E-Paper
A drone picked its own target, and killed three in Ukraine. No treaty covers weapons like it yet
Next month, 128 countries will meet in Geneva to decide whether to negotiate an international treaty for such weapons.
Prefer HTon Google
On July 6, a small fixed-wing drone flew into Ukraine's Zaporizhzhia with about five others, none of them transmitting radio signals. Operators had launched them towards a petrol station 14km from the front line, and the drones had no radio link back to them. As it came in, the drone's software chose what to hit, most likely the propane tanks it had been trained to recognise, according to a New York Times investigation published on August 24. The drone missed, struck the wall of an apartment building and exploded near people sheltering there. Tetiana Bubynets, a 19-year-old accounting student at Zaporizhzhia National University, died in hospital, and Oleksiy Svirin, 41, and Roman Karpiy, 48, died later of their injuries.
Next month, from November 16 to 20, the 128 states party to the Convention on Certain Conventional Weapons, India among them, will meet in Geneva to discuss whether to begin negotiating binding rules for weapons that pick their own targets. The convention is a framework hosted by the UN that regulates or bans weapons considered excessively injurious or indiscriminate.
Governments have discussed autonomous weapons in Geneva for 12 years; in early September, they agreed on a text setting out what such weapons are and what limits should apply, a first step towards rules. The text has not been published so far.
Ukrainian air-defence commanders, drone specialists and forensic investigators who examined the wreckage told the Times the aircraft had flown without a pilot. The drones carried video cameras but no antennas for reaching an operator. Inside two of them, investigators found an Nvidia Jetson Orin, a consumer minicomputer that retails from $249 and is sold to students, developers and startups. The module was not encrypted, Ukrainian officials said, so specialists could read the terrain images loaded for navigation and the code specifying what the drone had been trained to attack.
Kateryna Bondar of the Center for Strategic and International Studies (CSIS) told the Times this was the first documented case of civilian deaths caused by a Russian drone using fully autonomous targeting. Colonel Serhii Minaiev, who commands air defence in the city, said: "Machines are making decisions to strike."
Also read: Starshield, the SpaceX satellite service Ukraine’s drones rely on, and who controls it
The line the drone crossed
Russia and Ukraine have both been flying drones with machine vision for two years. In the standard arrangement an operator finds a target, designates it, and software takes over for the final seconds of the attack, holding the lock after jamming cuts the radio link. Soldiers call this last-mile autonomy, and both sides now use it routinely.
Ukraine's defence ministry said in September that the number of successful strikes using AI guidance had risen tenfold since the start of the year. In tests it ran that month, each drone had to detect and lock on to a moving lightly armoured vehicle from at least 500m away and hit it with the pilot's hands off the controls. The ministry said the decision to use the technology is made by a human.
At Zaporizhzhia, operators sent the drone to an area without designating a target and left it to find something matching a category it had been trained on.
The International Committee of the Red Cross defines an autonomous weapon as one that selects and applies force to a target without human intervention. It says this means the user does not choose, or even know, the specific target, or the precise timing and location of the strike.
The US military uses almost identical wording in Directive 3000.09, its policy on autonomy in weapons, which covers weapons that, once activated, can select and engage targets without further intervention by an operator. A presidential memorandum signed on June 5 required the Pentagon to update the directive within 90 days and to review it annually after that.
Seen from a distance, a drone using last-mile autonomy and one that chooses its own target can carry the same airframe, camera and computer. But they differ in the software loaded onto them and in whether a person made the final decision. The evidence of what the Zaporizhzhia drone had done came from its Nvidia module, which was unencrypted, so investigators could read what was on it.
This also complicates the ability to reach a decision on autonomous weapons. An agreement that allows one kind and bans the other would have to be enforced with that kind of evidence, likely to be recovered only from the wreckage after a strike.
Also read: Iran's threat to Gulf undersea cables and the network carrying nearly all international web traffic
Electronic warfare
The Ukrainian and Russian armies jam radio signals along the front so heavily that many radio-controlled drones fail before reaching their targets. Both the sides have also spent two years working around this obstacle.
Russia moved first to fibre-optic drones at scale, which trail a physical cable that cannot be jammed. Russia had begun using mesh networks, in which nearby drones relay each other’s signals, in 2025, and leaned harder on them after SpaceX cut off its troops’ unauthorised Starlink terminals in February.
Ukraine has pushed with onboard AI. Its deputy defence minister Kateryna Chernohorenko said in 2024 that several dozen home-made AI systems were already being bought and delivered to the armed forces. A drone that flies without a control link cannot have that link jammed, and it does not give away where its operator is. A drone that flies and chooses its target without a human in the loop has both advantages.
The Fourth Law, a Ukrainian firm, sells an autonomy module called the TFL-1 that bolts target-lock and its own camera onto somebody else's drone. The company says the module costs from $150 and raises hit rates two to five times, while adding 10% to 20% to the cost of a drone.
What large militaries are building
The US Air Force's Collaborative Combat Aircraft programme, which is building uncrewed jets designed to fly with crewed fighters, is the furthest along of the American efforts. On June 17, the Air Force ordered both competing prototypes into production, the General Atomics YFQ-42A and the Anduril YFQ-44A, aiming at more than 150 aircraft by the end of the decade at a target unit cost near $30 million, roughly a third of an F-35.
The Pentagon has separated the autonomy software from the airframe under an open architecture called the Autonomy Government Reference Architecture, and is running the software competition in parallel.
Collins Aerospace's Sidekick flew on the YFQ-42A in early February, and Shield AI's Hivemind on the YFQ-44A later that month.
The YFQ-44A has switched between Hivemind and Anduril's Lattice mid-flight, which means new tactics can be loaded as software updates without changing the aircraft. By late September, the Air Force had received its first two aircraft at Creech Air Force Base in Nevada, describing them as semi-autonomous, for experiments on how they will be used alongside crewed jets.
This month, an F-22 pilot gave high-level tactical directives to a YFQ-44A in flight, and its onboard autonomy software carried them out in real time, the service said.
China describes its equivalent effort as intelligentisation, the successor to two earlier modernisation drives. State broadcaster CCTV in January showed a swarm of more than 200 fixed-wing drones controlled by a single soldier, with what a researcher at China's National University of Defence Technology called an autonomous anti-jamming algorithm that lets the drones plan their own flight paths when jammed. The claim, which comes from Chinese state media, has not been independently verified.
Israel's reported use of AI comes earlier in the process, in choosing targets, with software proposing them and a human approving. The systems reported by +972 Magazine and the Guardian, Lavender and The Gospel, generate and rank targets for human approval.
The Israel Defense Forces has rejected the characterisation, telling the Guardian it does not use an artificial intelligence system that identifies terrorist operatives and describing Lavender as a database for cross-referencing intelligence sources.
Russia has taken the cheapest route of the four. A narrow classifier, software trained to recognise a single class of object, can run on a consumer board and still let a drone make the final decision. Ukrainian intelligence says Nvidia Jetson modules have turned up in the V2U drone, a Shahed variant and the S-71M cruise missile.
Video | Abrams tanks to launch strike drones? America unveils Perch 2. 0 after Ukraine’s battlefield lessons
No export regime covers the software
The Missile Technology Control Regime, which 35 governments follow, restricts delivery systems by what they can carry and how far, with its strictest category covering anything lifting 500kg over 300km.
The Wassenaar Arrangement, with 42 participating states, covers conventional arms and dual-use goods, and was extended in 2013 to surveillance software and intrusion tools. Neither regime covers autonomy software for small drones, or the inference chips, which run trained AI models, that it depends on.
Nvidia has said its Jetson Orin modules are consumer products sold to students, developers and startups, and told the Times they are designed for civilian robotics and machine-vision applications and are not sold in Russia, though they are available in resale markets.
American AI companies have also had to decide whether their models can be used in such weapons. When the Pentagon pressed AI laboratories earlier this year to allow their models to be used for all lawful purposes, Anthropic refused two uses, mass domestic surveillance and fully autonomous weapons. Its chief executive Dario Amodei wrote that autonomous weapon systems may prove critical for national defence, but that frontier AI systems are not reliable enough today to power them. US President Donald Trump ordered federal agencies on February 27 to stop using the company's technology, and the Pentagon designated it a supply-chain risk. Anthropic sued, and the dispute is in courts.
OpenAI signed its own agreement with the US Department of War in February, saying it reflected the company’s principles of human responsibility for the use of force, including for autonomous weapon systems.
In Geneva
The November meeting is the convention's seventh review conference, where states are expected to decide whether to move towards negotiating a binding instrument, extend the discussion-only mandate, or let the process lapse.
UN secretary-general António Guterres and the International Committee of the Red Cross first called in 2023 for such a treaty to be agreed by 2026, and they renewed the appeal in August, describing the conference as the clearest path available to negotiations.
At the September talks, the US and Russia proposed late changes and deletions to the draft text, diplomats told Reuters. A senior diplomat said the US position had hardened over the preceding six months, with Washington favouring something closer to guidelines than a binding treaty, on the grounds that international humanitarian law already governs the conduct of war. Backers of a binding treaty include Brazil, Ireland and several African states.
The Washington Post reported on September 26 that, during the final day of the talks, US and Russian diplomats removed language from the draft requiring the weapons to function predictably and reliably, obliging users to take ethical considerations into account, and requiring a person to verify targets identified by AI before an attack.
