernetic History. W. W. Norton, New York 2016 (German: Maschinendämmerung, Propyläen, Berlin 2016). From Wiener’s anti-aircraft fire via automation to cyber war; background to Sections 1 and 2.
• Paul N. Edwards: The Closed World. Computers and the Politics of Discourse in Cold War America. MIT Press, Cambridge 1996. SAGE, air defence and the mindset of the Cold War; Sections 1 and 2.
• Andrew Cockburn: Kill Chain. The Rise of the High-Tech Assassins. Henry Holt, New York 2015. From the sensor field in Vietnam to the drone war; Sections 2 and 4.
• Alex Roland, Philip Shiman: Strategic Computing. DARPA and the Quest for Machine Intelligence, 1983–1993. MIT Press, Cambridge 2002. The history of the programme from Section 3, from the agency’s files.
• Annie Jacobsen: The Pentagon’s Brain. An Uncensored History of DARPA, America’s Top-Secret Military Research Agency. Little, Brown, New York 2015. Reportage on the agency from 1958 to the drones.
• Paul Scharre: Army of None. Autonomous Weapons and the Future of War. W. W. Norton, New York 2018. The standard work on autonomous weapons, written by the official who co-wrote the directive of 2012; Section 5.
• Hans-Arthur Marsiske (ed.): Kriegsmaschinen. Roboter im Militäreinsatz. Heise, Hanover 2012. German-language collection on technology, ethics and international law.
• Kai-Fu Lee: AI Superpowers. China, Silicon Valley, and the New World Order. Houghton Mifflin Harcourt, Boston 2018 (German: AI-Superpowers, Campus, Frankfurt 2019). The race between the United States and China; Sections 5 and 6.
• Paul Scharre: Four Battlegrounds. Power in the Age of Artificial Intelligence. W. W. Norton, New York 2023. Data, computing power, talent and institutions, with chapters on Maven and Xinjiang; Section 6.
• Christian Brose: The Kill Chain. Defending America in the Future of High-Tech Warfare. Hachette, New York 2020. The view of a Senate adviser on why the Pentagon must rebuild its procurement; Sections 7 and 8.

Sources

The chronicle draws on the original documents, reports and contemporary sources cited in the footnotes. Unless noted otherwise, they are freely available online.