Military AI and Strategic Stability

Established Weapons that select and engage targets without further human intervention are not prospective; some are four decades old. The US Phalanx close-in weapon system (fielded 1980) and the Aegis combat system have long had modes that engage incoming threats automatically, and the Israeli Harpy loitering munition has been sold since the 1990s with the ability to loiter over an area and dive on emitting radars without per-target human approval. What changed in the 2020s is not the existence of machine targeting but its economics and its reach: cheap machine perception moved autonomy out of fixed defensive niches into small offensive munitions produced by the hundred thousand, while machine learning entered the intelligence fusion and decision-support layers of nuclear-armed states.

Frontier Whether this stabilizes or destabilizes deterrence is genuinely contested, with real evidence on both sides. Proponents argue automation extends decision time by filtering data and reduces error relative to fatigued humans; critics point to a documented record of automation bias, to escalation dynamics measured in wargames and simulations, and to the entanglement of AI-enabled sensing with nuclear command, control and communications (NC3). Neither side can yet point to a decisive empirical test at the strategic level.

Frontier The governance question is scheduled to come to a head within months of this writing. After a decade of Geneva talks, the Group of Governmental Experts (GGE) on lethal autonomous weapons systems held its final mandated session on 31 August to 4 September 2026, and the Seventh Review Conference of the Convention on Certain Conventional Weapons (CCW) in November 2026 must decide whether to open negotiations on a binding instrument. This brief tracks the documented battlefield record as reported by named investigations, stated doctrines, the negotiation state, escalation modelling, the meaningful-human-control literature, and the verification problem. It is a strategic-stability and governance analysis; it contains nothing operational.

Established The measured record of military automation failure predates modern AI and is unusually well documented. On 26 September 1983 the Soviet Oko early-warning system reported five inbound US ICBMs; duty officer Stanislav Petrov judged the alert false (it was sunlight glinting off clouds) and did not pass it up the chain as an attack warning. In 1988 the USS Vincennes, operating the Aegis system under time pressure, shot down Iran Air 655, killing 290 civilians, after the crew misread the system's data. In March and April 2003, US Patriot batteries operating in highly automated engagement modes shot down a British RAF Tornado GR4 and a US Navy F/A-18C, killing three aircrew; US Army human-factors investigations, notably the work of John Hawley at the Army Research Laboratory, attributed the fratricides substantially to automation bias, operators trusting machine classifications they had seconds to overrule. These cases anchor every serious argument about human control: humans sometimes catch machine errors (Petrov), and sometimes ratify them (Patriot).

Established The first UN-documented case of a weapon attacking without required connectivity to an operator dates to Libya, 2020. The UN Panel of Experts on Libya (report S/2021/229, March 2021) described Turkish-made STM Kargu-2 loitering munitions used against retreating Haftar-affiliated forces, systems that were, in the Panel's words, programmed to attack targets without requiring data connectivity between the operator and the munition. Frontier Whether the Kargu-2 actually killed anyone in autonomous mode is not established. The Panel's report does not confirm casualties attributable to autonomous operation, and the episode is widely over-cited as the first autonomous kill; the honest reading is documented autonomous attack capability, undocumented autonomous lethality.

Frontier Ukraine has become a running natural experiment in which electronic warfare pushes both sides toward terminal autonomy. Radio-frequency jamming along the front made operator-steered FPV strike drones unreliable in the last hundreds of metres, and both sides responded with machine-vision terminal guidance: the operator designates, the munition completes the attack on its own if the link drops. Ukrainian developers claimed autonomous strikes by the Saker Scout reconnaissance-strike system as early as October 2023 (vendor claims), and Russian sources have claimed automatic target recognition for the Lancet family (vendor claims); independent verification of engagement-mode settings in specific strikes is essentially absent, which is itself a preview of the verification problem. Ukrainian government figures put domestic drone production above two million units in 2024 (programme's own figures); at that scale, autonomy policy is set by procurement defaults, not by individual operator choices.

Frontier On 1 June 2025 the entanglement of cheap autonomous-capable systems with nuclear forces moved from the journals to the airfields. Ukraine's SBU smuggled first-person-view drones deep into Russia and struck strategic-bomber bases in Operation Spiderweb; Kyiv claimed 117 drones launched and 41 aircraft hit, while independent satellite-imagery analyses confirmed roughly a dozen Tu-95 and Tu-22M3 bombers destroyed or damaged at Belaya and Olenya (claims and confirmations diverge, and both should be reported as such). Ukrainian officials and subsequent reporting stated that some drones completed their final approach autonomously when jamming cut the control link. The strategic-stability point does not depend on the exact tally: aircraft that are counted under the New START treaty as nuclear-capable delivery systems were destroyed by systems costing orders of magnitude less, by a non-nuclear state, using partially autonomous terminal guidance.

Frontier The Gaza war produced the most detailed reporting to date on AI decision-support in targeting, and it is contested reporting. Investigations by +972 Magazine and Local Call (Yuval Abraham, November 2023 on the Habsora target-generation system and April 2024 on Lavender), based on six Israeli intelligence-officer sources and partially corroborated by The Guardian, claimed that Lavender marked roughly 37,000 Palestinians as suspected militants; that a known error rate of around 10 percent was accepted; that human review of machine-nominated targets sometimes took about 20 seconds, largely to confirm the target was male; and that pre-authorized civilian-casualty allowances were attached to target categories. The Israel Defense Forces deny the characterization, stating that these are information-management and decision-support tools, not systems that select targets, and that analysts must make independent determinations. The numbers are not independently verifiable. What the episode documents even on the military's own account is the governance-relevant quantity: machine target nomination at a scale that compresses per-target human judgment, which is precisely what the meaningful-human-control debate is about. These were not autonomous weapons; they were the decision layer above human-operated ones.

Established Stated doctrine in the United States permits autonomous weapons under review requirements and does not require a human in the loop. DoD Directive 3000.09, Autonomy in Weapon Systems (2012, reissued 25 January 2023), requires that systems allow commanders and operators to exercise appropriate levels of human judgment over the use of force and imposes a senior-level review for certain autonomous systems; its own drafters have said publicly that it is neither a ban nor an in-the-loop mandate. The Replicator initiative (announced August 2023) set out to field thousands of attritable autonomous systems within 18 to 24 months, and the Pentagon stated the first tranche was delivered by August 2025 (programme's own figures).

Established Every public nuclear-weapons commitment on AI so far is a unilateral or bilateral declaration, not a verified obligation. The 2022 US Nuclear Posture Review commits to maintaining a human in the loop for all actions critical to informing and executing presidential nuclear-employment decisions; the United Kingdom has made a similar declaratory commitment. On 16 November 2024, at their Lima meeting, Presidents Biden and Xi affirmed the need to maintain human control over the decision to use nuclear weapons, the first joint US-China language on the question. US Strategic Command leadership has said publicly that AI will support decision-making but never make launch decisions. Frontier Russia has made no equivalent declaration, and its posture cuts the other way. Moscow maintains the Soviet-legacy Perimetr semi-automated retaliation system (details contested), is developing the Poseidon nuclear-armed autonomous underwater vehicle, and argues in Geneva that existing international humanitarian law (IHL) suffices and no binding instrument is needed.

Frontier China's position concedes the vocabulary of human control while defining almost everything out of scope. Its 2022 CCW working paper proposes prohibiting only systems that cumulatively meet five criteria, including full autonomy with no possibility of termination and uncontrolled self-evolution, a threshold almost no militarily useful system would meet; analysis at West Point's Lieber Institute (2025) reads Chinese human-oversight language as supervisory on-the-loop control, and in October 2025 Beijing again argued definitions must be agreed before binding commitments.

Established The negotiation record is long, and its endgame is dated. CCW informal meetings began in 2014; the GGE was established in 2016 and agreed 11 guiding principles in 2019; its current mandate is to develop elements of an instrument by 2026. In October 2023 the UN Secretary-General and the ICRC President jointly appealed for a legally binding instrument by 2026 prohibiting autonomous weapons that function without human control and regulating the rest. UNGA resolution 78/241 (December 2023) was the first General Assembly resolution on the subject; the Secretary-General's report A/79/88 (2024) compiled the views of states and other stakeholders; resolution 79/62 was adopted on 2 December 2024 by 166 votes to 3 (Belarus, North Korea, Russia against; abstentions including China, India, Iran, Israel, Turkiye and Ukraine), mandating informal consultations held in New York in May 2025; and on 6 November 2025 the First Committee adopted a follow-on resolution 156-5-8 calling on CCW parties to complete the elements of an instrument.

Established Inside the GGE, a negotiating majority now exists and the blocking minority is explicit. In September 2025 Brazil delivered a statement for 42 states declaring the chair's rolling text a sufficient basis to move to negotiations. At the March 2026 session the chair circulated a working characterization of LAWS as a functionally integrated combination of one or more weapons and technological components that can identify, select, and engage a target without intervention by a human operator; support for negotiations grew from roughly 40 to more than 70 states during the week (WILPF's count), while the United States proposed replacing the term human control with good faith human judgement and care, which most delegations rejected. The final GGE session concluded on 4 September 2026, days before this brief closed, and its outcome document was not yet in the public record at time of writing; the Seventh CCW Review Conference in November 2026 decides whether a negotiating mandate exists.

Frontier Escalation modelling gives the debate its only quantitative, if artificial, evidence. Rivera and colleagues (FAccT 2024) placed five off-the-shelf large language models in a turn-based simulation as autonomous national decision-makers and found that all models exhibited escalatory behaviour with sudden, hard-to-predict escalation spikes and arms-race dynamics; a base model without safety fine-tuning was the most severe, occasionally choosing nuclear first use with rationales as thin as possessing the weapons. Earlier RAND wargaming (2020) found that inserting autonomous systems into crises degraded signalling: machines do not read restraint, and speed itself generated inadvertent escalation. Both are toy environments; neither has a validated mapping to real command staffs, and that gap is itself a research finding.

The open questions are not whether military AI exists but how it interacts with deterrence, crisis management and law.

Frontier Is there a floor on crisis decision time below which human deliberation becomes ceremonial? Hypersonic delivery, AI-fused early warning and automated battle management each shave minutes from timelines that for ICBMs were already only about 30 minutes and for depressed-trajectory submarine launches less. Whether decision-support systems extend usable time (by filtering noise) or compress it (by presenting machine confidence that is costly to overrule) has never been measured at the strategic level; the tactical record from Patriot suggests the second effect is real.

Frontier Does AI-enabled sensing erode secure second strike? If machine processing of satellite, acoustic and signals data makes mobile missiles and submarines trackable, counterforce temptation grows and crisis stability falls. Evidence is fragmentary: mobile-missile hunting remains historically hard, and Speculative claims that the oceans will become transparent to ML-processed sensor networks remain projections without demonstrated detection performance against quiet submarines.

Frontier Does removing or compressing the human raise or lower harm to civilians? Advocates argue machines neither panic nor take revenge; the reported Gaza record suggests decision-support can also industrialize permissiveness by scaling target nomination faster than judgment. Both effects can be true in different systems; no fielded comparison has ever been published.

Frontier What happens when autonomous systems interact with each other? Financial markets provide the only large-scale record of algorithm-on-algorithm interaction under adversarial pressure, and it includes flash crashes; whether military autonomy produces analogous flash engagements is modelled but unmeasured.

Frontier Can diffusion be governed at all? Terminal-guidance autonomy in Ukraine rides on commercial components and open-source software; whether any instrument negotiated in Geneva can bind a technology whose supply chain is a hobbyist catalogue is an open institutional question, not a rhetorical one.

Established Verification is unsolved, and the field mostly admits it. Autonomy is a property of software, configuration and use, not of observable hardware: the same airframe is operator-steered or autonomous depending on a settings flag, and the flag can change after inspection. No party to the GGE has tabled a verification protocol with demonstrated ability to distinguish compliant from non-compliant systems; proposals in the academic and UNIDIR literature (design-time declarations, observable doctrine, tamper-evident engagement logging, post-incident forensics) exist on paper and have never been piloted at scale. Honest treatments state the conclusion plainly: a LAWS instrument would begin life with weaker verification than the Biological Weapons Convention, which has none.

Established Definitions remain contested after a decade because they allocate obligations. China's five cumulative criteria, the chair's 2026 working characterization, and the US preference for judgment language over control language are not semantics; each draws the treaty boundary around a different set of systems.

Established There is no accepted test-and-evaluation science for autonomous targeting under adversarial conditions. Machine-vision systems degrade under distribution shift, camouflage, decoys and adversarial countermeasures; militaries acknowledge the problem (it motivates 3000.09's review requirements) but no public benchmark measures how error rates move when an adversary is trying to move them, so certification claims cannot be independently examined.

Frontier Attribution and forensics lag use. The Kargu-2 and Ukraine cases show the pattern: whether a given strike was executed autonomously is generally unknowable to outside investigators, which blocks both accountability and confidence-building.

Frontier Secrecy is structural. The assurance a stability regime needs (show me your control arrangements) is exactly what military organizations classify; no state has yet accepted intrusive access to weapon software, and none has proposed a workable substitute.

Progress on the stability question waits on results mostly being produced elsewhere.

Frontier Evaluation science for AI systems. The same gap that frustrates frontier-model governance, no mature science of behavioural guarantees under novel inputs, is the binding constraint on certifying weapon autonomy; formal verification handles components, not end-to-end perception-decision chains in open environments.

Frontier Wargaming methodology validation. The escalation results that alarm policymakers come from synthetic games; nobody has established how well LLM-agent or tabletop results predict real institutional behaviour, so a research programme on wargame external validity is upstream of taking those results at face value.

Established Open-source intelligence as the de facto verification layer. Commercial satellite imagery and OSINT analysis, which produced the independent bomber-damage counts after Spiderweb, currently do more compliance-relevant observation than any treaty body; the stability literature increasingly depends on this ecosystem's health.

Established Legal infrastructure. Article 36 of Additional Protocol I already obliges states to review new weapons for IHL compliance; scholarship and state practice on making such reviews rigorous and partially transparent is the nearest existing institution a future instrument could build on.

The decisive results in this field are institutional and observational as much as experimental, and the brief ranks them.

Frontier The most consequential scheduled result is a policy result. The decisive near-term result is institutional rather than technical: whether the Seventh CCW Review Conference in November 2026 adopts a negotiating mandate for a legally binding instrument on autonomous weapons, or lets a decade of preparatory work lapse into another mandate cycle. With a negotiating majority above 70 states, a 156-vote General Assembly resolution behind it, and the explicit opposition of the largest military powers, the conference is a clean test of whether consensus-based arms control can still bind a militarily significant technology before mass adoption. Either outcome settles the live institutional question.

Frontier The natural experiment already running is the electronic-warfare-versus-autonomy race in Ukraine. If, over the next two to three years of documented use, terminal autonomy becomes the procurement default on both sides, the window in which human-in-the-loop norms could be locked in by treaty will have closed in practice regardless of what Geneva decides; OSINT-based observation of fielded system modes is the measurement instrument, imperfect as it is.

Frontier Escalation findings need replication with humans in the loop. The Rivera protocol, LLM agents in crisis simulations, should be rerun as pre-registered, cross-laboratory experiments with mixed human-machine command teams, measuring whether machine advice shifts human escalation choices (the automation-bias question at the strategic echelon). This is cheap, unclassified, and nobody has published it.

Speculative An adversarial targeting benchmark would convert certification claims into measurements. A public, unclassified benchmark reporting how automatic-target-recognition error rates move under countermeasures would do for weapon-review claims what public model evaluations did for AI-safety claims; classification pressures make it unlikely soon, which is why it stays speculative.

Speculative A verification pilot is the missing existence proof. One multinational exercise in which participating systems carry tamper-evident engagement logs audited by a third party would establish whether post-use verification is feasible at all; it has been proposed in the literature and funded by no one.

Frontier The nuclear-adjacent measurement that matters is early-warning false-positive behaviour. Red-team studies of AI-fused warning systems against Petrov-class ambiguous stimuli would quantify whether machine fusion suppresses or amplifies false alarms; the work is inherently classified, so the public record may only ever see its conclusions, if those.

Established Controllability is an engineering property before it is a legal one, and its components are known. The ICRC's recommended restrictions read as a specification: limits on target types, geographic and temporal bounds on operation, and guaranteed human ability to supervise, intervene and deactivate. Geofencing, mission-time cutoffs, and deactivation that works under jamming are all buildable; the engineering tension is that every channel added for human override is a channel an adversary can attack, which is exactly the pressure that produced terminal autonomy in Ukraine.

Established Human-machine interface design determines whether nominal control is real control. The Patriot record shows that a human with veto authority, seconds of decision time, and high trust in the machine is functionally out of the loop; engineering meaningful control means engineering vigilance, calibrated trust displays, and workload, the field Hawley's studies founded and which remains underfunded relative to autonomy itself.

Frontier Tamper-evident logging is the load-bearing verification technology. Cryptographically sealed engagement records (what the system perceived, what mode it was in, who authorized what) are the only proposed mechanism that survives the software-mutability objection, and they exist today only as proposals and prototypes.

Frontier On the nuclear side, the engineering requirement is architectural separation. Advisory AI in NC3 (data fusion, options analysis) must be demonstrably incapable of initiating release actions; that demands air-gapped authority chains, formally specified interfaces at the human decision points, and modernization discipline in programmes (US NC3 modernization among them) that are otherwise incentivized to integrate everything with everything.

Established This topic is the hard case of several neighbouring ones. The evaluation and compute-governance machinery surveyed in AI Governance is the civilian face of the same unsolved problem, certifying behaviour of learned systems; military autonomy is where its absence is priced in human lives rather than benchmark scores. The treaty-design-under-rivalry problem belongs to Existential Risk Governance, and the accountability-gap questions (who is liable when a machine's engagement violates IHL) connect to Future Legal Systems.

Frontier Two technical adjacencies shape the threat model. Emergent dynamics among interacting autonomous systems, the flash-engagement worry, is the military instance of the questions treated in Multi-Agent Intelligence Systems; and the integration of frontier-scale models into military planning and intelligence, already begun through defence contracts with leading AI labs, ties the field's trajectory to Artificial General Intelligence. Loitering-munition hardware itself is commodity aerospace; the strategic questions live almost entirely in software, doctrine and law.

Established The CCW's consensus rule is the central institutional fact. Every state party can block; Russia has used procedure to slow the GGE for years, and the same rule let a handful of states dilute each annual mandate. The forum that owns the issue is structurally unable to bind its most reluctant members, which is why the two-tier package (prohibit systems that cannot comply with IHL; regulate the rest) has existed in substance since 2023 without becoming law.

Established The escape route has precedents. The Ottawa landmines convention (1997) and Oslo cluster-munitions convention (2008) were both negotiated outside consensus fora after CCW deadlock, without the major military powers, and both nonetheless built stigma that shaped behaviour beyond their membership. A UNGA-mandated negotiation is the analogous path here, and the 156 to 166-vote resolutions of 2024-2025 are its constituency; the open question is whether a treaty without Washington, Moscow and Beijing restrains anyone who matters.

Frontier A parallel soft-law track exists and is growing. The US-initiated Political Declaration on Responsible Military Use of AI and Autonomy (2023) had about 58 endorsing states by late 2024, and the REAIM summit series (The Hague 2023, Seoul 2024) produced a Blueprint for Action; these commit signatories to review, testing and senior authorization practices without prohibiting anything, and their measurable effect on procurement is so far undocumented.

Frontier The nuclear layer is being handled bilaterally and declaratorily. The Biden-Xi human-control statement and the P5 context around it are the only institutional coverage of AI in NC3; there is no negotiation, no verification, and no Russian participation, which makes this the least institutionalized part of the highest-stakes question.

Established The only universal existing institution is the national weapon review. Article 36 reviews are legally required of Additional Protocol I parties now; proposals to make them more rigorous and partially transparent are the lowest-cost institutional upgrade on the table.

Established Meaningful human control began as an NGO coinage and became the negotiation's centre of gravity. The UK NGO Article 36 introduced the phrase in 2013; Roff and Moyes gave it elements (predictable systems, informed operators, timely intervention, accountability) in 2016; Santoni de Sio and van den Hoven formalized it as tracking and tracing conditions in 2018. The 2026 fight between human control and good faith human judgement and care is the direct descendant of this literature, with the operative question being whether control must be exercised per engagement or may be designed in at the system level.

Established The accountability gap is the oldest objection and remains unclosed. Sparrow's 2007 argument, that neither programmer, commander nor machine can properly bear responsibility for an autonomous system's unlawful kill, has been answered in doctrine (states insist command responsibility attaches) but not in practice: no individual has ever been prosecuted for an autonomous or decision-support-mediated targeting error, including the documented fratricides.

Frontier The dignity argument divides even opponents of the technology. The claim, associated with UN special rapporteur Christof Heyns (2013) and invoked through the Martens Clause, that delegating kill decisions to machines wrongs the target regardless of outcomes, moves some delegations and leaves consequentialists unmoved; it cannot be settled empirically, and the brief flags it as a values question rather than a research question.

Frontier The measured harms so far run through compressed judgment, not runaway machines. The reported 20-second reviews in the Lavender investigation, if accurate, describe humans formally in the loop and substantively out of it; automation bias research predicts exactly this failure mode. Ethics frameworks that certify presence of a human without measuring the quality of human engagement certify the wrong variable.

Speculative Threshold-lowering is plausible and unproven. The argument that casualty-free force lowers the political cost of starting wars has historical analogues (drone campaigns) but no clean causal evidence yet at the autonomous-systems level.

Frontier The civilizational stake is whether strategic judgment stays a human practice. Each delegation step (sensing, fusion, nomination, engagement) has been individually defensible, and the record shows the ratchet only turns one way under battlefield pressure: Ukraine adopted terminal autonomy because jamming forced it, not because anyone chose machine war. The endpoint of the ratchet, interacting automated force postures with humans ratifying machine tempo, is the flash-war scenario, and financial markets are the existence proof that coupled algorithms produce system-level events no designer intended.

Frontier The nuclear taboo has a human anchor that automation quietly corrodes. Eighty years of non-use rest partly on individual humans (Petrov among them) bearing personal moral weight at decision points; distributing that weight across machine recommendations and pre-delegated protocols is a change in the taboo's load-bearing structure whose consequences nobody can measure until it fails.

Established Historically, weapons have been regulated after mass use, not before. Chemical weapons were banned in 1925 after Ypres, cluster munitions in 2008 after decades of harm; the LAWS process is one of the few attempts to legislate ahead of mass adoption, and its outcome in 2026 will be read, fairly or not, as the precedent for whether AGI-era military capabilities can be governed prospectively at all.

Speculative Diffusion may matter more than great-power balance. If autonomy keeps riding commercial supply chains, the long-run redistribution of coercive power toward middle powers and non-state actors, of which Spiderweb is an early data point, could reshape deterrence more than anything the P5 negotiate.

These horizons track the governance decision points and the observable diffusion of autonomy, not laboratory capability.

• 10 yr: Frontier The November 2026 Review Conference either opens negotiations or diverts the issue to a UNGA track; either way, terminal-guidance autonomy becomes a procurement default in peer conflict, and the declared human-control lines at the nuclear level hold or visibly fray with Russia the test case. A first legally binding instrument, with or without the major powers, is plausible within the decade; verified compliance is not.
• 25 yr: Speculative Tamper-evident logging or an equivalent post-use verification mechanism gets its first treaty use if any instrument matures; autonomous systems are standard across major militaries; whether a machine-speed crisis (a flash engagement between automated postures) has occurred by then is the live uncertainty this brief cannot resolve.
• 50 yr: Speculative Strategic decision support is institutionalized in all nuclear states; stability depends on whether the era's treaties bound machine roles in NC3 while the binding was cheap, a window that closes early in this period.
• 100 / 250+ yr: Handwave Claims that war becomes bloodless machine-on-machine exchange, or that automated deterrence delivers permanent stability, or that AI abolishes war through perfect information are assertions with no evidential basis; every measured datum so far shows automation redistributing rather than removing violence.

• Depends on Nothing technical on this map blocks the field; its constraints are institutional. The evaluation-science and governance results tracked in AI Governance (behavioural certification of learned systems) and the treaty-design work in Existential Risk Governance are the nearest upstream dependencies.
• Requires (not on this map) A CCW negotiating mandate for a binding autonomous-weapons instrument, the decision the November 2026 Review Conference either takes or refuses; declared human-control commitments over nuclear employment from all nine nuclear-armed states rather than the current three-and-a-half; a validated test-and-evaluation method for autonomous targeting under adversarial conditions, without which certification claims are unfalsifiable; reproducible escalation experiments with mixed human-machine command teams to replace toy LLM wargames; and a tamper-evident engagement-logging standard that militaries actually accept, the only proposed verification mechanism that survives software mutability.
• Enables A worked example of pre-adoption arms control for software-defined capability, which is the template every subsequent AI-governance regime (civilian or military) would build on; conversely, stable machine-restraint norms in NC3 are close to a precondition for surviving the integration of more capable AI into state power.
• Adjacent The accountability machinery of Future Legal Systems, the interaction dynamics of Multi-Agent Intelligence Systems, and the capability trajectory of Artificial General Intelligence each set boundary conditions on this topic.

Handwave “Killer robots are science fiction.” Autonomous engagement has been fielded since 1980 in defensive systems and since the 1990s in the Harpy; the UN documented autonomous-attack-capable munitions in combat in 2020. The fiction framing survives because it lets the debate be postponed.

Established “International law already bans them.” False. IHL applies fully to their use (the GGE affirmed this in 2019 and every year since), but no prohibition specific to autonomous weapons exists in any treaty; that absence is precisely what the 2026 Review Conference is about.

Frontier “A ban treaty is inevitable given the UN votes.” The 156 to 166-vote majorities are real, and so is the fact that the states building the systems voted no or abstained; Ottawa and Oslo show treaties without the great powers can build norms, and also show those norms bind unevenly. Inevitable is not a defensible reading of a process one consensus rule has stalled for a decade.

Frontier “The Gaza reporting shows AI autonomously killing people.” As reported, Lavender and Habsora are decision-support systems whose outputs humans approved; the IDF disputes even that characterization, and the sourcing is six anonymous officers, partially corroborated. The documented concern is compressed human review, not machine-initiated engagement, and precision matters because the two failure modes need different remedies.

Established “The Kargu-2 in Libya was the first confirmed autonomous kill.” The Panel of Experts documented capability and use, not casualties attributable to autonomous mode; the claim exceeds its source, and repeating it hands sceptics an easy debunking.

Frontier “Nuclear launch is already automated somewhere.” No nuclear state claims delegated launch authority to machines. Russia's Perimetr is reported as a semi-automated system with humans at the final step, though its details are contested and Moscow has made no human-control declaration; the US, UK and the joint US-China statement have explicitly committed the other way. The honest statement is: not automated, and protected mainly by promises.

Speculative “AI will make deterrence safer through better information.” Coherent and undemonstrated. Decision-support advocates cite data-overload relief (US experiments claimed days of added warning, on the programme's own figures); the counter-record is automation bias from Patriot to the wargaming literature, and Petrov's case, where the safeguard was a human distrusting the machine.

Frontier “Regulation is pointless because verification is impossible.” Half right, therefore wrong. Verification is unsolved, but the BWC has bound state behaviour for fifty years with none, and norm-plus-transparency regimes measurably shaped landmine and cluster-munition markets; the inference from unverifiable to worthless is not supported by the arms-control record.

Handwave “Autonomous war will be bloodless, machines fighting machines.” Every documented use of autonomy so far, Libya, Ukraine, the decision-support layer in Gaza, has had humans on the receiving end; nothing in procurement trends points at machine-only battlefields.

Frontier “The LLM wargame results show AI wants war.” Overread. Rivera and colleagues measured unpredictable escalation preferences in text-generation systems placed in roles nobody deploys them in; the finding that matters is the unpredictability and the automation-bias risk when such outputs advise humans, not machine intent.