THREAT ASSESSMENT
LIBRARY

The 2023 Zhuhai Airshow provided the most significant public data point in our longitudinal tracking of PRC swarm capability. The demonstration of over 200 coordinated fixed-wing and multirotor platforms operating under distributed AI control — with autonomous collision avoidance, formation reconfiguration, and simulated ISR tasking — represented a qualitative leap from the light-show demonstrations of 2016-2018. We assess with high confidence that the Zhuhai demonstrations represent a subset of operational capabilities rather than the frontier of PRC research, consistent with PRC practice of revealing mature systems publicly while reserving leading-edge development for classified programs.

Reporting from multiple sources indicates that the China Electronics Technology Group Corporation (CETC), operating under PLA Strategic Support Force oversight, has been the primary locus of swarm command-and-control algorithm development since at least 2019. CETC's work on heterogeneous swarm coordination — integrating fixed-wing, rotary-wing, and ground-based robotic units — suggests an operational concept extending beyond air-only demonstrations. Academic paper output from the National University of Defense Technology (NUDT) and Harbin Institute of Technology increased approximately 340% between 2018 and 2024 in the domain of multi-agent reinforcement learning applied to aerial systems. We treat this publication surge as a lagging indicator of classified work conducted 24-36 months prior.

The DJI commercial supply chain represents a dual-use pathway that substantially lowers the barrier to swarm production scale-up. DJI manufactures approximately 70% of the world's commercial drones and maintains a vertically integrated supply chain in Shenzhen. While the gap between consumer-grade flight controllers and military-hardened swarm platforms is non-trivial, the fundamental sensor, motor, and battery technologies are directly transferable. We assess that this civilian industrial base provides the PRC with a production surge option unavailable to any peer competitor. The China Aerospace Science and Technology Corporation (CASC) has separately demonstrated loitering munition production capacity at scale; the fusion of CASC's weapons integration expertise with CETC's swarm algorithms remains an assessed — though not publicly confirmed — development vector.

PLA doctrinal documents reviewed by this desk, including publicly available versions of the "Science of Military Strategy" (2020 edition) and associated PLA Daily commentary, treat autonomous swarms as a "system-of-systems destruction" capability, designed to overwhelm adversary air defense networks through volume rather than stealth. This doctrinal framing suggests PRC planners have accepted the signature and electronic vulnerability of individual swarm units as an acceptable trade-off for mass attrition effects. We assess this doctrine is specifically calibrated against Taiwan Strait contingencies where volumetric saturation of ROCAF and USN air defense networks is a prerequisite for any amphibious operation.

The intelligence gap in this area remains significant with respect to swarm autonomous targeting logic under GPS-denied and heavy electronic warfare environments. All publicly demonstrable PRC swarm capabilities have operated in permissive electromagnetic environments. We have low confidence in assessments of how swarm coordination degrades under sustained EW suppression, as no public testing has been observed in realistic contested conditions. This gap is analytically significant because PRC adversaries (principally the United States and Taiwan) maintain robust EW capabilities that would be employed immediately against swarm operations in a Taiwan Strait scenario.

Western export controls imposed following the February 2022 invasion of Ukraine targeted the semiconductor, electronic components, and dual-use technology sectors with unprecedented breadth. The consensus among allied intelligence assessments is that these controls, while not hermetically effective, imposed substantial friction on Russian defense acquisition. Component-level forensic analysis of Lancet-3 and Shahed-series drones recovered in the Ukraine theater has identified Western-origin semiconductors manufactured prior to February 2022, consistent with the pre-war stockpile hypothesis. The presence of components from U.S., Dutch, and Japanese manufacturers in recovered post-invasion systems indicates stockpile drawdown rather than ongoing successful procurement.

Chip smuggling networks operating through intermediary jurisdictions represent the primary identified circumvention pathway. Reporting from multiple sources indicates active procurement networks operating through Singapore, the UAE, Turkey, and Kazakhstan, with trans-shipment nodes in Armenia and Georgia. The Singapore node has faced the most aggressive interdiction efforts following bilateral U.S.-Singapore enforcement cooperation, resulting in a documented contraction of that route's throughput. The UAE and Turkish routes remain more operationally active, though both governments have faced U.S. diplomatic pressure that has produced periodic enforcement actions. Kazakhstan presents a more complex picture, as Russian defense procurement entities have established legal front companies in Almaty with commercial cover that complicates interdiction without bilateral cooperation that remains inconsistent.

The Lancet-3's operational performance in Ukraine represents the most documented case study in the effectiveness of AI terminal guidance on a contemporary battlefield. ZALA Aero Group's production facility in Izhevsk has demonstrated resilience through decentralized assembly and supplier diversification, though production rates are assessed to have declined from peak 2023 output. The AI guidance module — which enables the Lancet to identify and track armored vehicles and field artillery in the terminal phase — is the most component-intensive element of the system. Recovery data suggests that this module relies on a commodity AI inference chip in the sub-10 TOPS range, a specification that can be met by a wider range of components than cutting-edge AI accelerators. This finding partially mitigates the sanctions impact for the specific Lancet guidance application.

We assess that Russia's domestic semiconductor program, centered on facilities at Zelenograd and Nizhny Novgorod, will not produce AI-grade components within the assessment period. Current domestic capability is limited to 90nm process nodes, which is insufficient for competitive AI inference at the performance levels required for advanced autonomous targeting. Russian state media and official statements have claimed progress toward 28nm domestic production, but we assess these claims to be aspirational rather than operational. The intelligence gap in this area concerns the full extent of technology transfer from PRC semiconductor manufacturers, which could potentially accelerate the domestic program timeline if PRC-Russia technology sharing deepens beyond current observed levels.

Alternative analysis suggests the possibility that Russia has adapted its operational concept away from AI-dependent systems in response to component scarcity, relying on operator-in-the-loop modes for guidance rather than full autonomous terminal engagement. Field reporting from Ukraine is consistent with an increase in semi-autonomous or remotely piloted Lancet deployments alongside the fully autonomous variant. If this adaptation is confirmed as a systematic doctrinal shift rather than an operational workaround, the sanctions impact on operational effectiveness is lower than assessed. This assessment currently discounts this interpretation, but assigns it MODERATE probability and will re-evaluate as additional field data becomes available.

The Shahed-136, first observed in operational employment against Ukrainian infrastructure in September 2022, represented a significant but fundamentally modest technical achievement: a delta-wing loitering munition with a commercial-grade GPS navigation system, a 40kg warhead, and a piston engine audible from several kilometers. Despite its technological simplicity, the Shahed-136's operational record demonstrated that volume, low unit cost (estimated $20,000-$50,000 per unit), and launch flexibility provided militarily meaningful effects against fixed infrastructure. Iran's decision to supply Shahed variants to Russia confirmed the system's strategic value as an export product and simultaneously exposed it to Western forensic examination at scale.

The Shahed-238 represents a qualitative evolution that we assess with high confidence incorporates a turbojet engine (replacing the piston), an infrared seeker, and software logic enabling the system to acquire and track discrete target signatures in the terminal phase. This architecture — GPS mid-course navigation transitioning to active IR seeker terminal homing — is the foundational design of precision-guided munitions as old as the HARM missile, but its integration into a low-cost one-way attack platform represents meaningful democratization of precision strike capability. Reporting from multiple sources indicates that the Shahed-238 program accelerated following 2022 operational feedback from Ukraine, where GPS jamming by Ukrainian forces degraded Shahed-136 accuracy and increased intercept rates.

The RQ-170 Sentinel capture in December 2011 has been a subject of ongoing analytical debate. Iran's official claim that its cyber forces spoofed the aircraft's GPS navigation and effected a controlled landing has been assessed by multiple Western intelligence services as technically plausible but unconfirmed. What is not disputed is that Iran subsequently possessed an advanced stealth reconnaissance UAV for disassembly and analysis. We assess that the most significant knowledge transfers were in composite material construction techniques, communications architecture (specifically GPS-based autonomous flight systems), and potentially in the area of optical sensors. Iranian domestic UAV development between 2012 and 2020 showed measurable improvement in several of these domains, though isolating the RQ-170 contribution from broader technology acquisition efforts is analytically difficult.

The Houthi operational employment record provides a uniquely valuable live testing dataset for Iranian system performance. Unlike laboratory or range testing, Red Sea operations subjected Iranian-supplied systems to real-world electronic warfare, naval intercept attempts by U.S. and allied forces, and maritime operating environments. The intelligence gap in this area remains significant regarding the extent to which the IRGC Aerospace Force has embedded technical personnel with Houthi units. We assess that the Houthi-Iran logistics pipeline, which has been documented through multiple interdictions by the U.S. Navy and regional partners, also carries technical data in the form of system performance logs, recovered intercept debris analysis, and potentially real-time communications from operational units.

The Chinese component supply question is the most analytically contested element of this assessment. Component forensic analysis of recovered Shahed systems has identified Chinese-manufactured microcontrollers, sensors, and passive electronic components in varying configurations. These findings are consistent with both licit commercial procurement through Iranian front companies and with a state-directed supply arrangement — the evidence base does not currently permit confident attribution. Alternative analysis suggests that the level of technical sophistication in Iran's AI guidance program would be difficult to achieve without external expert assistance, whether from China, North Korea, or non-state technical actors. We maintain a LOW confidence judgment on Chinese state involvement while flagging this as a high-priority intelligence gap.

NATO's autonomous weapons integration challenge is fundamentally a policy problem masquerading as a technical one. The technical barriers to allied interoperability — differing data standards, communication protocols, command architectures — are real but tractable. Allied technical communities have demonstrated the capacity to solve harder integration problems in other domains (e.g., LINK-16, STANAG data standards). The binding constraint is that member states hold substantially different views on what constitutes acceptable autonomous weapons behavior, and these differences reflect genuine domestic political constraints rather than negotiating positions.

Germany and France, reflecting strong domestic civil society pressure and EU policy debates on lethal autonomous weapons, maintain restrictive positions requiring meaningful human control over targeting decisions. The United States, United Kingdom, and Australia hold positions that permit a significantly wider autonomous engagement envelope in time-critical scenarios. These are not differences in rhetorical emphasis; they translate directly into incompatible rules of engagement that would require autonomous systems operating in a combined NATO task force to apply different engagement criteria depending on which nation's command authority is in the loop. We assess with high confidence that this divergence, absent a NATO-level political resolution that currently appears unlikely, will prevent combined operations leveraging autonomous strike capabilities below the strategic level for the foreseeable future.

The decision-cycle speed differential is the most operationally consequential gap identified in this assessment. Modern peer adversary autonomous systems concepts — specifically PRC swarm operations and Russian Lancet-class loitering munitions — are designed for engagement timescales measured in seconds to minutes. NATO multinational targeting processes, even in their most streamlined forms, impose coordination requirements that add 30-60 seconds of latency at minimum, and frequently considerably more when political approval chains are engaged. Against adversary systems operating at machine-speed, this latency is not a procedural inconvenience — it is a structural combat disadvantage. The intelligence gap in this area remains significant with respect to how PRC and Russian autonomous systems would actually perform against NATO air defenses at realistic operational tempos.

DIANA, established in 2022, represents NATO's most direct institutional response to the innovation speed problem. Its mandate to connect allied startups with defense challenge problems is conceptually sound and has produced a pipeline of promising autonomous systems prototypes in ISR, counter-UAS, and logistics domains. We assess with moderate confidence that this pipeline will yield operationally relevant capabilities. However, DIANA's fundamental limitation is that it operates at the prototype level; the pathway to NATO-wide operational deployment runs through individual national procurement processes, each with its own acquisition timeline, security requirements, and political oversight. Our assessment of a 5-7 year gap between DIANA prototype and NATO operational deployment is conservative and may understate the challenge.

AUKUS Pillar II represents a different integration model — three nations with closely aligned policy positions, shared classification frameworks, and a pre-existing intelligence partnership, attempting to develop genuinely interoperable autonomous systems. Early progress on shared AI/ML model sharing, sensor fusion standards, and cooperative autonomous ISR has been more substantive than the broader NATO effort. The analytical significance of AUKUS for this assessment is as a test case: if three closely aligned allies with maximum political will and pre-existing integration architecture still require years to achieve autonomous weapons interoperability, the challenge for 32-nation NATO is correspondingly greater.

The F2T2EA kill chain framework provides the most analytically tractable lens for comparing U.S. and PRC AI-enabled warfighting capacity, because each phase of the kill chain has discrete technological requirements and measurable performance characteristics. The intelligence challenge is that the most meaningful performance data — actual kill chain execution under contested conditions — is not publicly available for either side. This assessment is therefore based on inferred capability from platform and architecture characteristics, exercise reporting, and doctrinal analysis.

In the FIND and FIX phases, both the U.S. and PRC have invested heavily in multi-domain ISR fusion. U.S. Project Maven, which began as a computer vision program for ISR analysis and has expanded across DoD, represents the most mature publicly documented AI-ISR integration effort. Maven's track record in counterterrorism operations provides genuine combat validation that PRC systems lack. However, Maven's architecture was designed for counterterrorism — finding individuals and small groups in permissive environments — and scaling it to peer-competitor land and maritime warfare involves engineering challenges that have proven slower to resolve than initial projections suggested.

PRC military-civil fusion gives the PLA access to civilian AI infrastructure and datasets at a scale that constitutes a structural asymmetry. China's civilian surveillance network — estimated at over 700 million cameras with facial recognition, vehicle tracking, and behavioral analytics — provides training data for object recognition and tracking algorithms that directly translates to military target recognition. The PRC e-commerce and logistics networks provide high-volume training data for autonomous vehicle and coordination AI. No U.S. privacy framework would permit DoD to access equivalent civilian datasets. We assess this structural data advantage as most significant in the TRACK phase, where persistent surveillance and identity management at scale translates most directly to military function.

The JADC2 program represents the U.S. attempt to achieve seamless multi-domain kill chain integration. The concept — connecting sensors from all domains (space, cyber, air, land, sea) into a single operational picture accessible at echelon from strategic to tactical — is theoretically decisive. The implementation reality, as of this assessment, involves significant unresolved challenges in data fusion latency across classification domains, legacy system integration that was not designed for real-time AI consumption, and organizational incentives that resist the data sharing JADC2 requires. We assess with moderate confidence that JADC2 will not achieve its full theoretical performance specification before 2028, and that U.S. kill chain speed in a Taiwan Strait scenario would be meaningfully constrained by these implementation gaps.

The intelligence gap in this area remains significant with respect to PRC kill chain validation. Chinese military AI systems have not been tested against a peer adversary employing active countermeasures. The PLA's last major combat operation was the 1979 Sino-Vietnamese War — over four decades ago. While the PLA has invested enormously in simulation and exercise infrastructure, simulation cannot replicate the electromagnetic environment, adversary adaptation, and physical friction of actual combat. U.S. forces have accumulated two decades of continuous combat operational data that has refined AI ISR and targeting systems in ways that cannot be replicated in peacetime. This experiential advantage may prove decisive if the quality of PRC AI systems degrades materially under the conditions of actual high-intensity conflict.

The reported Pentagon blacklisting of Anthropic represents the most significant domestic AI policy event in the defense AI industry since Google's withdrawal from Project Maven in 2018. However, the dynamics are importantly different. The Google-Maven withdrawal was driven by employee protest within an organization with no primary defense mission — Google chose commercial harmony over defense contracts it did not need. Anthropic's position is more complex: the company was founded explicitly around AI safety research, its constitutional approach to AI alignment is directly relevant to the autonomous weapons question, and its commercial position is more dependent on maintaining a coherent ethical brand than a company of Google's scale. The blacklisting therefore reflects a genuine values conflict rather than a commercial calculation gone wrong.

Reporting from multiple sources indicates that the proximate trigger for the blacklisting was Anthropic's refusal to modify Claude's Constitutional AI guardrails to permit targeting assistance applications, following a DoD contractor request that was escalated to agency level. Anthropic's public usage policies explicitly prohibit use of Claude models for "development of weapons" and "activities with the potential to cause widespread harm." The Pentagon's reported position is that these restrictions are incompatible with the requirements of AI-enabled warfare and constitute a form of policy-by-commercial-terms that the government is not willing to accept. We assess with high confidence that this framing will define the legal and political battle ahead.

The Google-Maven analogy is instructive but incomplete. When Google withdrew from Project Maven in 2018, the DoD pivoted to Palantir, CACI, and purpose-built defense AI vendors without experiencing significant capability loss, because Google's contribution was incremental rather than foundational. The Anthropic case is qualitatively different because frontier large language model capability — specifically the reasoning, code generation, and analytical synthesis capabilities of Claude — represents a more foundational input to next-generation defense AI systems than the computer vision work at stake in Maven. If Anthropic's frontier research continues to advance while remaining outside the defense AI ecosystem, DoD faces a growing quality gap rather than simply a sourcing inconvenience. Alternative analysis suggests this dynamic could motivate a negotiated resolution, but current reporting indicates both sides have hardened their positions.

OpenAI is positioned as the immediate primary beneficiary of Anthropic's exclusion. OpenAI's previous agreement to supply GPT-4 class models to the DoD, announced in early 2024, established a commercial and legal framework for frontier AI in defense applications that the Anthropic blacklisting has now made strategically decisive. Microsoft's Azure Government Cloud, which provides the infrastructure for most DoD AI deployments, positions Microsoft as an integrating intermediary between OpenAI's models and defense agency requirements. The risk to this consolidation scenario is that OpenAI's own safety research community and board dynamics could produce a similar values conflict — OpenAI's departure from its original nonprofit mission structure and its commercial orientation make this less likely than it would have been in 2022, but the organizational risk is non-trivial.

The long-term innovation pipeline impact is the most analytically significant concern in this assessment. AI safety research — the domain in which Anthropic has made disproportionate contributions relative to its size — is directly relevant to the problem of safe autonomous weapons. Interpretability research, constitutional AI alignment methods, and adversarial robustness work are precisely the technical domains needed to make autonomous weapons safe enough for military deployment under law of armed conflict requirements. Excluding the leading safety AI company from defense AI work does not eliminate the safety problem; it simply means that safety research and defense AI development proceed in separate silos, with the integration left to defense-aligned vendors who have less institutional expertise in safety methods. We assess this structural outcome as negative for long-term U.S. defense AI capability and safety simultaneously — a genuinely adverse outcome for both camps in the policy debate.

The cost asymmetry problem in counter-UAS is not a procurement failure or a technology gap — it is a fundamental structural problem that derives from the economics of UAS production versus the engineering requirements of precision intercept. A Shahed-136 costs approximately $20,000-50,000 to produce. A Patriot PAC-3 missile costs approximately $4 million per round. A Coyote Block 3 kinetic intercept missile costs approximately $80,000. Even the most affordable kinetic intercept systems maintain a cost ratio of at least 2:1 against the cheapest effective attack platforms, and this ratio inverts catastrophically as attack platform costs continue to decline through commercial manufacturing scale-up. The strategic implications are significant: an adversary capable of producing attack UAS at $500 unit cost can economically sustain a campaign against a defender spending $80,000 per intercept by simple arithmetic.

The Leonidas program, developed by Epirus and integrated into the GDLS Stryker-based Leonidas AGV in partnership with Kodiak Robotics for autonomous vehicle operation, represents the most operationally advanced HPM C-UAS system in the U.S. inventory. The fundamental economic appeal of HPM is that the marginal cost per intercept approaches the cost of electricity — each Leonidas engagement consumes kilowatts of electrical energy rather than an expendable interceptor. A vehicle-mounted HPM system can in principle engage hundreds of targets in a single operational period limited only by power supply and thermal management, not magazine depth. Early test data indicates effective engagement envelopes against commercial-grade UAS in the 400-800 meter range, with an expanding envelope as power system refinements mature.

The swarm overwhelm scenario represents the most analytically challenging C-UAS problem set. Current defended area coverage from any single C-UAS system — HPM, kinetic, or EW — is inherently limited by engagement geometry, power coverage area, and reaction time. A coordinated autonomous swarm attack designed to simultaneously approach from multiple vectors, at multiple altitudes, and at varying speeds can exploit the geometric constraints of any fixed or vehicle-mounted system. We assess with moderate confidence that current C-UAS deployments, even combining HPM, kinetic, and EW layers, cannot reliably defeat a coordinated swarm exceeding 50 simultaneous platforms against a single defended point, because the engagement geometry requires impossible sensor-coverage and intercept-cadence at current system densities. This assessment is operationally significant: 50-unit swarms are within demonstrated and commercially accessible capability for multiple adversary categories.

The EW approach to C-UAS — GPS jamming, RF command-link disruption, and communication spoofing — has been the most widely deployed C-UAS method globally due to its low unit cost and broad effectiveness against first and second-generation UAS platforms. However, reporting from multiple sources indicates that UAS designers, including both state actors and commercial manufacturers, have specifically engineered against EW vulnerability in current-generation systems. GPS-denied navigation using optical flow, terrain matching, and inertial measurement units eliminates GPS jamming vulnerability. Mesh networking between swarm elements, where each unit can relay guidance and coordination data peer-to-peer without a central command uplink, defeats command-link jamming approaches that target central controllers. We assess that the EW approach will retain effectiveness against low-sophistication operators but will become progressively less reliable against adversary systems specifically designed to defeat it.

The intelligence gap in this area remains significant with respect to the operational performance of HPM systems against GPS-denied, mesh-networked swarm platforms. Laboratory and limited field testing has demonstrated Leonidas-class HPM effectiveness against commercially-derived platforms. Whether HPM retains equivalent effectiveness against platforms with hardened electronics specifically engineered against RF energy — including ferrite shielding, distributed redundant electronic architecture, and hardened flight control systems — is not yet established from available open-source evidence. This engineering arms race between HPM emitters and hardened target platforms will likely determine the long-term viability of HPM as the primary C-UAS solution, and is assessed as a high-priority intelligence and technology gap for force protection planning purposes.