The Algorithmic Trigger
How AI Weaponization Is Rewriting the Rules of Force
AI Weapons Watch | Kevin J.S. Duska Jr. | August 11, 2026 |
From Project Maven’s targeting stack to the Kargu-2 precedent in Libya, autonomous and semi-autonomous weapons have quietly crossed thresholds that governments spent a decade insisting they would not cross. This is a map of that terrain — and of the flash-war risk sitting underneath it.
The Threshold Has Already Moved
For most of the last decade, the debate over artificial intelligence in warfare was conducted in the future tense. Analysts, ethicists, and defense officials argued about what might happen if machines were ever permitted to select and engage targets without a human in the decision loop. That debate has not been resolved. It has been overtaken by events.
The record now shows a machine-recommended airstrike pipeline running in active combat theaters, a fielded quadcopter munition that a United Nations panel described as having hunted retreating soldiers without a data link to its operator, swarming systems moving from demonstration videos into procurement budgets, and a body of strategic literature warning that machine-speed sensing and machine-speed response could compress the decision window between states to a point where no human review is possible before the first shot is fired. None of this is speculative. Each is documented, sourced, and — in the case of at least one incident — the subject of formal UN reporting.
What follows is a working map of that terrain: the targeting layer, the kill layer, the swarm layer, and the escalation layer, followed by an assessment of the governance vacuum sitting underneath all four.
The Targeting Layer: Project Maven and the Automation of Decision
The institutional starting point for most of what follows is a Pentagon initiative launched in April 2017 under a memo establishing the Algorithmic Warfare Cross-Functional Team — the program that became known as Project Maven. The original mandate was narrow: use machine learning to sort through the overwhelming volume of full-motion video collected by drones over conflict zones, flagging objects of interest that a human analyst might otherwise miss in hours of footage.
Google’s exit did not end the program — it accelerated its evolution. Contractors including Palantir, Amazon Web Services, Microsoft, and Clarifai stepped into the space Google vacated, and Maven has since expanded well beyond object recognition in drone footage. Public Pentagon demonstrations now describe a system that ingests intelligence feeds from more than a hundred sources, weighs available strike assets, and presents a commander with a pre-packaged targeting workflow — described by officials, without apparent irony, as “magic.” The addition of large language model interfaces has broadened who can query the system and how, moving it from a specialist tool toward something closer to a natural-language command layer over the kill chain.
The Pentagon’s official position throughout has been that a human remains in the loop for lethal decisions. That claim deserves scrutiny rather than dismissal or blind acceptance. A human who is asked to approve or reject a machine-generated recommendation within a compressed decision window, under institutional and psychological pressure to trust the system that produced it, is exercising a meaningfully different kind of judgment than a human building a target package from raw intelligence. The architecture does not have to remove the human to erode the human’s actual authority over the outcome. That erosion, sometimes called automation bias, is the real story of the targeting layer, and it is one every subsequent development in this article builds on.
The Kill Layer: Kargu-2 and the Libya Precedent
If Project Maven represents the automation of decision-support, the Kargu-2 represents the automation of the decision itself — or at least the first well-documented case that looks like it.
In March 2021, a United Nations Panel of Experts on Libya released a report to the Security Council describing events from the previous year’s fighting around Tripoli, in which forces aligned with the UN-recognized Government of National Accord pushed back troops loyal to General Khalifa Haftar. The report stated that retreating convoys were “hunted down and remotely engaged” by unmanned combat aerial vehicles and lethal autonomous weapons systems, explicitly naming the STM Kargu-2 — a Turkish-made quadcopter loitering munition. The panel’s language was specific: the systems were described as programmed to attack targets without requiring a data connection between operator and munition, a capability the report characterized as true fire-forget-and-find functionality.
What the report did not do is confirm that anyone was killed by the system operating without human supervision, or settle whether the Kargu-2 was in fact operating autonomously at the moment of engagement rather than under manual control. Analysts who examined the underlying paragraph closely, including researchers writing for the Bulletin of the Atomic Scientists and the war-studies faculty at King’s College London, flagged both ambiguities directly. The Kargu-2’s manufacturer markets it as capable of both autonomous and manual operation, and loitering munitions with far less machine-vision sophistication have been used in combat for years, which complicates any claim that this was unambiguously a novel category of killing.
The caution in the secondary literature is appropriate and worth preserving rather than flattening into a cleaner story. But the caution should not obscure what is not in dispute: a fielded, exported, commercially available weapons platform was described by a UN body as capable of selecting and engaging human targets without a live data link to a human operator, in an active conflict, in 2020. Whether or not that specific engagement was fully autonomous, the capability exists, is deployed, and has been exported by Turkey to multiple partners. The Libya incident is significant less as a confirmed first casualty and more as a marker — the moment the autonomous-weapons debate stopped being hypothetical and became a documented feature of at least one real war.
The Swarm Layer: From Single Platforms to Distributed Lethality
Swarming changes the character of the problem in three specific ways. First, it shifts the relevant unit of analysis from the individual platform to the collective behavior of the group, which is often governed by decentralized coordination algorithms rather than a single point of human control. Second, it multiplies the targets a single human operator is expected to supervise, which is precisely the condition under which meaningful human oversight tends to degrade — a handful of drones can be watched closely, but a formation of dozens or hundreds cannot be reviewed engagement by engagement in real time. Third, it changes the economics of the battlefield: swarms built from cheap, expendable platforms are designed to overwhelm point-defense systems through sheer numbers and redundancy rather than through the sophistication of any individual unit.
The Kargu system itself is illustrative of the trajectory: its manufacturer has publicly described swarming functionality intended to let a formation of drones operate together against a target set, moving the platform from a standalone loitering munition toward a networked, distributed weapon. Militaries in the United States, China, Russia, Turkey, and elsewhere are pursuing parallel programs, ranging from low-cost expendable air swarms to underwater and ground-based analogues. The strategic appeal is obvious — mass, redundancy, and cost-imposition against expensive legacy air-defense systems built for an earlier era of warfare. The strategic risk is equally obvious: a weapons category explicitly optimized to outpace individual human review is, by design, pushing toward the same automation-of-decision problem raised by Project Maven and the Kargu-2, just distributed across many simultaneous engagements instead of one.
It is worth being precise about what is documented versus projected here. Public reporting on operational swarm use in actual combat, as opposed to testing, demonstration, and doctrine development, remains thin — this is a capability still substantially in the procurement and experimentation phase for most major militaries, Ukraine’s rapidly iterating drone units being a partial and contested exception. That makes swarming less a confirmed battlefield fact today than a near-term trajectory that the targeting and kill layers above are already laying the groundwork for.
The Escalation Layer: Flash War and the Compression of Decision Time
The most consequential risk in this space may not be any single autonomous weapon, but what happens when many such systems, deployed by rival states, begin interacting with each other at machine speed.
The concept generally referred to as flash war borrows its framing from flash crashes in automated financial markets — episodes in which algorithmic trading systems, each individually rational and each reacting to the others in microseconds, produced sudden, extreme, and largely unintended market moves that no human trader authorized in real time. Strategists and arms-control researchers have argued that a comparable dynamic is plausible in a security environment increasingly populated by AI-enabled sensing, early-warning, and response systems: if a state’s automated defensive systems detect and react to another state’s automated systems faster than human decision-makers can be looped in, an escalation spiral could begin and accelerate before any human on either side has made a deliberate choice to fight.
This is not a purely academic concern. Nuclear and conventional early-warning systems have a long, uncomfortable history of false positives — flocks of birds, weather phenomena, and equipment malfunctions have all triggered alerts that were only prevented from becoming catastrophic by a human being willing to doubt the machine. The entire premise of introducing AI into that chain to compress response time is that human doubt, and the minutes it consumes, is treated as a liability to be engineered away rather than a safety margin to be preserved. Compressing decision time is precisely the design goal of much of the targeting-layer work described above; extended to the strategic level, between nuclear-armed or near-peer states, the same design goal becomes a systemic risk rather than a tactical advantage.
The honest caveat is that flash war remains a scenario, not an event — there is no confirmed case of an AI-triggered military escalation between states, and reasonable analysts disagree about how near-term the risk actually is versus how much of it is speculative extrapolation from financial-market analogies that may not transfer cleanly to kinetic conflict. But the same was true of autonomous lethal engagement before March 2020, and of automated targeting pipelines before 2017. The pattern across every layer in this article is that the technology has consistently arrived in the field faster than the governance structures meant to constrain it, and flash-war risk is the layer where the stakes of that pattern are highest.
The Governance Gap
Every layer above shares a common structural feature: the policy and legal frameworks meant to govern it were largely designed for a slower, more human-paced era of warfare, and have not caught up.
International humanitarian law was not written for this.
The core principles of the law of armed conflict, distinction between combatants and civilians, proportionality, and the requirement of a responsible human command, presume a human actor capable of exercising judgment at the point of decision. Autonomous and semi-autonomous weapons do not eliminate the requirement, but they stretch the causal chain between a human decision and a specific act of violence in ways the existing legal architecture was not built to trace cleanly. The Kargu-2 episode is instructive precisely because the UN panel that documented it did not attempt to rule on its legality; it flagged the capability and left the harder legal question open.
Export control has not kept pace with dual-use software.
Turkey’s export of the Kargu system to a partner government in an active civil conflict illustrates a broader problem: much of what makes a weapon autonomous is software and training data rather than hardware, and existing export-control regimes were built around physical components, not machine-learning models. A mid-sized power was able to field and export a functioning autonomous weapons capability well ahead of any binding international restriction on the category.
Corporate AI ethics policies are voluntary and reversible.
Google’s 2018 exit from Project Maven, framed at the time as evidence that employee and public pressure could constrain military AI development, has proven less durable than it appeared. Subsequent reporting indicates the underlying program did not stop — it moved to other contractors — and that some of the companies which once drew ethical lines around military AI work have since revisited or removed those restrictions as competitive and government pressure increased. Corporate policy, unlike binding law, can be a one-generation-of-management commitment rather than a durable constraint.
Multilateral autonomous-weapons talks remain unresolved.
Diplomatic efforts at the United Nations to establish binding rules on lethal autonomous weapons systems have continued for more than a decade under the Convention on Certain Conventional Weapons framework, without producing a binding treaty. States disagree fundamentally on basic definitions — what counts as “meaningful human control,” what counts as “autonomous” at all — and the states investing most heavily in the technology have the least incentive to accept restrictions that might constrain a capability they view as a competitive advantage.
The State Actor Landscape
The four layers above are not being pursued uniformly. Different states are converging on AI-enabled warfare from different starting points, with different risk tolerances, and that variation matters for anyone trying to assess where the next documented incident is likely to come from.
The United States
Washington has the most institutionally mature program in Project Maven, the most extensive public debate about it, and — at least on paper — the most formal human-in-the-loop policy commitments of any major military AI power, dating back to a 2012 Defense Department directive on autonomy in weapons systems that has been periodically updated rather than replaced. That formal caution coexists with rapid expansion of the underlying targeting infrastructure, an increasingly competitive contractor landscape as major technology firms revisit earlier restrictions on military AI work, and reporting that at least one AI vendor’s refusal to support fully automated strike authority became a point of friction serious enough to end its role in the program. The gap between stated doctrine and operational trajectory is worth watching closely.
China
Beijing has pursued swarming and autonomous systems as an explicit element of what Chinese military writing calls intelligentized warfare, treating AI-enabled mass and speed as a way to offset the United States’ advantage in exquisite, expensive individual platforms. Chinese firms have demonstrated large-scale drone swarm tests publicly, and PLA doctrine documents discuss compressed OODA-loop warfare in terms that map closely onto Western flash-war concerns, suggesting the risk is recognized by potential adversaries even where it is not yet formally constrained by either side.
Russia
Russia’s most significant contribution to this landscape has arguably come through the war in Ukraine rather than a centrally planned program: both sides have used the conflict as a live testbed for cheap, rapidly iterated drone systems, with electronic-warfare countermeasures and drone capability escalating in tandem on a timeline measured in weeks rather than years. That rapid, decentralized iteration cycle is itself a governance problem distinct from the top-down programs described elsewhere in this piece — doctrine and legal review structurally cannot keep pace with battlefield-unit-level innovation happening this fast.
Turkey and mid-sized exporters
The Kargu-2 case is a reminder that the states most likely to generate the next documented autonomous-engagement incident may not be the great powers investing the most money, but mid-sized states with capable defense-export industries and fewer domestic constraints on how aggressively they market autonomous capability. Turkey, Israel, and South Korea all field or export systems with meaningful autonomous functionality, and none of the three has signed onto binding restrictions on the category.
Non-State and Gray-Zone Risk
Everything above concerns state militaries operating within some form of institutional and legal structure, however imperfect. The proliferation risk that follows from cheap, software-defined autonomy is that the same underlying capability is not confined to states. Commercial drone platforms with autonomous targeting modes added through aftermarket software have already appeared in non-state and irregular conflicts, and the barrier to entry for a crude but functional autonomous loitering munition is now closer to a hobbyist drone-building forum than to a state weapons-procurement program.
This matters for the flash-war conversation specifically. Most flash-war analysis assumes rational state actors with institutional command structures, however compressed their decision windows become. A non-state or gray-zone actor deploying autonomous systems without any equivalent command structure, doctrine, or accountability chain introduces a form of unpredictability that state-to-state escalation models were not built to account for — and one that existing arms-control and export-control frameworks, built around states as the relevant unit of regulation, are particularly poorly suited to address.
What This Means Going Forward
A few implications follow from laying these four layers side by side rather than treating them as separate stories.
- The targeting layer and the kill layer are converging. Systems built to recommend targets to humans and systems built to autonomously engage targets are not on separate tracks — they are components of the same kill chain, and the institutional pressure in most militaries runs toward tighter integration and faster throughput, not slower and more deliberate human review.
- Proliferation is running ahead of doctrine. Autonomous and semi-autonomous weapons are cheaper to build and export than the major legacy platforms they complement, which means mid-sized and non-state actors are acquiring capabilities that were, until recently, the exclusive province of a handful of advanced militaries.
- The accountability question is becoming harder, not easier, to answer. As targeting recommendations, munitions guidance, and even natural-language command interfaces are handled by AI systems built by multiple contractors and layered on top of each other, tracing responsibility for a specific harmful outcome back to a specific human decision becomes structurally more difficult — which is precisely the condition under which impunity tends to flourish.
- Escalation risk is the layer most likely to be underweighted by policymakers, because it has no single incident attached to it the way Libya does for autonomous kill decisions. Flash-war scenarios are diffuse, cross-domain, and probabilistic rather than discrete and documented — which makes them easier to defer and harder to build political will around, right up until the point where deferring is no longer an option.
None of this argues that AI-enabled military systems are uniformly reckless or that every application collapses into the worst-case scenario. Machine-assisted analysis of overwhelming sensor data solves a genuine human cognitive bottleneck, and some automated defensive systems — missile-defense interceptors operating on timelines measured in seconds, for instance — have used automated engagement logic for decades without triggering the runaway-escalation scenarios described above. The relevant distinction is not automation versus no automation. It is where in the chain human judgment is preserved, how much time that judgment is given, and whether the institutions fielding these systems are honest about the difference between a human who is genuinely deciding and a human who is merely present.
Closing Assessment
The throughline across Project Maven, the Kargu-2, drone swarming, and flash-war risk is not a single runaway technology — it is a consistent institutional pattern. Capability development outruns doctrine. Doctrine outruns law. Law outruns enforcement. Each layer of that gap has been documented independently, by different researchers, using different methods, across different countries and conflicts. Read together, they describe a single trajectory: the threshold for what counts as an acceptable level of human control over lethal force has been quietly renegotiated by engineering decisions and procurement contracts, not by public debate or binding international agreement.
That renegotiation is not finished, and it is not irreversible. But it will not reverse itself. The gap between what these systems can already do and what the law, the export-control regime, and the multilateral process have agreed to constrain is the story — and it is a story still being written in procurement budgets and battlefield reporting rather than in treaty text.
The opinions put forth herein reflect the intelligence analysis conducted by AI Weapons Watch’s administrator – Prime Rogue Inc.
About the Author
