INTELBRIEF
The Emerging Need to Protect Critical Infrastructure and VIPs from Weaponized AI Drone Threats
Autonomous Visual (Facial Recognition) Tracking Demo, Winter 2025
- Generative Artificial Intelligence (GEN-AI), when used for malicious and criminal purposes, is predominately recognized for its analytical, mission planning, and propaganda value.
- GEN-AI now also offers coding capability to extremists, terrorists, and insurgents, which provides them with PHY-AI capabilities that can translate into drone (and robot) weaponization.
- Weaponized consumer drones can increasingly be created with advanced facial and object targeting capabilities which would allow them to be launched as ‘fire and forget’ weapons directed at CI and VIPs.
- A synthesis of C-UAS and C-AI will be required to deter, respond to, and mitigate this emerging threat.
Consumer generative artificial intelligence (GEN AI) readily provides non-state actors, extremists, and criminals the ability to program consumer drones for autonomous flight and object (pattern) targeting for weaponization purposes.Proof-of-concept activities I directed at C/O Futures confirm the substantial uplift GEN AI provides to actors with no formal coding skills to weaponize drones that autonomously attack programmed targets. Critical infrastructure and VIP (dignitary, executive) protection protocols will increasingly be insufficient to meet this advanced emerging threat. New procedures derived from a fusion of counter-terrorism principals, red-teaming, and an understanding of machine vision and physical AI will be required to respond to and mitigate this deadly challenge. Ultimately, a synthesis of counter-unmanned aircraft systems (C-UAS) and counter artificial intelligence (C-AI) will also need to be brought to bear.
The nefarious component of GEN AI, increasingly recognized within the last couple of years by counter-terrorism professionals, is derived from its ability to create new content (including analytical products) related to the processes and planning of illicit and para-military activities. This content includes giving guidance on how to build improvised explosive devices (IEDs) or even chemical or biological devices, providing mission planning for a school shooter attack, creating a small arms training regime to hone tactical skills, supporting terrorist propaganda and recruitment, as well as assisting in a host of other threatening activities limited only by a failure of imagination.
Recognition of GEN AI content creation for malevolent purposes is still in its initial stages but its actual use by criminals, extremists, and non-state actors has gone beyond early-adopter incidents to spread at an increasing pace. These include the attacks on Trump International Hotel in Las Vegas on 1 January 2025, Florida State University in Tallahassee on 17 April 2025, the American Reproductive Centers in Palm Springs on 17 May 2025, Tumbler Ridge Secondary School in British Columbia on 10 February 2026, along with full adoption by Boko Haram and other Islamic State provinces from 2024 or so onward.
However, the ability of GEN AI to engage in coding, which directly facilitates the conduct of nefarious acts in the physical domain, has until quite recently gone almost unnoticed. This still emergent follow-on threat represents a transition from GEN AI capability (the ability to create computer code) over to physical AI (PHY AI) actuation. The significance here is that it empowers an individual or group with little to no coding ability (heretofore considered a specialized skillset) with the ability to program drones and other robotic systems with autonomous acquisition and targeting capabilities. Providing significant advancement in lone-actor or small-group attack capability, a drone so programmed becomes a ‘fire and forget’ weapon and has the additional advantage of rendering many current C-UAS impotent. This is even before PHY AI attributes related to response time and speed of flight advantages over human operators are factored into the equation. Where such new capabilities get even more concerning is the shift from generative to <a href="https://digitalcommons.unomaha.edu/ncitereportsresearch/162/” rel=”nofollow noopener” target=”_blank”>agentic AI models — that is, those that have agency or autonomy versus the passive nature of GEN AI — which will undoubtedly prove to make such ‘fire and forget’ drones even more capable.
While advancing capabilities in this regard have been mentioned specifically in relation to armed nation-states where individual soldiers or military vehicles are acquired and then destroyed by autonomous weaponized drones (such as in the fighting between Ukraine and Russia), attributing these capabilities to criminals, extremists, and terrorists would seem to defy conventional logic. Initial projections of terrorists and insurgents eventually gaining these capabilities began in the mid-2010s in non-public weaponized drone threats training provided by the author. However, object (pattern) targeting for consumer drone weaponization purposes is already here. Inklings of this advancement having become a reality appeared in March 2024 in an online video in which an assassination drone was programmed by an engineering graduate student. Physical confirmation of these technological capabilities being available to non-coders with the assistance of GEN AI has now been validated by C/O Futures, LLC in various emerging threat-focused ‘proof of concept’ activities, beginning in 2025, related to its GEN AI initiative. Without going into specifics, a simulated extremist or terrorist group with no coding training can, via advancements in GEN AI, now use those systems themselves to code consumer drones to autonomously acquire objects and then achieve ‘target lock-on.’ This is undertaken via facial and pattern recognition processes underpinned by machine learning models that have been built (or simply acquired from online app libraries) and trained. The follow-on protocol of having the autonomous drone physically fly into the targeted object — presumably with an IED with an impact detonation method (such as via crossed metal whiskers) — then itself becomes a relatively simple process. The ease of this overall approach has escaped the attention of most non-state actors who have not forensically studied it for attack implementation purposes.
This means that critical infrastructure (CI) and dignitaries and executives (VIPs), along with the specific vehicles that they are riding in, can now be threatened and attacked in new and innovative ways by malicious autonomous drones fielded by non-state groups. To date, no specific incident of a successful attack of this type by extremists, terrorists, or the cartels has been publicly reported, but the potential readily exists. Unfortunately, CI, VIP and related protection protocols will increasingly be insufficient to meet this advanced emerging threat. New procedures derived from a fusion of counter-terrorism principles, red-teaming, and an understanding of machine vision and physical AI will be required to respond to and mitigate it. Ultimately, a synthesis of C-UAS and C-AI disciplines will need to be brought to bear to address this emergent hybrid threat, operating within the developing GEN AI and PHY AI threat frontier, which offers malevolent actors a new and deadly capability.
Published in partnership with the 2026 Global Security Forum
Dr. Robert J. Bunker is with the Future Security Initiative (FSI), Arizona State University and is the Director of Research & Analysis, C/O Futures, LLC.
We use cookies to ensure you get the best experience on our website. Learn more
