When the Targeting System Is AI: The Quiet Proliferation of Lethal Autonomy

AI-assisted targeting workflows are no longer a research programme. Open-source reporting on recent US military operations — including the high-tempo targeting cycles against Iranian-backed maritime and missile infrastructure, the real-time fusion of overhead imagery and signals intelligence in Eastern European theatres, and the operational integration of machine-learning targeting support at Central Command — describes a deployment posture in which AI is not a future capability but a standing component of the kill chain. The question the Department of Defense has been publicly comfortable debating — whether AI should be used in targeting — has been overtaken by a different question the department has been less comfortable engaging: what specifically is the human doing in a workflow where the machine has already identified, characterised, and queued the target.

This question is not academic. The doctrinal boundary between "decision-support" AI and "autonomous" AI is the thin line on which most of the last decade of military-AI governance has been balanced. That line has been softening for a long time. The softening has accelerated.

From Project Maven to Replicator

The public timeline begins with Project Maven, the 2017 Pentagon initiative that introduced computer-vision AI to full-motion-video analysis and triggered the internal Google revolt that first made the debate visible outside defense circles. Maven was narrowly scoped — ML-assisted object detection in overhead video — and deployed in non-kinetic analysis roles. A decade of capability development later, the operational successors encompass real-time multi-source fusion across imagery, SIGINT, and cyber telemetry, generating targeting recommendations with reliability and speed that no human analyst could replicate at the volumes required by modern high-tempo operations.

The Replicator initiative, the Office of the Secretary of Defense's 2023 acceleration programme for mass-producible autonomous systems, added the effects side of the same equation. Replicator prioritises attritable autonomous platforms — air, sea, and ground vehicles designed to be deployed in large numbers with reduced per-unit survivability requirements. The programme's operational premise is that the US can match or exceed Chinese production scale by fielding large numbers of relatively-cheap autonomous systems rather than smaller numbers of exquisite ones. Each Replicator-class system is an autonomous platform. Most are designed with AI-driven targeting and navigation.

The combination — pervasive ML-assisted analysis on the perception side, large numbers of autonomous platforms on the effects side — produces a targeting environment in which human decision-making occurs at a different place in the workflow than the traditional sensor-to-shooter cycle assumed.

What "human in the loop" means in practice

The phrase "human in the loop" has been the reassuring label on every military-AI policy document since 2017. Its durability in the policy literature has outlasted its operational precision. In current doctrine, "human in the loop" encompasses at least three distinct configurations: a human authorising each specific engagement before effects are released; a human authorising a target list and ruleset from which the system operates autonomously within defined parameters; and a human supervising the operation of a system that identifies, tracks, and engages targets matching pre-authorised criteria without per-engagement confirmation.

These are not equivalent levels of control. The first is the configuration the phrase was coined to describe. The second and third are real operational deployments that use the same language. The conceptual drift has occurred through a combination of capability development (the systems have become faster than human per-engagement authorisation can support), operational necessity (high-tempo scenarios against peer or near-peer adversaries will not permit slow kill chains), and doctrinal accommodation (the rules that govern the authorisation of pre-cleared target categories have expanded the permissible scope of delegated autonomy).

Each step of this drift is defensible on its own terms. The aggregate drift has moved "human in the loop" from a precise description of per-engagement authorisation to a general-purpose reassurance that some human is somewhere in the system. The reassurance function of the phrase has survived. The control function has weakened.

The Anthropic counter-signal

The Department of Defense's recent move to classify Anthropic as a supply-chain risk — triggered by the AI lab's refusal to permit its Claude models to be deployed in fully-autonomous lethal applications — is the most visible institutional resistance to the drift. Anthropic's position, to simplify, is that the "human in the loop" configuration that earlier AI-governance documents described as the floor remains the floor, and that capabilities which operate below that floor — systems that identify, select, and engage targets without per-engagement human authorisation — are beyond what the company will sell into.

The Pentagon's response — commercial penalty, procurement deprioritisation — is itself a data point. If the current AI-assisted operational picture were consistent with the classical "human in the loop" standard, the Anthropic position would be non-disruptive and the Pentagon would have no operational reason to penalise it. The penalty implies that the operational picture is in fact inconsistent with the classical standard, and that vendors insisting on the classical standard are commercially inconvenient. This is not a polemical reading. It is the straightforward incentive interpretation of the procurement action.

The international law question

The law of armed conflict imposes substantive requirements on targeting. Distinction (civilian versus combatant), proportionality (expected civilian harm balanced against concrete military advantage), and precaution (feasible measures to minimise civilian harm) are binding. AI targeting systems do not automatically fail these requirements. Well-designed systems with high-quality training data and appropriate command oversight can outperform human analysts on specific precision dimensions.

The problem is not whether AI systems can meet the legal standards. It is whether they can be verified to meet them, at operational scale, in real-time adversarial conditions. Verification requires visibility into how the system identified a target, what confidence level the recommendation reflected, what alternatives were considered, and what factors the system judged to be probative. Modern ML systems do not provide this kind of verification-ready explanation. Post-hoc explanations can be generated, but the relationship between the explanation and the actual computational basis of the recommendation is loose. A verification regime that cannot actually verify the decisions it claims to audit is a regime with reassurance function but limited control function.

The counterpoint

Defenders of the current trajectory argue that AI-assisted targeting at speed and scale is the only realistic way to conduct operations against peer adversaries with comparable capabilities, that the human-oversight mechanisms remain meaningfully intact even as the per-engagement authorisation model gives way to pre-authorised-category supervision, and that the precision improvements AI enables reduce aggregate civilian harm relative to the non-AI alternative. Each of these arguments has operational content.

The peer-adversary argument is the strongest. A US force configured for slow deliberative targeting against a peer configured for fast AI-assisted targeting would lose. The precision argument has strong empirical support in specific operational categories — counter-piracy, counter-UAS, precision maritime interdiction — where AI-assisted systems produce measurably lower collateral effects than the classical human-analyst-plus-guided-weapon configuration. The oversight argument is the weakest. It depends on maintaining the fiction that pre-authorised-category supervision is equivalent to per-engagement authorisation. As the technical capability deployed moves further from the latter, the equivalence becomes harder to defend.

What to watch

The near-term signal is what happens to Anthropic's position within the commercial market. If the Pentagon's supply-chain-risk action produces material commercial consequences — lost enterprise contracts beyond the DoD itself — other labs will read the signal and align. If it does not, Anthropic's posture becomes a durable differentiation and other labs may follow. The medium-term signal is whether any major military AI deployment produces a publicly-attributed incident of significant civilian harm that traces to targeting-system error. Such an incident would re-energise the human-in-the-loop debate at a level of specificity that current abstraction has insulated from scrutiny. The long-term signal is international: whether the Convention on Certain Conventional Weapons process produces any binding restraint on autonomous lethal systems, or whether the deliberative process there is overtaken by operational facts established on the ground.

Related coverage

• Anthropic's Pentagon blacklisting exposes the price of military AI guardrails — the policy-layer expression of the operational trajectory described here.
• California's new AI rules drag dataset transparency into state-level enforcement — the civilian-side AI governance framework being built at state level while defense AI moves in the opposite direction.