Military AI and Lethal Autonomous Weapons (LAWS): Security in an Era When AI Models Are Controlled by the State

Hello, this is Hamamoto from TIMEWELL. When people hear the word AI, many of them picture peaceful uses such as writing text or generating images. Yet the same technology is quietly moving to the front line of the battlefield and national security. AI that selects targets, weapons that may decide on their own whether to attack, and a move by governments to draw a line that says "this AI model must not be handed to other countries." All of these look like a distant world, but they are in fact connected to the foundations of the AI services we use every day.

On June 12, 2026, the U.S. government was reported to have issued a directive to major AI companies to suspend foreign-national users' access to their top-tier AI models. What was stopped was not a "weapon" but "AI itself."

In this article, I will trace how AI is used in the military, the international rulemaking around lethal autonomous weapons, and the trend of AI models becoming subject to state control, breaking down the jargon as much as I can along the way. If you are wondering how far your own company is already caught in the net of export control and economic security, feel free to first check where you stand with our three-minute export-control risk check before reading on.

What it means for AI to become a weapon

First, I want to clear up a misunderstanding. What is actually advancing right now is not "robot soldiers like the Terminator." It is a far more mundane and far more widely used form of AI. It is AI as software that reads through the enormous volumes of data gathered from the battlefield and sorts out where things are and who might become a target.

A symbolic example is Project Maven, which the U.S. Department of Defense launched with a Deputy Secretary of Defense memorandum dated April 26, 2017 that established the Algorithmic Warfare Cross-Functional Team (AWCFT)¹. This was an effort to use machine learning to automatically analyze ISR footage, that is, intelligence, surveillance, and reconnaissance imagery, collected by drones and sensors. Picture AI taking over the grunt work that a human would otherwise do by staring at a monitor for hours looking for vehicles and people. According to reports, the "Maven Smart System" in this lineage has been used in Ukraine since 2022 to pinpoint the location of Russian equipment. The director of the U.S. National Geospatial-Intelligence Agency (NGA) reportedly said in September 2025 that Maven would begin delivering "machine-generated" intelligence at scale to combatant commanders by mid-2026, but this is a citation by way of a secondary source, and the original statement remains unconfirmed at this time.

Another case that drew global attention was target selection in Gaza. According to the testimony of six Israeli intelligence officers, given to the journalist Yuval Abraham for a report published by +972 Magazine and Local Call and shared with the Guardian ahead of publication, the Israeli military used a system called "Lavender" to generate human target candidates, alongside a separate AI-based decision support system that "recommended buildings and structures as targets rather than individuals"². The latter is the system that a short statement on the Israeli military's own website called "Habsora (the Gospel, in English)." Striking figures come from the same reporting: at one stage Lavender is said to have listed as many as 37,000 Palestinian men whom the system had linked to Hamas or Palestinian Islamic Jihad, and one officer described investing "20 seconds for each target," saying he had "zero added-value as a human, apart from being a stamp of approval." These rest on accounts from anonymous sources, and the Israeli military has denied their substance, stating that it "does not use an artificial intelligence system that identifies terrorist operatives or tries to predict whether a person is a terrorist" and that "information systems are merely tools for analysts in the target identification process." This remains a contested account that cannot be asserted as fact.

To understand the debate over lethal autonomous weapons, it helps to first pin down one yardstick: "how far is a human involved?" Experts broadly sort this into three stages.

Autonomy classification	Human involvement	Illustration
human-in-the-loop	A human approves the execution of an attack	A soldier confirms on a monitor and presses the fire button
human-on-the-loop	The machine acts; a human supervises and stops it if needed	An interception system activates automatically and a human can abort it
human-out-of-the-loop	Once activated, no human intervenes and the machine completes the task on its own	Precisely the domain that LAWS puts in question

In terms of concrete weapons, loitering munitions, which circle over a preset area searching for targets, sit right on this boundary line. Regarding the Turkish-made Kargu-2 used in the 2020 Libyan civil war, a UN panel of experts report touched on the possibility that it was operated in a manner that could track targets without human instruction. On the battlefields of Ukraine, too, there is a growing practice of combining image recognition with cheap FPV drones so that, even when communications are jammed, the final few hundred meters of the run are flown autonomously. Where does "a human fired" end, and where does "the machine fired" begin? That very ambiguity in the line is the starting point for the rulemaking that follows.

To state my own stance, what truly frightens me here is not so much that "AI fires on its own," but that "humans accept what AI has selected without scrutinizing it enough." The better AI becomes as a sorting clerk, the more humans want to delegate judgment to it. That very slackening connects directly to the debate over lethal autonomous weapons.

Two tracks of international rulemaking around LAWS

Lethal autonomous weapon systems are called LAWS for short. The rough image is of weapons that find and attack targets on their own, without a human being meaningfully involved in the decision to pull the trigger. That said, there is still no single internationally agreed definition of "where autonomy begins" or "how much human involvement makes it permissible." What matters here is that the international community is not moving down a single road: it has split broadly into two tracks. One is the disarmament track that seeks to "prohibit the dangerous things"; the other is the governance track that says "if you are going to use it, use it responsibly."

The disarmament track heading toward a "ban"

The main stage for prohibition and regulation is the Group of Governmental Experts (GGE) under the Convention on Certain Conventional Weapons (CCW), which meets in Geneva³. In 2019 this group compiled "11 guiding principles," confirming a foundation that international humanitarian law naturally applies to LAWS and that human responsibility cannot be transferred to machines. In recent years a two-tier approach, "prohibit what should be prohibited, and regulate the rest," has become the axis of the debate. The task given to the GGE is to build, by consensus, "a set of elements of an instrument, without prejudging its nature." The coordinator is Chair Robert in den Bosch of the Netherlands, who has been building up a rolling text that reflects states' views, with the final report expected to be submitted to the CCW Review Conference to be held in 2026. The 2026 sessions are reported to be scheduled in Geneva for early March and from late August into early September, for a total of about ten days. What I want to flag is that this is not the stage where "a treaty has been concluded"; it is still the stage of continuing to lay the groundwork for negotiations.

There is a more political message accumulating on the UN General Assembly side as well. According to UN meeting records, the resolution on autonomous weapons adopted by the First Committee of the General Assembly was carried in the plenary as draft A/C.1/80/L.41, by a recorded vote of 164 in favor, 6 against, and 7 abstentions⁴. The six that voted against were Belarus, Burundi, North Korea, Israel, Russia, and the United States. In the 2023 "New Agenda for Peace," the UN Secretary-General recommended concluding a legally binding instrument banning LAWS that lack human control by 2026, and the Secretary-General and the International Committee of the Red Cross (ICRC) are calling on states to reach agreement by the end of 2026. A call and an agreement are two different things, but the fact that they are pressing states with a deadline should not be overlooked.

As a structure, a large number of states favoring a ban face off against a few heavily armed states that are cautious about regulation. According to civil society groups and reporting, at the September 2025 session Brazil took the lead and 39 states parties issued a joint statement that they were "ready to begin negotiations," while the actual start of negotiations has been blocked by countries such as Russia, Israel, India, Australia, South Korea, and the United States⁵⁶. In the background lies the coloring of an AI arms race led by the U.S. and China: the more a country wants to seize the initiative, the more cautious it is about an agreement that would bind its own hands. Relatedly, there is also the question of how far to involve AI in nuclear command and control, and the leaders of the U.S. and China were reported in 2024 to have confirmed a shared understanding that humans retain the decision to use nuclear weapons. Rulemaking appears to be progressing, but honestly, where we stand now is stalled just short of the crucial matter of "binding force."

The other track, championing "responsible use"

Separate from the debate over a ban, there is a governance current that says, "we do not deny using AI in the military as such, but we use it responsibly." At its center is the "Political Declaration on Responsible Military Use of Artificial Intelligence and Autonomy," led by the United States⁷. It was announced in February 2023 at the REAIM summit held in The Hague by then-Under Secretary of State Bonnie Jenkins, and as of January 2024 it had 51 endorsing states. At the following year's REAIM in Seoul (2024), a more concrete "Blueprint for Action" was compiled. What is discussed here is not "prohibition" but an implementation-oriented set of principles for how to secure human responsibility at each stage from development through operation.

Within the United States there are also norms that anticipated this thinking as a formal system. DoD Directive 3000.09 (revised January 25, 2023) requires "appropriate levels of human judgment" in the design and operation of autonomous and semi-autonomous weapons⁸. It is an approach of putting a brake in place through one's own operational rules, without waiting for a prohibition treaty. The Geneva track aiming at a ban and this track championing responsible use are often in tension. Seen from the former, the latter looks like "justification for using it"; seen from the latter, the former looks like "idealism that ignores real-world deterrence." This tug-of-war between the two is the true face of the international politics surrounding LAWS.

How Japan approaches LAWS

So what is Japan's position? According to the Ministry of Foreign Affairs, Japan states that it "will not develop fully autonomous lethal weapons that operate beyond the reach of human involvement," and that it will not conduct research and development of equipment whose use is not permitted under international or domestic law⁹. The key phrase is "significant human involvement." Japan takes the position that such significant human involvement is indispensable to the use of weapons, and that regulation should be narrowed to fully autonomous systems that lack that involvement.

Put the other way around, the idea is that autonomous systems in which humans are properly involved should not all be uniformly restricted. According to the Ministry of Foreign Affairs, autonomous technology with assured human judgment has security significance in reducing human error and in carrying out defense with fewer personnel. For Japan, where the falling birth rate makes it hard to secure Self-Defense Force members, easing manpower burdens is a pressing theme as well. Japan has submitted working papers laying out its thinking to the UN and the CCW, and the most recent submission is reported to be in May 2024. I should note that the relevant Ministry of Foreign Affairs page could not be fetched automatically even at the time of writing, and the above reflects the ministry's working papers cross-checked against multiple primary materials. I would ask you to read the finer points on the premise that they should be confirmed against the latest published sources.

For my part, I feel that this line drawn around "significant human involvement" is realistic. The idea of banning only fully autonomous weapons while permitting the scope for which humans bear responsibility can serve as a landing point that puts a brake on the technology without rejecting it outright. The hard part, though, is the substance of what "significant" actually means. As became an issue in the Gaza reporting, even if a human is nominally verifying, if that verification is no more than a brief rubber-stamp, the involvement is in name only. To make the principle Japan upholds truly meaningful, I believe we need a deeper layer of discussion about how to define, and how to verify, the "quality" of involvement.

When the AI model itself became subject to state control

From here is the point that is the newest of the past year or two and yet tends to be overlooked. Until now, security interest has been directed at "things" such as missiles, fighter jets, semiconductors, and manufacturing equipment, and at the "technology" of their design information. But over 2025 and 2026, the United States began directly managing AI models themselves as security assets. What is more, it is doing so while the approach has not settled into a formal system, with practice alone running ahead. This "vacuum in the framework" is the trickiest part right now.

The rescission of the Diffusion Rule and ECCN 4E091

The first foreshadowing came in export control. According to commentary from law firms and others, in January 2025 the U.S. Bureau of Industry and Security (BIS) published an interim final rule that, for the first time in history, added AI model weights (the massive cluster of parameters obtained through training, which amounts to the very contents of the model) to the scope of export control¹⁰. A new classification number, ECCN 4E091, was established, and its scope was narrowed to closed (non-public) weights trained with more than 10 to the 26th power operations. BIS estimated that fewer than five models worldwide fall under this threshold. This is what came to be known as the "AI Diffusion Rule (Framework for AI Diffusion)." It was announced on January 13, 2025, published in the Federal Register on January 15, and rescinded on May 13, 2025, before its main compliance dates took effect.

Yet the policy reversed before it took effect. Under the Trump administration, BIS formally rescinded this rule on May 13, 2025¹¹. Under Secretary Kessler, who was in charge, explained that it was "divorced from commercial reality," and on the same day issued three pieces of guidance, on the risks of Chinese advanced semiconductors, on controlling the use of U.S.-made chips to train Chinese AI, and on best practices to prevent diversion, previewing a "simpler framework." Even by mid-2026, however, that simpler replacement rule has not been formally established. Whether or not to make AI models subject to control: with the skeleton of the framework unsettled, the government has come to act through individual orders instead.

The suspension of Fable 5 and Mythos, and the limited release of GPT-5.6

With the framework a vacuum, 2026 became the year of individual orders. According to reporting, in July 2025 the U.S. Department of Defense (renamed the Department of War in 2025; hereafter the Department of War) awarded contracts of up to USD 200 million each to Anthropic, Google, OpenAI, and xAI, accelerating the military use of frontier AI. Meanwhile, on February 26, 2026, in a statement issued in the name of CEO Dario Amodei, Anthropic made clear two red lines in its discussions with the Department of War¹². It would not allow its technology to be used for either large-scale domestic surveillance or fully autonomous weapons. The statement also said that "today's frontier AI systems are simply not reliable enough to power fully autonomous weapons." In response, at the end of February 2026 the U.S. administration was reported to have directed federal agencies to stop using Anthropic's technology, and almost simultaneously OpenAI announced a deployment contract with the Department of War. OpenAI is said to have reached an accommodation under a framework of "lawful use," while prohibiting two things: large-scale domestic surveillance and lethal autonomy without human approval¹³. The same red lines, but framed in contrasting ways.

Company	How the red line was framed	Content
Anthropic	Written in as a contractual inviolable	Will not allow use for fully autonomous weapons or large-scale domestic surveillance (February 26, 2026 statement)
OpenAI	Agreed under a "lawful use" framework	Concluded a Department of War contract while prohibiting large-scale domestic surveillance and lethal autonomy without human approval

And the decisive blow came in June 2026. According to reporting, on Friday, June 12, the U.S. Department of Commerce issued an export control directive ordering Anthropic to suspend its top-tier models Fable 5 and Mythos for those outside the United States, as well as for foreign nationals inside the country¹⁴. Anthropic, saying it had no means of screening foreign nationals in real time, is reported to have disabled both models for all customers within roughly 90 minutes of the notice, and the models are said to have been unavailable for more than a week¹⁵. Two triggers are said to have been behind it. One was a case in which access was granted to a South Korean telecommunications carrier under a limited-partner slot, and that company was then suspected of ties to China, an involvement the company denies. The other was a case in which Amazon CEO Andy Jassy reported to the administration that his own researchers had found a way around Fable 5's safeguards, which Anthropic counters was "a limited issue that had already been patched, not a wholesale breach of the safety measures." Furthermore, at the end of the same month, OpenAI announced its new model GPT-5.6 (a lineup of Sol, Terra, and Luna) but was reported to have narrowed its provision to "a trusted few partners" at the U.S. government's request¹⁶. OpenAI commented that it "does not expect this kind of government access process to become a long-term norm." As an article that digs into this whole sequence more from the angle of export control, I think reading The era when AI models become subject to export control alongside this one will help connect the dots into a line.

Here is the sequence so far, laid out chronologically.

Timing	Event
January 2025	BIS makes AI model weights subject to export control for the first time (ECCN 4E091). The AI Diffusion Rule is published
May 13, 2025	The Trump administration's BIS rescinds the AI Diffusion Rule. Three pieces of guidance are issued the same day
July 2025	The Department of War awards contracts of up to USD 200 million each to Anthropic, Google, OpenAI, and xAI
November 2025	The UN General Assembly adopts a LAWS resolution by 164 in favor, 6 against, and 7 abstentions
February 26, 2026	Anthropic states two red lines in the name of Dario Amodei
End of February 2026	The U.S. administration directs federal agencies to stop using Anthropic. OpenAI announces a Department of War contract
June 12, 2026	The U.S. Department of Commerce orders foreign-national access to Fable 5 and Mythos suspended
Around June 26, 2026	OpenAI limits GPT-5.6 to a trusted few partners

What is being asked of Japanese companies as users and builders

Having read this far, you might feel that "this is a story about American military and politics, and has nothing to do with Japanese business." But I believe Japanese companies in particular should take this on as their own concern. There are two reasons.

One is the risk on the user side. Many Japanese companies build U.S.-origin AI and cloud services into their operations. If that model is suddenly cut off one day for security reasons, the operations running on top of it stop along with it. The suspension of foreign-national access in June 2026 spread to all customers because Anthropic could not sort out foreign nationals. In other words, "we are a Japanese company, so we are out of scope" is not necessarily true. Which AI, and which country's technology, do you depend on? Is there an alternative when it stops? This inventory is becoming part of business continuity planning going forward. The point that access itself becomes subject to control is laid out from a practical perspective in How to prepare for the era when the AI you use suddenly stops one day.

The other is the risk on the builder side, the provider side. Once AI models and their related technology come to be classified as subject to export control, you have to judge, case by case, who you may provide what to. In the world of export control, the work of confirming whether a given technology or product falls on a regulatory list is called classification screening. Furthermore, there is a concept called "deemed export," under which letting foreign-national employees or overseas offices use technology is regarded as an export even without crossing a border. Once access to AI models or APIs comes within this scope, managing who inside the company may touch which AI, and how far you let business partners use it, becomes far more complex all at once. The Diffusion Rule was rescinded, and individual orders keep arriving while no replacement framework has settled. This very uncertainty is the real cost for companies.

This is where the export control AI agent we at TIMEWELL developed, TRAFEED (formerly ZEROCK ExCHECK), can prove useful. TRAFEED is a service we built to support classification screening of whether a product or technology falls under regulation, screening of counterparties, and monitoring of regulatory updates. The more military use and state control of AI advance, the more we need a mechanism to continually confirm, for AI models and related technology as well, "is this OK to hand over?" and "is the counterparty problem-free?" It replaces judgments that rely on a staff member's memory or intuition with operations aligned to the latest regulations. It is unglamorous, but this is a realistic step toward leveling the risk on both the user side and the builder side. On the premise that the final classification judgment rests with your company's export control officer, our role is to make the investigation and first-pass screening that precede it faster and more accurate.

The lines that will be drawn next, and how companies can prepare

Finally, let me organize the points to come. LAWS regulation (the CCW and UN debates) and state control over corporate AI models are, as systems, separate tracks. The former is the disarmament context of constraining how weapons are used; the latter is the management context of who AI is handed to as a security asset. Yet the two are clearly connected by the questions of "how much significant human involvement to require," "what lawful use means," and "where to draw the line that must not be crossed, such as fully autonomous weapons and large-scale surveillance." The exchange between Anthropic and the U.S. government was an event in which that connection point erupted in the form of a corporate red line.

Seen from the technology side, this is also a repeat of a pattern we have seen before. One tech-focused outlet characterized the suspension of Fable 5 and Mythos as the first real-world test of whether frontier AI can truly be contained through export control, overlaying it with the history of how attempts to suppress encryption technology and spyware through export control once failed to function adequately¹⁵. Digital technology can be copied and crosses borders easily. AI model weights are no exception. Within voluntary frameworks like the Wassenaar Arrangement, which brings transparency among states to exports of conventional arms and dual-use technologies, whether AI weights and training data can be treated as "technology" or "software" is something that will be tested in earnest from here on¹⁷.

What can companies do? There are no flashy answers. First, grasp the AI you depend on and its sources of supply, and estimate the impact and the alternatives if it stops. Second, inspect whether anything among the technology or AI access you provide could fall within the scope of regulation. Third, accept that regulations and entity lists are moving targets, and review your judgments continuously rather than treating them as a one-time exercise. These three are not the conclusion to the grand theme of military AI, but rather practical preparations you can begin tackling tomorrow.

If you want to work out what becomes a risk in your own case and where to start, please feel free to reach out via an individual consultation. You can review the feature overview in the TRAFEED product catalog (PDF). At the intersection of AI and security, we can start by taking inventory of your export control and economic security responses together. Precisely because we live in an era when AI can become both a weapon and an object of control, this is a time to get ready, early, to put into words "who are we handing what to."

---

References

Footnotes

1. Memorandum for See Distribution, Subject: “Establishment of an Algorithmic Warfare Cross-Functional Team (Project Maven)” — Deputy Secretary of Defense, U.S. Department of Defense — dated 26 April 2017 — scanned copy of the official memorandum — https://www.govexec.com/media/gbc/docs/pdfs_edit/establishment_of_the_awcft_project_maven.pdf ↩

2. "'The machine did it coldly': Israel used AI to identify 37,000 Hamas targets" (Harry Davies and Bethan McKernan, The Guardian, 3 April 2024) — reporting on the testimony of six Israeli intelligence officers, given to the journalist Yuval Abraham for a report published by +972 Magazine and Local Call; the Guardian states that the accounts "were shared exclusively with the Guardian in advance of publication." The Israeli military's response is carried in the same article: "The IDF does not use an artificial intelligence system that identifies terrorist operatives or tries to predict whether a person is a terrorist," and "Information systems are merely tools for analysts in the target identification process." — https://www.theguardian.com/world/2024/apr/03/israel-gaza-ai-database-hamas-airstrikes / "'The Gospel': how Israel uses AI to select bombing targets in Gaza" (Harry Davies, Bethan McKernan and Dan Sabbagh, The Guardian, 1 December 2023) — records that "a short statement on the IDF website" said it was using an AI-based system called Habsora (the Gospel, in English) — https://www.theguardian.com/world/2023/dec/01/the-gospel-how-israel-uses-ai-to-select-bombing-targets ↩

3. Lethal Autonomous Weapon Systems — UNODA (UN Office for Disarmament Affairs) — updated periodically — https://disarmament.unoda.org/en/our-work/emerging-challenges/lethal-autonomous-weapon-systems ↩

4. GA Adopts More Than 60 Resolutions, First Committee (recorded vote 164-6-7, draft A/C.1/80/L.41) — UN Meetings Coverage — 2025-11 — https://press.un.org/en/2025/ga12736.doc.htm ↩

5. September 2025 GGE Joint statement — Stop Killer Robots — 2025-09 — https://www.stopkillerrobots.org/news/september-2025-gge-joint-statement/ ↩

6. Geopolitics and the Regulation of Autonomous Weapons Systems — Arms Control Association — 2025-01 — https://www.armscontrol.org/act/2025-01/features/geopolitics-and-regulation-autonomous-weapons-systems ↩

7. Political Declaration on Responsible Military Use of Artificial Intelligence and Autonomy — U.S. Department of State — 2023-02 — https://www.state.gov/political-declaration-on-responsible-military-use-of-artificial-intelligence-and-autonomy-2/ ↩

8. DoD Directive 3000.09, Autonomy in Weapon Systems (revised 2023-01-25) — U.S. Department of Defense — https://www.esd.whs.mil/portals/54/documents/dd/issuances/dodd/300009p.pdf ↩

9. Lethal Autonomous Weapon Systems (LAWS) — Ministry of Foreign Affairs of Japan — last updated unconfirmed — https://www.mofa.go.jp/mofaj/dns/ca/page24_001191.html ↩

10. New U.S. Export Controls on Advanced Computing Items and AI Model Weights (ECCN 4E091) — Sidley Austin — 2025-01 — https://www.sidley.com/en/insights/newsupdates/2025/01/new-us-export-controls-on-advanced-computing-items-and-artificial-intelligence-model-weights ↩

11. The US AI Diffusion Rule (rescission on 2025-05-13) — United States Studies Centre — 2025 — https://www.ussc.edu.au/the-us-ai-diffusion-rule ↩

12. Statement from Dario Amodei on our discussions with the Department of War — Anthropic — 2026-02-26 — https://www.anthropic.com/news/statement-department-of-war ↩

13. OpenAI announces Pentagon deal after Trump bans Anthropic — NPR — 2026-02-27 — https://www.npr.org/2026/02/27/nx-s1-5729118/trump-anthropic-pentagon-openai-ai-weapons-ban ↩

14. Anthropic Says US Orders Halt to Foreign Access for Fable 5, Mythos 5 — Bloomberg — 2026-06-13 — https://www.bloomberg.com/news/articles/2026-06-13/anthropic-says-us-limits-foreign-access-to-fable-5-mythos-5 ↩

15. From PGP to Mythos, history shows why cyber export control doesn't work — TechCrunch — 2026-06-19 — https://techcrunch.com/2026/06/19/encryption-spyware-and-now-mythos-history-shows-why-cyber-export-control-doesnt-work/ ↩ ↩²

16. OpenAI limits GPT-5.6 rollout after government request — TechCrunch — 2026-06-26 — https://techcrunch.com/2026/06/26/openai-limits-gpt-5-6-rollout-after-government-request-says-restrictions-shouldnt-be-the-norm/ ↩

17. Understanding U.S. Allies' Current Legal Authority to Implement AI and Semiconductor Export Controls — CSIS — 2025 — https://www.csis.org/analysis/understanding-us-allies-current-legal-authority-implement-ai-and-semiconductor-export ↩