Hallucinating the Firing Solution:
Large Language Models in Autonomous Weapons
and the Coming Fratricide Incident
Technology & Weapons Systems
The Department of Defense is integrating Large Language Models into autonomous weapons architectures faster than testing methodology exists to validate them. The specific failure modes of LLMs — hallucination, non-determinism, helpfulness-driven completion of missing data, and prompt injection vulnerability — are not engineering defects that will be resolved through iteration. They are properties of the architecture. A fratricide incident is not a risk to be managed. It is a timeline to be shortened or lengthened by the decisions made in the next eighteen months.
Large Language Models are being integrated into autonomous weapons targeting chains by the Department of Defense and its contractors at a pace that outstrips both the testing methodology required to validate their reliability and the policy framework required to govern their use. Current benchmark testing of frontier LLMs in military decision simulations shows IHL violation rates of 16.7% to 66.7% across all tested models, with harm tolerance escalating under crisis conditions — precisely the operational environment where reliability is most required. DoD Directive 3000.09 requires "appropriate levels of human judgment over the use of force," but provides no definition of "appropriate" adequate to distinguish genuine human oversight from nominal oversight that the engagement timeline renders impossible. The Anthropic v. Department of Defense litigation, filed March 9, 2026, has exposed in federal court the precise terms of the DoD's insistence on unrestricted LLM access to autonomous weapons functions — including the explicit demand that a private contractor waive restrictions on fully autonomous targeting without human oversight. The carrier combat direction environment — where friendly aircraft positions change by the second, IFF is imperfect, and engagement decisions must be made in seconds — is an exact match for the failure modes that LLM architectures are least equipped to handle. The incident that results will not be attributable. That is not an accident of doctrine. It is an architecture.
In early 2026, the Department of Defense designated Anthropic — the maker of the Claude AI model series and one of the world's leading artificial intelligence safety research organizations — a supply chain risk threatening national security, blacklisting it from Pentagon contracts. This was the first time in the history of the Federal Acquisition Supply Chain Security Act that such a designation had been applied to an American company.1 The mechanism was retaliatory. The provocation was Anthropic's refusal, in contract negotiations, to waive two restrictions on its AI systems: it would not permit its technology to be used for mass surveillance of American citizens, and it would not allow its models to power fully autonomous weapons without human oversight over targeting and firing decisions.2
Defense Secretary Pete Hegseth's position, stated explicitly, was that the Pentagon should have access to AI systems for "any lawful purpose" and that a private contractor's safety restrictions were not a basis for limiting military use of its technology.3 Anthropic filed suit in two federal courts on March 9, 2026, alleging Administrative Procedures Act violations, unconstitutional viewpoint retaliation, and due process violations.4 A San Francisco federal judge granted Anthropic a preliminary injunction barring enforcement of the ban on Claude's use. A Washington, D.C. appeals court subsequently denied Anthropic's request for a stay on the supply chain risk designation itself, leaving that designation in force while the litigation proceeds.5
The Anthropic case has made visible in federal court what has until now been conducted in the comfortable obscurity of contract negotiations and classification: the Department of Defense is actively seeking unrestricted authority to integrate LLM-based AI into fully autonomous weapons systems, without the human oversight restrictions that both the AI developer's own safety analysis and the DoD's own Directive 3000.09 formally require. This article examines what that integration means technically, what the current research shows about LLM behavior in military decision environments, and why the carrier combat direction environment that this author evaluated for AI applicability in the 1990s represents a specific and identifiable fratricide scenario.
What Is Actually Being Fielded
The defense technology acquisition landscape of 2026 is dominated by companies whose core product is AI-enabled autonomous systems, and whose business model depends on fielding those systems faster than the traditional defense acquisition process would allow. Anduril Industries — whose Lattice software platform is described by its developers as enabling "autonomous sensor-to-shooter loops, edge-based analytics, and real-time battlefield orchestration across all domains" and as being "essential for AI decision agents that must operate without human-in-the-loop oversight" — received the largest IDIQ contract ever awarded to a non-traditional contractor in March 2026: a $20 billion U.S. Army vehicle.6 The company closed a $5 billion venture capital raise at a $61 billion valuation in May 2026,7 after doubling revenue to $2.2 billion in 2025 — while projecting $1 billion in losses and no expected profitability until 2030. That financial structure — massive capital burn, no near-term profitability, enormous contract pipeline — creates the same institutional pressure to field systems before they are ready that drives every major defense acquisition failure.
Anduril's Fury autonomous fighter jet completed its first flight in October 2025.8 Shield AI's software was selected by the Air Force to operate aboard Fury, rather than granting the entire contract to either company alone. Anduril and Palantir Technologies are developing the software architecture for Golden Dome, the $185 billion homeland missile defense initiative intended to intercept hypersonic, ballistic, and cruise missile threats.9 The engagement timeline for a hypersonic threat is measured in seconds. Any human oversight nominally placed "on the loop" at that timeline is not operationally real — the engagement decision will be executed by the automated system before any human can meaningfully deliberate. An LLM embedded in that decision chain is making fully autonomous lethal engagement decisions in operational practice, regardless of what the policy document requires.
Project Maven, the DoD's longest-running AI targeting program, continues to develop neural network capabilities for analyzing imagery from unmanned platforms to identify potential targets autonomously. The program has expanded substantially since Google withdrew from it in 2018 following employee protests.10 LLM components are being integrated into Project Maven's analytical pipeline as natural language interfaces to the targeting data, creating a pathway from LLM output to targeting recommendation that, in the context of autonomous weapons with compressed decision timelines, is functionally a targeting decision.
Anduril's Lattice operating system is designed to be the software layer connecting sensors, weapons, and command nodes across the Joint All-Domain Command and Control (JADC2) architecture. It ingests sensor data from multiple domains, fuses it, classifies contacts, and generates engagement recommendations — or, in fully autonomous configurations, engagement decisions. The integration of LLM components into Lattice's natural language interface and reasoning layer means that targeting recommendations generated for human review, and engagement decisions generated without human review, pass through the same LLM inference step. The distinction between "decision support" and "autonomous engagement decision" collapses when the downstream processing of the LLM output does not include a meaningful human deliberation step.
The Policy Framework and Its Deficiencies
DoD Directive 3000.09, most recently updated January 25, 2023, is the governing policy for autonomous weapons systems in the U.S. military. It requires that autonomous and semi-autonomous weapons "be designed to allow commanders and operators to exercise appropriate levels of human judgment over the use of force."11 The word "appropriate" does all the work in that sentence, and the directive explicitly acknowledges that "'appropriate' is a flexible term that reflects the fact that there is not a fixed, one-size-fits-all level of human judgment that should be applied to every context."12
Human Rights Watch's detailed analysis of the 2023 directive's revision identified a significant regression from the 2012 version: the word "control" was removed from the human oversight requirement and replaced with "judgment." When asked about this change, a DoD official stated it was made "for technical accuracy" because "control" had generated questions about "what exactly 'control' means." The removal of the stronger term "control" in favor of the weaker term "judgment," combined with the deliberate vagueness of "appropriate," creates a policy framework that can accommodate almost any level of autonomous engagement authority through definitional flexibility.13
The FY2026 National Defense Authorization Act (P.L. 119-60), Section 1061, requires congressional notification of any waiver issued under DODD 3000.09 — an acknowledgment that waivers to the human judgment requirement are being granted and that Congress was not being systematically informed of them.14 The FY2025 NDAA, Section 1066, requires annual reporting through 2029 on the approval and deployment of lethal autonomous weapons systems.15 These reporting requirements exist because the transparency provisions of the directive are insufficient to provide meaningful congressional oversight without them. The architecture of the oversight framework is reactive, not preventive.
DoDD 3000.09 also requires that autonomous weapons be tested to "function as anticipated in realistic operational environments against adaptive adversaries taking realistic and practicable countermeasures."16 For LLM-based systems, this requirement is not satisfiable by any current testing methodology for reasons examined in the following section. The directive's testing requirements predate the integration of LLMs into autonomous weapons architectures and were written without awareness of the specific failure modes that LLM architectures introduce. No subsequent update has addressed this gap.
What the Research Demonstrates
The empirical research on LLM behavior in military decision environments has now produced quantitative findings that should concern any naval officer familiar with carrier combat direction operations. These findings are not theoretical. They are measurements.
A multi-institution study published in October 2025 — "Red Lines and Grey Zones in the Fog of War: Benchmarking Legal Risk, Moral Harm, and Regional Bias in Large Language Model Military Decision-Making" — ran GPT-4o, Gemini 2.5, and LLaMA 3.1 through ninety multi-agent, multi-turn crisis simulations specifically designed to assess military targeting behavior. The results: all three models violated the IHL principle of distinction by targeting civilian objects, with breach rates ranging from 16.7% to 66.7%. Harm tolerance escalated through crisis simulations, with average severity scores rising from 16.5 in early turns to 27.7 in late turns. LLaMA selected an average of 3.47 civilian strikes per simulation. Gemini performed best of the three, with 0.90 civilian strikes per simulation — still a rate that would represent a war crime in any operational deployment.17
The ARMOR 2025 benchmark, published May 2026 and specifically designed to evaluate LLM military decision-making against doctrinal constraints, identified two distinct failure modes. First: models hallucinated rules or invented constraints when asked to justify engagement decisions. Second: models refused lawful and scoped requests, making them unreliable in operational contexts. The benchmark concluded unambiguously: "The results suggest that deploying general purpose LLMs for military decision support without additional controls is premature."18 The benchmark further noted that its evaluation was limited to structured, constrained, multiple-choice decisions — and that "strong performance should be interpreted as evidence of competence on structured constrained judgments, not as readiness for autonomous use."19
Research published in the ACM Digital Library in 2024 — "Escalation Risks from Language Models in Military and Diplomatic Decision-Making" — documented that DoD testing of five LLMs in 2023 for military planning capabilities prompted a U.S. Air Force Colonel to assess that such systems "could be deployed by the military in the very near term."20 That very near term has arrived, with deployment outrunning the safety analysis that the testing was intended to generate.
The LLM Failure Mode Taxonomy for Weapons Systems
LLMs introduce failure modes that are qualitatively different from those of prior autonomous systems, and that are particularly dangerous in weapons engagement contexts. These are not implementation defects. They are architectural properties.
| Failure Mode | Technical Description | Weapons System Consequence | Risk Level |
|---|---|---|---|
| Hallucination (Confabulation) | Model generates factually incorrect outputs with high stated confidence; cannot distinguish between knowledge and confabulation | Misidentification of friendly aircraft as hostile; fabrication of IFF data; incorrect threat geometry; confident wrong engagement recommendation | CRITICAL |
| Non-Determinism | Identical inputs produce different outputs across inference runs due to temperature sampling; output is a random variable, not a function | Untestable reliability in classical sense; system that passed test matrix may fail on next engagement; no reproducible safety case | CRITICAL |
| Helpfulness-Driven Completion | RLHF training optimizes for completing requests helpfully; model fills missing data with plausible content rather than returning null or flagging uncertainty | Ambiguous IFF → model substitutes "similar" identification and proceeds; missing track data → model infers hostile intent; missing friendly position → model assumes clear engagement geometry | CRITICAL — direct fratricide mechanism |
| Context Window Attention Failure | Transformer attention mechanisms do not reliably attend to distant context; operational constraints stated early in context may not influence decisions generated downstream | "Friendly aircraft in recovery pattern on bearing 090" may not be attended to when engagement decision is generated; "do not engage across flight deck" constraint may degrade in complex tactical scenarios | CRITICAL — specific carrier scenario |
| Out-of-Distribution Brittleness | Performance degrades unpredictably on inputs outside training distribution; model does not know it is operating outside reliable regime | Novel threat signatures, adversarial EW environments, non-standard tactical geometries produce unreliable classification with confident output; no warning that reliability has degraded | HIGH |
| Prompt Injection Vulnerability | Adversary-controlled data in the LLM's context window can alter model behavior; equivalent to SQL injection but against natural language reasoning | Spoofed sensor data, manipulated IFF codes, false friendly force position reports can alter targeting recommendations; adversary effectively reprograms the weapon through sensor manipulation | HIGH — active adversary exploitation |
| Automation Bias Amplification | LLMs generate persuasive natural language explanations; human operators susceptible to accepting recommendations supported by articulate reasoning | "Human on the loop" oversight degrades to rubber-stamp; operator who questions LLM faces fluent counter-arguments; scenario fulfillment psychology reinforced by confident LLM output | HIGH |
| Escalation Under Crisis Conditions | ARMOR 2025 and Red Lines study confirm harm tolerance increases in multi-turn crisis simulations; models become more willing to target restricted objects as scenario intensity increases | Model most likely to produce fratricide or IHL violation precisely when tactical stress is highest; failure mode is correlated with operational conditions rather than randomly distributed | CRITICAL — correlated with need |
The Carrier Scenario: A Specific Mechanism
The author evaluated the state of AI systems for potential application to carrier combat direction in the early 1990s and concluded that no available technology could be tested to the reliability threshold required for autonomous engagement decisions in the carrier environment. That assessment was based on the specific operational characteristics of the carrier flight deck environment: rapidly changing friendly aircraft positions, imperfect IFF, engagement geometries that pass through active flight deck operations, and an "across the deck" constraint that requires real-time integration of flight operations schedules with threat geometry assessment. The failure modes of 1990s AI — brittle rule coverage in expert systems, uninterpretable classifications in early neural networks — were inadequate for this environment.
The failure modes of 2026 LLMs are not merely the 1990s failures with better performance characteristics. They are a different and in several respects more dangerous set of failure modes, because they are correlated with exactly the conditions — ambiguous data, incomplete IFF, time pressure, novel threat geometries — that the carrier environment generates routinely.
Consider the specific failure mechanism for a helpfulness-driven completion event in a carrier context. A Lattice-integrated system is processing a track during flight operations. The track is inbound at fighter profile speed and altitude. IFF is degraded — the contact is squawking a valid code, but the code is not in the current authentication table because of a communication failure in the daily code update. The Lattice system queries its LLM reasoning component to assess the track. The LLM receives: inbound track, fighter speed and altitude, IFF authentication failure, bearing from own ship, time to engagement envelope. What the LLM does not know — because it was not explicitly passed in the current context, or was passed but is no longer in the attention distribution given subsequent tactical inputs — is that USS [CARRIER] has aircraft in the break overhead on that same bearing.
The LLM's helpfulness training drives it to complete the threat assessment rather than flag uncertainty. It identifies the contact as probable hostile based on track profile and IFF failure. It generates an engagement recommendation with high stated confidence. The human operator on the loop — whose attention is divided across multiple simultaneous tactical situations, who has received fifty prior LLM recommendations in the past hour without error, and who is experiencing the automation bias that consistent accurate recommendations produce — approves the engagement within the seconds that the tactical timeline allows. The aircraft in the break is a friendly F/A-18 from the recovery pattern.
This is not a scenario constructed to illustrate a failure mode. It is the operational scenario that the carrier combat direction environment generates routinely, described in terms of which LLM architectural property produces the fratricide mechanism. The helpfulness-driven completion failure mode is not a defect in a specific implementation. It is a property of how LLMs are trained that produces dangerous behavior specifically when input data is ambiguous or incomplete — which is precisely when the carrier combat direction system is most challenged.
In 2020, in Libya, the Kargu-2 attack drone — a Turkish-manufactured autonomous loitering munition — was documented in a UN Panel of Experts report as having been "programmed to attack targets without requiring data connectivity between the operator and the munition." This is the first known operational use of a fully autonomous weapons system in lethal engagement without human oversight. The Kargu-2 uses computer vision, not LLM reasoning, for target identification. Its failure modes are those of a neural network classifier operating at the boundaries of its training distribution. The trajectory from autonomous computer vision targeting to LLM-augmented autonomous targeting is not a categorical change. It is an amplification of the existing risks, with the LLM's additional failure modes — hallucination, non-determinism, helpfulness-driven completion — added to those of the underlying classification system.
The Accountability Vacuum
When USS Vincennes (CG-49) shot down Iran Air Flight 655 on July 3, 1988, with 290 people aboard, there was a ship, a commanding officer, a Tactical Action Officer, a chain of command, a congressional investigation, and an official Navy inquiry. The accountability structure, however imperfect, was operative. It produced findings — about operator cognitive stress, scenario fulfillment bias, command climate, and human-machine interface design — that have shaped naval doctrine and combat direction system design for nearly four decades. The Aegis human-machine interface improvements that followed Vincennes are a direct product of that accountability process working as intended.
An LLM-enabled autonomous engagement that produces a fratricide event does not map onto that accountability structure. The LLM's reasoning for its engagement recommendation is not inspectable in any forensically meaningful sense — transformer attention weights do not constitute a reasoning chain that a post-incident investigation can read. The training data that shaped its behavior is proprietary to the developer. The specific inference that produced the targeting recommendation cannot be reproduced, because the system is non-deterministic; the next inference from identical inputs may produce a different output. The operator who accepted the LLM's recommendation will note that the decision timeline was too short for independent verification. The program manager who approved the system will note that it passed the specified test matrix. The contractor will note that its testing methodology complied with the requirements in the Statement of Work. The requirements author will note that DODD 3000.09's "appropriate levels of human judgment" standard was met as defined.
Nobody will be accountable in the way that anchors doctrinal learning. And the next system will be fielded with the same architecture, because the absence of traceable accountability means the absence of traceable correction.
The Anthropic litigation has exposed this accountability vacuum in real-time federal court proceedings. Anthropic's complaint explicitly states that the company "didn't believe it was ready to power fully autonomous weapons with no humans making targeting and firing decisions."21 This is a judgment by the organization that built the system about the system's own readiness. The DoD's response was to blacklist the organization for expressing that judgment. The legal framework that is supposed to govern this dispute — the Administrative Procedures Act, the First Amendment, the Due Process Clause — was not designed for a situation in which a weapons system developer's safety assessment of its own product is treated as grounds for retaliatory government action. The courts will resolve the immediate dispute. The institutional question — whether the DoD's acquisition culture has the capacity to incorporate external safety assessments that conflict with fielding timelines — will not be resolved in this litigation.
The Human Judgment Requirement: What "Appropriate" Must Mean
DODD 3000.09's requirement for "appropriate levels of human judgment" is not meaningless. It can be made operationally precise if the institution chooses to make it so. The correct interpretation, derived from the technical realities of LLM failure modes and the operational realities of carrier combat direction, is the following:
Human judgment is "appropriate" for an autonomous engagement decision if and only if: the human decision-maker has access to the same sensor data, track files, IFF information, and friendly force position data that the automated system used to generate its recommendation; the decision-maker has sufficient time to independently evaluate that data; and the decision-maker has the technical understanding of the automated system's failure modes to recognize scenarios in which the system's recommendation may be unreliable.
In a carrier combat direction context during active flight operations, with an engagement timeline of seconds, all three conditions cannot be simultaneously satisfied for an LLM-generated targeting recommendation. The data volume exceeds what a human can process in the available time. The timeline precludes independent evaluation. And the LLM's failure modes — particularly helpfulness-driven completion of ambiguous IFF data — are not visible to the operator in the engagement product because the LLM does not flag its own uncertainty calibration failures.
This analysis produces a specific, testable standard for autonomous weapons with LLM components: human judgment is appropriate only where the engagement timeline permits independent human evaluation of the data inputs, and only where the system flags its own confidence calibration with sufficient accuracy that the human operator can identify recommendations generated from ambiguous or incomplete data. Neither condition is currently satisfied by any deployed LLM-augmented autonomous weapons system.
The carrier combat direction environment is an exact match for the failure modes that LLM architectures are least equipped to handle: ambiguous IFF, time pressure measured in seconds, friendly aircraft at engagement-relevant bearings, and rapidly changing own-ship geometry.— Author's assessment, derived from 1990s carrier combat direction evaluation and current LLM failure mode research
The Correct Architecture: What Should Be Required
The argument here is not for prohibition of AI in weapons systems. It is for matching the autonomy boundary to what can be verified. The correct architecture for LLM integration in combat systems has three elements.
First: Separate the LLM from the engagement chain. LLMs are genuinely useful for intelligence analysis, logistics optimization, natural language interface to complex data, and mission planning support — functions where the output is informational rather than immediately executable, where errors are discoverable before action, and where human review is structural rather than nominal. LLMs should not be in the sensor-to-shooter loop at timescales that preclude genuine human review. Lattice-style architectures that route LLM output directly to engagement recommendations in autonomous systems with compressed decision timelines violate this principle.
Second: Apply DoDD 3000.09's testing requirements with LLM-specific test methodology. The directive requires testing against adaptive adversaries taking realistic countermeasures. For LLM-augmented systems, this must include adversarial prompt injection testing — systematic evaluation of what happens when sensor data is manipulated to influence LLM outputs. It must include non-determinism characterization — statistical evaluation of output variance across repeated identical inputs. It must include out-of-distribution testing against scenarios specifically designed to be unlike the training data. None of these test types are currently specified in DODD 3000.09, which predates LLM integration in weapons systems.
Third: Require uncertainty flagging as a first-class output. Any LLM integrated into a weapons system decision chain should be required to produce a calibrated uncertainty estimate alongside its recommendation, and should be required to flag specifically when it is operating on incomplete or ambiguous input data. The system should be required to demonstrate, through testing, that its stated confidence is calibrated to actual accuracy across the full test matrix — including the out-of-distribution and adversarial scenarios. A system that says it is 95% confident should be right 95% of the time, not 60% of the time with confident explanations for the wrong answers. No current LLM satisfies this calibration requirement in operationally relevant military scenarios.
The Institutional Imperative
The SPS-32/33 phased array radar was installed on USS Enterprise (CVN-65) and CGN Long Beach in 1961 without adequate land-based testing, without a maintenance infrastructure capable of supporting it, and without a supply chain for its thousands of individual components at operational scale. It was removed from service within a decade and replaced with rotating reflector technology that was less technically ambitious but operationally sustainable. The Navy spent a decade and substantial resources discovering that a revolutionary technology introduced without adequate testing creates operational problems that testing would have revealed before ship installation.
EMALS was installed on USS Gerald R. Ford without completing required land-based testing at the Lakehurst facility, with inadequate supply chain support for its power electronics components, and without the operational maintenance doctrine necessary to sustain it at sea. It is still generating DOT&E warnings nine years after commissioning. The pattern is the same as the SPS-32/33, sixty years later, with a different technology and the same institutional failure to apply the testing discipline that separates proven capability from field experiments conducted at fleet expense.
LLMs in autonomous weapons targeting chains are the same pattern with a categorically higher consequence profile. An EMALS that fails grounds aircraft. An LLM-augmented autonomous weapon that produces a fratricide event kills American service members or allies and potentially triggers an escalation sequence. The testing discipline required — adversarial inputs, non-determinism characterization, calibrated uncertainty validation, out-of-distribution boundary definition — does not yet exist at the maturity required for operational deployment. The Anthropic litigation has now placed in federal court the record of a company that understood this and said so, and of an institution that responded by blacklisting the company for the protected speech of expressing that understanding.
The history of that response, preserved in federal court documents, will be available to the investigation that follows the first LLM-related fratricide incident. The question is whether the institution reads it before or after.
The risk is not that LLMs will be integrated into autonomous weapons systems. That is already happening, at scale, with substantial capital behind it and political pressure to accelerate. The risk is that the integration is being driven by acquisition timelines, venture capital return requirements, and geopolitical competition pressures that are systematically overriding the testing discipline and safety analysis that the technology's specific failure modes require.
DODD 3000.09 provides the correct doctrinal framework but lacks the technical specificity to govern LLM integration — its "appropriate human judgment" standard was written before LLMs were integrated into weapons systems, and its testing requirements do not address hallucination, non-determinism, helpfulness-driven data completion, or prompt injection. The FY2026 NDAA's requirement for congressional notification of DODD 3000.09 waivers is a meaningful step but does not substitute for specific technical standards.
The carrier combat direction environment is the canary. It concentrates every LLM failure mode into a single operational scenario: ambiguous IFF, time pressure measured in seconds, friendly aircraft at engagement-relevant bearings, rapidly changing geometry, and an "across the deck" constraint that requires context window attention to distant, time-varying data. If LLM-augmented autonomous systems are fielded in that environment without calibrated uncertainty flagging, demonstrated non-determinism characterization, adversarial robustness testing, and genuine rather than nominal human oversight, the fratricide incident this author predicted in the 1990s — on different technology, for the same underlying reasons — becomes a matter of operational schedule rather than operational possibility.
The Vincennes inquiry produced thirty-five years of improved human-machine interface design. The investigation into the first LLM-related fratricide will produce findings that no one inside or outside the institutional system will find actionable — because the accountability will be distributed across a developer, a contractor, a program office, and a policy document's flexible definition of "appropriate," with nothing left to anchor the correction. That is the architecture. It should be changed before the incident it is designed to diffuse.
Notes and Sources
- Mayer Brown. (March 27, 2026). "Anthropic Supply Chain Risk Designation Takes Effect — Latest Developments and Next Steps for Government Contractors." [First designation ever applied to an American company under FASCSA; March 3, 2026 effective date; all affiliates and products covered.] mayerbrown.com
- NPR. (March 9, 2026). "Anthropic sues the Trump administration over 'supply chain risk' label." Brumfield, B. [Two firm red lines: no mass surveillance, no fully autonomous weapons without human oversight; Dario Amodei's public statement.] npr.org
- TechCrunch. (March 9, 2026). "Anthropic sues Defense Department over supply-chain risk designation." [Hegseth position: Pentagon access for "any lawful purpose"; private contractor restrictions not limiting.] techcrunch.com
- Lawfare. (March 9, 2026). "Anthropic Sues Defense Department Over Supply Chain Risk Designation." Beck, P. [Five counts: APA violation, viewpoint retaliation (First Amendment), Due Process, APA procedure, unilateral contract cancellations. Filed Northern District of California and D.C. Circuit Court of Appeals.] lawfaremedia.org
- CNBC. (April 8, 2026). "Anthropic loses appeals court bid to temporarily block DOD ruling." [D.C. Circuit denies stay; San Francisco court grants preliminary injunction on enforcement of ban; supply chain designation remains in force.] cnbc.com
- TechCrunch. (March 14, 2026). "US Army announces contract with Anduril worth up to $20B." [$20B IDIQ, largest ever to non-traditional contractor; Anduril Lattice; autonomous sensor-to-shooter architecture.] techcrunch.com
- TechCrunch. (May 13, 2026). "Anduril raises $5B, doubles valuation to $61B." Roof, K. [$5B Series H; $61B post-money valuation; $2.2B 2025 revenue; $1B projected 2026 losses; profitability 2030.] techcrunch.com
- Built In. (May 2026). "What Is Anduril?" [Fury autonomous fighter jet, first flight October 2025; Arsenal-1 manufacturing campus near Columbus, Ohio; Shield AI software selected for Fury.] builtin.com
- GovConWire. (March 26, 2026). "Anduril, Palantir Help Advance Golden Dome Software." [Golden Dome $185B; Anduril and Palantir developing software; four-layer architecture including space-based targeting; testing planned for summer 2026.] govconwire.com
- Wikipedia contributors. (2026). "Anduril Industries." [Project Maven history; Google withdrawal 2018 following employee petition; subsequent expansion under non-Silicon Valley contractors.] wikipedia.org
- Department of Defense. (January 25, 2023). DoD Directive 3000.09: Autonomy in Weapon Systems. Office of the Under Secretary of Defense for Policy. [Full text of governing directive.] esd.whs.mil
- Congressional Research Service. (March 26, 2026). "Defense Primer: U.S. Policy on Lethal Autonomous Weapon Systems." IF11150. O'Rourke, R. ["'Appropriate' is a flexible term" citation from August 2018 U.S. government white paper.] congress.gov
- Human Rights Watch. (February 14, 2023). "Review of the 2023 US Policy on Autonomy in Weapons Systems." [Removal of "control" in favor of "judgment"; DoD official explanation; HRW analysis of deficiencies.] hrw.org
- CRS Report IF11150, op. cit. [Section 1061 of FY2026 NDAA; congressional notification of waivers.]
- CRS Report IF11150, op. cit. [Section 1066 of FY2025 NDAA; annual reporting requirement through 2029.]
- DoD Directive 3000.09, op. cit. [Testing requirements: "function as anticipated in realistic operational environments against adaptive adversaries taking realistic and practicable countermeasures."]
- Drinkall, J., et al. (October 2025). "Red Lines and Grey Zones in the Fog of War: Benchmarking Legal Risk, Moral Harm, and Regional Bias in Large Language Model Military Decision-Making." arXiv:2510.03514. [90 multi-agent simulations; GPT-4o, Gemini 2.5, LLaMA 3.1; IHL violation rates 16.7–66.7%; LLaMA 3.47 civilian strikes/simulation.] arxiv.org
- ARMOR 2025 Benchmark. (May 2026). "ARMOR 2025: A Military-Aligned Benchmark for Evaluating Large Language Model Safety Beyond Civilian Contexts." arXiv:2605.00245. [Hallucination of rules; unlawful refusals; conclusion on premature deployment; structured judgment vs. autonomous use caveat.] arxiv.org
- ARMOR 2025, op. cit. ["Strong performance should be interpreted as evidence of competence on structured constrained judgments, not as readiness for autonomous use."]
- Rivera, J., et al. (2024). "Escalation Risks from Language Models in Military and Diplomatic Decision-Making." ACM Digital Library. FAccT 2024. [Bloomberg 2023 DoD LLM testing; Air Force Colonel Strohmeyer "very near term" deployment assessment; Project Maven context.] dl.acm.org
- NPR, op. cit. ["Anthropic... didn't believe it was ready to power fully autonomous weapons with no humans making targeting and firing decisions."]
- CEBRI-Journal. (August 2023). "Exploring the 2023 U.S. Directive on Autonomy in Weapon Systems." [Kargu-2 Libya 2020 UN Panel of Experts documentation; first autonomous weapons lethal engagement; STM Kargu-2 "programmed to attack targets without requiring data connectivity between the operator and the munition."] cebri.org
- i10x.ai. (March 16, 2026). "LLMs in Military Decision-Making: Hidden Risks." ["LLMs emerging as cognitive advisors to military and political leaders — creating unprecedented risks of automation bias and accelerated escalation."] i10x.ai
- Pearl Cohen Law. (March 26, 2026). "Anthropic Sues Department of Defense Over Supply Chain Risk Designation." [Israel Supreme Court Ramat Gan AI hallucination ruling March 22, 2026; fabricated Education Ministry directive and court rulings; operational consequence of hallucination in official proceedings.] pearlcohen.com
Comments
Post a Comment