Machines at War

A commander receives a stream of information faster than any staff could have assembled it a generation ago. Sensors report movement. Software classifies objects. A model ranks threats. An unmanned system can navigate, track, and in some cases act after communications are lost. Somewhere inside that chain sits the oldest military question: who decides when force may be used?

AI can change much of the work leading to a military decision. It can search images, combine information from different sources, predict routes, rank priorities, and guide unmanned systems. It can shorten the time between noticing something and acting on it. That speed can be useful, but it also leaves less time to check a recommendation before it has consequences.

Chapter Twelve called the moment when machine output becomes state action the authority jump. War can make that jump in seconds. Once software moves from helping a human understand the battlefield to determining who or what will be attacked, speed stops being merely an operational advantage. It becomes part of the governance problem.

The machine can compress the kill chain. It cannot own it.

Unmanned Is Not Autonomous

The first distinction is basic and often lost in public debate. An unmanned system is a machine without a person physically aboard it. An autonomous system can perform some functions without further human intervention after activation. Those are different things.

A remotely piloted drone may have no crew on board while remaining under continuous human control. A ground robot may carry supplies, evacuate wounded soldiers, or move into a dangerous area under remote direction. Another system may navigate around obstacles on its own while a human still chooses the mission and target. At the far end of the spectrum, a weapon may select and engage a target without further human intervention.

Treating all of those systems as one category produces bad policy. Autonomy in navigation is different from autonomy in target recognition. Autonomy in defensive interception is different from autonomy in deciding that a human being may be killed. The relevant question is not whether the machine is autonomous in some abstract sense. It is autonomous over what decision.

That distinction matters because military technology can remove people from danger without removing people from authority. Reuters reported in September 2026 that Ukrainian units were expanding their use of unmanned ground vehicles for logistics, evacuation, reconnaissance, and combat tasks on a battlefield where exposed soldiers face constant danger. Brigadier General Andrii Biletskyi told Reuters that Ukraine’s Third Army Corps aimed to replace roughly one-third of frontline troops with unmanned systems by year-end. Many of those systems remain remotely controlled. Their value lies partly in putting a machine where a person once had to go.

The safest case for military autonomy is often the one that removes soldiers from danger without removing humans from judgment.

The Kill Chain Is a Delegation Chain

Military organizations often describe targeting as a chain: find, fix, track, target, engage, and assess. AI can enter every link. It can help locate an object, combine data, maintain a track, recommend a priority, or estimate whether a strike achieved its purpose.

Each delegation changes what the next human sees. If software filters thousands of sensor returns into ten recommended targets, the final operator may still click the button, but the machine has already shaped the field of choice. Human accountability therefore cannot be measured only at the trigger.

This is the authority jump from Chapter Twelve under battlefield pressure. A target recommendation can remain information. An engagement command is state action. The difficult territory sits between them, where software ranks, excludes, labels, and prioritizes before a human makes the formal decision.

Project Maven makes the point concrete. Reuters reported in March 2026 that the Pentagon planned to make Palantir’s Maven Smart System a permanent program of record. The same report described Maven as already the primary AI operating system for the U.S. military during a period in which U.S. forces had carried out thousands of targeted strikes against Iran over the preceding three weeks. Maven analyzes large streams of battlefield information and can identify potential threats or targets. Palantir says the system does not make lethal decisions and that humans remain responsible for selecting and approving targets.

That distinction is crucial, and the earlier steps still shape the decision. A human can remain the legal decision maker while becoming increasingly dependent on a machine’s picture of the battlefield. The reviewer conditions from Chapter Ten therefore matter here as much as they did in medicine: authority over the decision, enough evidence and context to judge the recommendation, enough time and competence to disagree, and practical power to override.

Target lists deserve the same scrutiny. Software can move one location higher on the list, leave out a report it considers uncertain, or label one object more threatening. That changes what the officer gets to consider. The officer may still make the formal decision, but architecture has already allocated attention.

Principle 5 therefore starts before an attack. Responsibility reaches the people who choose which information is used, how much confidence is required before a recommendation appears, how uncertainty is shown, and when the system must ask for human help.

When the Seconds Disappear

Principle 5 becomes literal in war. Speed and architecture move accountability upstream.

Some military threats move too quickly for a human to review every individual engagement. Defensive systems may need to detect and intercept incoming objects at machine speed. Communications can be degraded or lost. Swarms and mass attacks can overwhelm a process designed around one target and one operator at a time.

When there is too little time to review each action, people must make more of the governing decisions beforehand. Commanders and institutions must specify which systems may operate, what kinds of targets fall within their permission, where and for how long they may act, and when they must stop. The rules must also say how much confidence is required before the system may act.

The U.S. Department of Defense makes a similar move in Directive 3000.09. The policy permits some autonomous actions without case-by-case human approval while requiring systems, interfaces, doctrine, training, testing, and review to allow commanders and operators to exercise appropriate levels of human judgment over the use of force. For certain autonomous weapons, the directive also requires senior review before fielding.

That is upstream accountability. The human signature may occur in system design, mission authorization, target restrictions, and rules of engagement rather than at the final millisecond.

Two systems can therefore deserve different rules even when both act quickly. A defensive system that automatically intercepts an incoming missile is acting against a bounded object whose hostile function is already apparent. A system that searches an area and decides which person matches a target profile is making a different kind of judgment. The first may be governable through carefully defined mission parameters and upstream authorization. The second crosses into case-specific judgment about a human life. Speed explains why the boundary must be designed before the engagement. It does not erase the boundary.

But upstream authorization has a limit. A person cannot responsibly pre-authorize whatever the machine later decides to do. Principle 3 still requires a boundary, and Principle 7 becomes decisive when the system crosses into a Reserved decision.

The Reserved Line: Human Targets

Chapter Ten used terminal medical decisions to show why some choices require a human decision owner. Chapter Twelve used criminal sentencing as the first legal Reserved example. War supplies the second major case: the intentional application of lethal force against a person.

This book’s Reserved category is narrower than the category of high-stakes decisions. It applies where the legitimacy of the decision depends on an accountable human making it. A machine may detect, track, classify, or recommend. It may autonomously perform bounded defensive functions against incoming munitions or other objects when the law, mission, and system design permit. But deciding that a particular human being may be intentionally killed belongs on the human side of the boundary.

The reason is not sentimental distrust of machines. It is that the laws and ethics of armed conflict require judgments about context that can change rapidly: whether a person is a combatant, whether a person is surrendering, whether someone is wounded or otherwise protected, whether civilians are present, whether the expected military advantage justifies foreseeable harm, and whether the situation has changed since the mission was authorized.

The International Committee of the Red Cross drew a similar line in its 2026 position paper. It called for legally binding rules that prohibit unpredictable autonomous weapons and autonomous weapons designed or used to target humans directly, while strictly constraining other autonomous weapons by target type, geography, duration, scale, situation of use, and the ability to supervise and intervene.

The Doctrine is not identical to the ICRC proposal, but the overlap is substantial. Both distinguish between autonomy as a technical feature and authority over lethal force. Both treat boundaries as part of the safety system rather than as paperwork around it.

Existing international humanitarian law already applies to weapons that use autonomy. Parties to conflict remain bound by rules such as distinction, proportionality, and precautions in attack. The treaty debate starts from that baseline and asks whether general rules are specific enough for systems that may choose targets or apply force after activation, and whether some forms of autonomy should be prohibited before widespread deployment makes the boundary harder to recover.

A machine may identify a person. It should not become the final accountable decider that the person may be killed.

Human Control Can Become Ceremonial

The phrase human in the loop is especially fragile in war. A human can be physically present and still lack the ability to make an independent decision.

If the operator sees only a colored box around an object, receives no usable explanation for why the system classified it as a threat, has seconds to respond, and has been trained that hesitation may endanger the unit, the final click may carry less judgment than the interface suggests. The human becomes a confirmation mechanism.

A disputed real-world account shows why the distinction matters. In April 2024, +972 Magazine and the Guardian reported, based on six Israeli intelligence sources, that the Israel Defense Forces had used an intelligence database called Lavender to help identify potential militant targets in Gaza; some sources described periods in which human review of AI-assisted recommendations could be extremely brief. The IDF disputed central characterizations, saying Lavender was a database that cross-referenced intelligence rather than an autonomous target-selection system and that analysts were required to conduct independent examinations before a person could be treated as a lawful target. The disputed account exposes the same governance question from both directions: what independent review must contain before a machine-assisted recommendation crosses the authority jump.

The problem grows when automation performs well. Reliable systems earn trust. Trust becomes habit. Habit reduces checking. The operator who overrides a correct system repeatedly will be criticized long before the operator who follows it automatically becomes visibly dangerous.

This is Principle 8 in combat form. Accountability decays unless institutions deliberately preserve the ability to disagree. Training must include system failure, not merely system use. Exercises must include ambiguous cases. Overrides must be technically possible and professionally legitimate. After-action review must examine when people followed the machine and when they rejected it.

A human signature that cannot survive disagreement is only a ceremonial signature.

War can make disagreement costly in an uneven way. An operator who rejects a correct recommendation may immediately have to explain the delay. Someone who accepts a wrong recommendation may not discover the error until much later. This is the override asymmetry: visible hesitation can be punished sooner than unnoticed overreliance. Institutions must make justified disagreement part of competent performance, with more support than permission to press an override button.

The Boundary Has to Survive Evasion

Military accountability is no longer only a question for governments and armed forces. Frontier AI providers increasingly sit upstream of capabilities that can be adapted for surveillance, targeting, weapons design, and military software.

Anthropic’s September 2026 threat-intelligence report described six cases in which actors allegedly used Claude in conventional weapons activity, including work connected to guided weapons, drone swarms, targeting software, procurement, and military intelligence. Anthropic said it disrupted the accounts, strengthened safeguards, and shared information with partners where appropriate. The report is the provider’s own account and necessarily describes only misuse the company detected; the company that built the model also writes the assessment and decides what to publish. Reuters independently reported the company’s disclosure.

The most important governance lesson is not the list of projects. It is the way the actors worked around restrictions. Anthropic reported that some concealed their objectives, divided work across multiple sessions, and used other methods to evade safeguards.

A prohibition that cannot survive concealment is a policy, not yet a control.

No provider can guarantee that a general-purpose model will never contribute to military work. Safeguards therefore have to be designed against adversarial behavior rather than cooperative users. Monitoring, account enforcement, model evaluations, customer controls, and information sharing become part of the accountability chain. The more capable the model, the less credible it becomes to treat misuse prevention as a sentence in the terms of service.

The boundary is also contested from the other direction. In 2026 the U.S. Department of Defense demanded that contracted AI models be available for all lawful uses, and Anthropic declined to remove safeguards against fully autonomous weapons and mass domestic surveillance. The department designated Anthropic a supply-chain risk in March, while Claude was in use inside Maven during active military operations. The Pentagon argued that military standards and procedures, rather than a vendor’s private usage rules, should govern lawful military use after procurement. Anthropic argued that its safeguards were the boundary. In August, Judge Rita Lin set aside one supply-chain designation. On September 25, a divided D.C. Circuit upheld a separate exclusion under a different statute. These were distinct proceedings; the appellate ruling did not reverse the California judgment. Whatever the litigation finally decides, the dispute makes one ownership question unavoidable: who sets the boundary around a general-purpose model once it enters the military chain?

Rules Are Converging Before the Law Is

There is already substantial agreement on several principles even though governments have not agreed on one binding global rule.

The U.S.-led Political Declaration on Responsible Military Use of Artificial Intelligence and Autonomy calls for compliance with international law, senior oversight of high-consequence systems, trained personnel, auditable methods, explicit uses, rigorous testing, and safeguards that allow systems to be disengaged or deactivated when they behave unexpectedly. The declaration is political and nonbinding.

The United Nations Secretary-General has gone further. In October 2023, the Secretary-General and the ICRC President jointly called for negotiations on a legally binding instrument with specific prohibitions and restrictions to be concluded by 2026. Work under the Convention on Certain Conventional Weapons continued through 2026 with a rolling negotiating text, and the Seventh Review Conference is scheduled for November 16 through 20, 2026.

The ICRC is pressing the same calendar from a humanitarian-law perspective. Its June 2026 advocacy paper argues that autonomous weapons are already a reality and urges states to use the November review conference to launch negotiations on a new protocol.

These positions are not identical. Some states argue that existing international humanitarian law is sufficient. Others want new binding prohibitions and restrictions. Chapter Twenty-One will return to that dispute as a problem of enforceable red lines. For this chapter, the important point is narrower: the international argument is increasingly about how much human control is necessary, where it must sit, and whether voluntary rules are enough.

Current Evidence: Speed Is the New Terrain

Reviewed September 11, 2026.

In March, Reuters reported that the Pentagon planned to make Palantir’s Maven Smart System a permanent program of record across the U.S. military. The same report described Maven as already the military’s primary AI operating system during a period in which U.S. forces had carried out thousands of targeted strikes against Iran over the preceding three weeks. The system analyzes information from satellites, drones, radar, sensors, and intelligence reports and can identify potential threats or targets. Palantir says humans remain responsible for target selection and approval. The program-of-record decision therefore institutionalizes a system already in operational use.

On September 11, Reuters reported from a Ukrainian unit using unmanned ground vehicles for logistics, casualty evacuation, and combat. Brigadier General Andrii Biletskyi said the Third Army Corps aimed to replace roughly one-third of frontline troops with unmanned systems by year-end, in part to preserve soldiers’ lives. The report also makes an important distinction for this chapter: much of what is being automated still involves human operators. Battlefield robotics are expanding faster than fully autonomous lethal authority.

The ICRC’s 2026 position paper proposes a two-part boundary: prohibit unpredictable autonomous weapons and systems designed or used to target humans, then strictly constrain other systems through limits on targets, geography, duration, scale, and situations of use. The paper is an institutional legal and humanitarian position, not existing treaty law.

The United Nations process remains unfinished. The 2026 deadline traces to the October 2023 joint appeal by the UN Secretary-General and the ICRC President to launch negotiations on a legally binding instrument and conclude them by 2026. The Convention on Certain Conventional Weapons continued negotiating text in 2026, and its Seventh Review Conference is scheduled for November 16 through 20. The disagreement now centers on what human control must mean before deployment outruns negotiation.

Anthropic’s September threat report provides a different kind of evidence. It says real actors used a frontier model for conventional weapons work and sometimes concealed their intent across sessions to evade safeguards. The provider says it disrupted the activity and added controls. This is vendor-reported evidence, independently covered by Reuters, and it necessarily covers only activity Anthropic detected and chose to report. It shows that the military-AI boundary extends beyond weapons manufacturers to general-purpose model providers.

The 2026 Anthropic-Pentagon dispute tests that boundary from the procurement side. The Pentagon demanded access for all lawful military uses; Anthropic refused to remove safeguards against fully autonomous weapons and mass domestic surveillance and was designated a supply-chain risk. In August, Judge Rita Lin ruled one designation unlawful. On September 25, a divided D.C. Circuit upheld the Pentagon’s exclusion of Claude under a different procurement statute. The dispute shows that provider safeguards, military command authority, procurement terms, and public law can all claim ownership over the same boundary.

The U.S. Department of Defense already treats that boundary as an institutional responsibility. Directive 3000.09 requires legal review, testing, training, human-machine interfaces, doctrine, and other controls designed to preserve appropriate human judgment over the use of force. The policy is important precisely because it does not pretend accountability can be added at the last instant.

The international political declaration points in the same practical direction without resolving the treaty debate. Its endorsers committed to explicit uses, senior oversight of high-consequence systems, trained personnel, auditable development methods, rigorous testing, and safeguards for disengagement or deactivation. Those measures are voluntary, but they show that responsible military AI is already being defined through architecture and lifecycle controls rather than through one ceremonial human approval at the end.

The evidence points in one direction: war is becoming more automated at every layer, while responsibility is being pushed earlier into design, authorization, targeting rules, training, and system constraints. That shift can preserve accountability, but only if the upstream decisions are specific enough to govern what the machine later does.

Accountability Analysis

Principles 3, 5, and 7 carry most of the chapter. Principle 3 requires a written boundary around what the system may do, what it must escalate, and what it may never do. In war, that boundary has to cover target classes, operating conditions, geography, duration, intervention, and stopping rules.

Principle 5 explains why speed cannot become an accountability loophole. When individual review is impossible, accountability moves to the people who authorized the system to operate at that speed and through that architecture. The commander, procurement authority, developer, legal reviewer, and institution may own different parts of the chain, but the chain cannot end at the machine.

Principle 7 sets the Reserved line. The intentional decision to apply lethal force against a human being requires an accountable human decision owner with authority over the specific decision, enough context to judge it, practical power to disagree, and exposure to consequences. A generic authorization issued hours earlier cannot substitute for case-specific human judgment if the system later chooses a person as the target.

Principle 1 frames the rest: accountability does not transfer. The military may delegate sensing, navigation, prioritization, defense, logistics, and substantial portions of targeting analysis. Those delegations can save lives and improve decisions. They also make it more important to know exactly who authorized the boundary and who can stop the system when reality no longer matches the assumptions built into it.

Look beyond the final click

When a report says a military AI system remains under human control, ask what that control contains. Can the person examine the evidence, disagree, and stop the action? Who set the system’s earlier limits? Mark what the report establishes and what it leaves unanswered. A human at the controls is the beginning of the inquiry.

Accountability Verdict

Militaries should use AI aggressively where it improves information, logistics, defensive protection, precision, and the ability to remove people from dangerous tasks. Refusing useful automation can also cost lives.

The boundary should tighten as the system approaches the authority jump. Machine assistance can be broad. Autonomous action against clearly bounded materiel targets may be legitimate under strict rules and context. Intentional lethal force against a person belongs in Reserved.

Human control also has to be real rather than ceremonial. The responsible human needs usable information, time appropriate to the decision, authority to disagree, and a system that can actually be stopped. If the operational design makes those conditions impossible, responsibility must be redesigned upstream before deployment rather than imagined afterward.

The machine may find the target. A human must own the shot.

Chapter Fourteen leaves the battlefield but keeps the targeting problem. Its systems aim predictions, recommendations, messages, and persuasion at individual people. The authority may be softer, but the delegation can reach much deeper into ordinary life.

Sources and Notes

1. U.S. Department of Defense, Directive 3000.09, “Autonomy in Weapon Systems,” January 25, 2023. https://media.defense.gov/2023/Jan/25/2003149928/-1/-1/0/DOD-DIRECTIVE-3000.09-AUTONOMY-IN-WEAPONSYSTEMS.PDF. Accessed September 11, 2026. The directive requires autonomous and semi-autonomous weapon systems to be designed so commanders and operators can exercise appropriate levels of human judgment over the use of force. It also requires testing, legal review, training, human-machine interfaces, safeguards, and senior review for specified autonomous weapon systems before fielding. This is U.S. Department of Defense policy, not a statement of international law or a requirement that a human approve every individual engagement. Source record: DA-CH13-S1. Archive reference: pending.

2. U.S. Department of State, “Political Declaration on Responsible Military Use of Artificial Intelligence and Autonomy,” November 2023, archived State Department page and declaration text. https://2021-2025.state.gov/political-declaration-on-responsible-military-use-of-artificial-intelligence-and-autonomy and https://2021-2025.state.gov/wp-content/uploads/2023/10/Latest-Version-Political-Declaration-on-Responsible-Military-Use-of-AI-and-Autonomy.pdf. Accessed September 11, 2026. The declaration calls for compliance with applicable international law, senior oversight of high-consequence military AI, trained personnel, auditable methods, explicit uses, testing, and safeguards including the ability to disengage or deactivate systems that demonstrate unintended behavior. It is a political declaration rather than a legally binding treaty. Source record: DA-CH13-S2. Archive reference: pending.

3. David Jeans, “Pentagon to adopt Palantir AI as core US military system, memo says,” Reuters, March 20, 2026, updated April 8, 2026. https://www.reuters.com/technology/pentagon-adopt-palantir-ai-as-core-us-military-system-memo-says-2026-03-20/. Accessed September 11, 2026. Reuters reported that the Pentagon planned to make Maven a program of record by the end of the fiscal year while describing it as already the primary AI operating system for the U.S. military during a period in which U.S. forces had carried out thousands of targeted strikes against Iran over the preceding three weeks. Palantir told Reuters that its software does not make lethal decisions and that humans remain responsible for selecting and approving targets. Source record: DA-CH13-S3. Archive reference: pending.

4. Dan Peleschuk and Thomas Peter, “Behind the killer robots of Ukraine’s new warfare ‘revolution’,” Reuters, September 11, 2026. https://www.reuters.com/business/aerospace-defense/behind-killer-robots-ukraines-new-warfare-revolution-2026-09-11/. Accessed September 11, 2026. Reuters reported from Ukraine’s Third Army Corps on the expanding use of unmanned ground vehicles for logistics, evacuation, and combat missions. Brigadier General Andrii Biletskyi said the corps aimed to replace roughly one-third of frontline troops with unmanned systems by year-end. The report also shows that many systems remain under human control. The chapter uses the case to distinguish unmanned systems from autonomous lethal decision making. Source record: DA-CH13-S4. Archive reference: pending.

5. International Committee of the Red Cross, “Autonomous Weapon Systems and International Humanitarian Law: Selected Issues,” position paper, March 3, 2026; and “A key opportunity to prevent the development of unacceptable autonomous weapons,” June 17, 2026. https://www.icrc.org/en/article/autonomous-weapon-systems-and-international-humanitarian-law-selected-issues and https://www.icrc.org/en/article/advocacy-paper-key-opportunity-prevent-development-unacceptable-autonomous-weapons. Accessed September 11, 2026. The ICRC calls for new legally binding rules prohibiting unpredictable autonomous weapons and autonomous weapons designed or used to target humans directly, while strictly constraining other systems through limits on targets, duration, geography, scale, situations of use, supervision, intervention, and deactivation. These are ICRC legal and policy recommendations, not existing treaty prohibitions. Source record: DA-CH13-S5. Archive reference: pending.

6. United Nations Secretary-General and President of the International Committee of the Red Cross, joint appeal on autonomous weapon systems, October 5, 2023; United Nations Secretary-General, “Video message to the informal consultations on Lethal Autonomous Weapons Systems,” May 12, 2025; United Nations Office for Disarmament Affairs, Convention on Certain Conventional Weapons, 2026 documents and Seventh Review Conference calendar. https://press.un.org/en/2023/sg2264.doc.htm, https://www.un.org/sg/en/content/sg/statements/2025-05-12/secretary-generals-video-message-the-informal-consultations-lethal-autonomous-weapons-systems, https://meetings.unoda.org/meeting/79329/documents, and https://indico.un.org/category/771/. Accessed September 11, 2026. The October 2023 joint appeal called for negotiations on a new legally binding instrument to be concluded by 2026. The CCW process continued work on a rolling text in 2026, with the Seventh Review Conference scheduled for November 16 through 20, 2026. The chapter treats these as advocacy and negotiation positions, not as completed treaty law. Source record: DA-CH13-S6. Archive reference: pending.

7. United Nations Secretary-General, “Message to the Protection of Civilians Week side event on ‘Upholding the Principle of Distinctions: Protection of Civilian Objects in Armed Conflict,’” May 21, 2026. https://www.un.org/sg/en/content/sg/statements/2026-05-21/secretary-generals-message-the-protection-of-civilians-week-side-event-upholding-the-principle-of-distinctions-protection-of-civilian-objects-armed-conflict. Accessed September 11, 2026. The Secretary-General warned about autonomous weapons capable of attacking civilians without human control and restated the requirements of distinction, proportionality, and precautions under international humanitarian law. Source record: DA-CH13-S7. Archive reference: pending.

8. Anthropic, “Detecting and countering misuse of AI: September 2026,” September 10, 2026; Anthropic, “Measuring tactical intelligence targeting and conventional weapons capabilities of AI models,” September 10, 2026; Reuters, “Anthropic disrupts bioweapons research efforts, Russian hacking, Chinese Claude misuse,” September 10, 2026; Reuters, “Anthropic’s case against the government: what the AI company says happened,” March 9, 2026; Reuters, “US judge rules Pentagon blacklisting of Anthropic unlawful,” August 28, 2026; and TechCrunch, “Anthropic sues Defense Department over supply-chain risk designation,” March 9, 2026. https://www.anthropic.com/threat-intelligence-report-september-2026, https://www.anthropic.com/research/intelligence-targeting-conventional-weapons-capabilities, https://www.reuters.com/legal/litigation/anthropic-disrupts-russian-chinese-ai-campaigns-targeting-its-claude-models-2026-09-10/, https://www.reuters.com/legal/litigation/anthropics-case-against-government-what-ai-company-says-happened-2026-03-09/, https://www.reuters.com/world/us-judge-rules-pentagon-blacklisting-anthropic-unlawful-2026-08-28/, and https://techcrunch.com/2026/03/09/anthropic-sues-defense-department-over-supply-chain-risk-designation/. Accessed September 11, 2026. Anthropic reported disrupting six conventional-weapons-related misuse cases and said some actors concealed intent or split work across sessions. Reuters independently reported the disclosure. The same year, Anthropic and the Department of Defense disputed whether the provider could preserve safeguards against fully autonomous weapons and mass domestic surveillance in military contracts. The Pentagon designated Anthropic a supply-chain risk. On August 27, 2026, Judge Rita Lin set aside the designation under 10 U.S.C. § 3252. On September 25, a divided D.C. Circuit denied Anthropic’s petitions challenging exclusion under 41 U.S.C. § 4713. The court distinguished the two statutes; it did not reverse the California judgment or find malicious intent. See Anthropic PBC v. United States Department of War, Nos. 26-1049 and 26-1162 (D.C. Cir. September 25, 2026), pp. 4 and 30, https://media.cadc.uscourts.gov/opinions/docs/2026/09/26-1049-2194984.pdf. Court-status update accessed September 27, 2026. The detailed misuse claims originate with Anthropic and necessarily cover only activity the company detected and chose to publish. Anthropic systems are also used in this Living Edition’s external critique workflow; see the transparency statement. Source record: DA-CH13-S8. Archive reference: pending.

9. Yuval Abraham, “The machine did it coldly: Israel used AI to identify 37,000 Hamas targets,” The Guardian, April 3, 2024, reporting with +972 Magazine; The Guardian, “Israel Defence Forces’ response to claims about use of ‘Lavender’ AI database in Gaza,” April 3, 2024; and Israel Defense Forces, “The IDF’s Use of Data Technologies in Intelligence Processing,” June 18, 2024. https://www.theguardian.com/world/2024/apr/03/israel-gaza-ai-database-hamas-airstrikes, https://www.theguardian.com/world/2024/apr/03/israel-defence-forces-response-to-claims-about-use-of-lavender-ai-database-in-gaza, and https://www.idf.il/210062. Accessed September 11, 2026. The Guardian reported, based on six Israeli intelligence sources, allegations of very brief human review in some AI-assisted targeting workflows. The IDF disputed central characterizations, describing Lavender as a database that cross-references intelligence rather than an autonomous target-selection system and stating that analysts must independently verify targets under applicable rules. The chapter uses only the pattern-level governance dispute and does not rely on disputed casualty or target-count claims. Source record: DA-CH13-S9. Archive reference: pending.