Deep Dive

Minab: how a school became a target

An outdated label, a warning that went nowhere, machine-speed review and depleted oversight teams. How AI-assisted targeting hit a girls' school, and what it means for anyone using AI to make decisions about people.

Angela Milash

— 6 min read
Share

What happened

On the morning of 28 February 2026, the first day of the US war with Iran, Tomahawk cruise missiles hit the Shajareh Tayyebeh Elementary School in Minab, a small city in southern Iran. It was mid-morning on a school day. About 156 people were killed, roughly 120 of them children; counts have shifted as recovery went on (NBC News).

Open-source investigators geolocated video of a Tomahawk striking next to the school (Bellingcat), a missile only the US fielded in that war. By 11 March a preliminary Pentagon assessment had found the US at fault (NPR). On 17 September a UN fact-finding mission said there were reasonable grounds to believe the US committed a war crime (Reuters).

How a school became a target

Bloomberg's reconstruction of the Pentagon's internal review describes a “cascade of preventable failures” (Bloomberg via ThePrint; Bloomberg graphic). No single person or system chose to bomb a school. Four ordinary failures lined up.

  1. A label nobody updated. Years earlier, the site was classified as an IRGC naval base. Satellite images from 2017 and 2018 show walls separating the school from the base, a painted sports pitch and playground markings. The label never changed. Data quality: ‘garbage in, garbage out’.
  2. A warning that went nowhere. An analyst noticed the change in 2019 and flagged it, but in a system that was not connected to the database used for targeting. Operational gaps in information management.
  3. Speed that turned review into a formality. Palantir's Maven Smart System took in the old label and flagged the site as a priority target. More than 1,000 targets were struck in the first 24 hours, and steps that once took hours took minutes. Some staff expected Maven to catch outdated data. It did not.
  4. The human in the loop teams were depleted. Teams that assess civilian harm had reportedly been cut by about 90 percent; at Central Command, from 10 people to 1.

On 22 September, Central Command said it had changed how targets are vetted, added continuous re-checks of intelligence and open-source cross-checks, and that human judgment remains essential (summary of Bloomberg's report).

A short history of Maven

  • 2017: The Pentagon launches Project Maven to use AI to analyze drone footage (Wikipedia).
  • 2018: Google's work on Maven becomes public. Thousands of employees sign a petition and some resign. On 1 June 2018 Google says it will let the contract expire in March 2019 (The Intercept).
  • 2019: Palantir takes over the work (The Next Web).
  • 2024 to 2025: Palantir's Maven Smart System contract ceiling rises from $480 million to nearly $1.3 billion, with more than 20,000 users (DefenseScoop). Anthropic's Claude is integrated into Palantir's platform for classified use.
  • Early 2026: Anthropic asks for written limits barring Claude's use for fully autonomous weapons and mass surveillance of Americans. The Pentagon refuses. On 27 February the President tells agencies to stop using Anthropic's technology and the company is designated a supply-chain risk. A district court vacates the designation in August; in September an appeals panel lets the phase-out continue. Sources told CBS that Claude was used in the opening strikes on Iran (CBS News).

Tech engineers and workers said no, and the work moved to another vendor. A model maker asked for limits, and the government customer refused them. The power to stop this system both is and is not sitting with the people who build its parts. This is the conversation about autonomous technology.

What it means beyond the battlefield

The stakes in Minab were as high as they get. The failure pattern is not unusual: it is what goes wrong whenever software is trusted to speed up decisions about people.

  • The data is old and nobody owns it. Systems act on what the record says, not on what is true today.
  • Corrections live somewhere else. The person who knows the record is wrong often writes it in a system the decision tool never reads.
  • “A human approves it” stops meaning much at machine speed. When a tool produces candidates faster than people can check them, review becomes a click. People also assume the tool will catch what they miss.
  • The review function is the first thing cut. Automation is sold as efficiency, and the people who ‘slow things down’ look like the cost.

Every one of these issues exists today in companies using AI agents to approve loans, flag fraud, screen job applicants, triage patients or block accounts. The consequences are smaller. The mechanics are the same.

What to do if you deploy AI to make or speed up decisions

  1. Put an age on every fact the system acts on. Records past their review date should block a decision, not just raise a warning.
  2. Connect the correction channel. Wherever staff flag “this record is wrong,” that flag must reach the system making decisions.
  3. Cap the pace to what people can actually review. If reviewers can check 50 cases an hour, the system should not send 500. Measure how long approvals take; seconds means rubber stamp.
  4. Make the tool show its doubts. Show the evidence, its age and what would change the answer, so reviewers question instead of confirm.
  5. Protect the reviewers. Treat cuts to oversight teams as a risk decision that leadership signs, not a line in a budget.

What we still don't know

  • The Pentagon's full findings. The formal investigation has not been published, and lawmakers have pressed for its release.
  • Claude's role, if any. Anthropic's Claude is reported to be built into Maven. Anthropic's CEO, Dario Amodei, told Bloomberg he does not know how the models were used in this strike (report). No public source shows Claude was involved in choosing this target, or how the Pentagon's phase-out of Claude has gone.
  • Exact figures. Death tolls, and whether the school was hit two or three times, differ between sources.
  • Whether the changes work. Central Command has described new checks, but not how often data must be refreshed or how many targets a reviewer may approve per hour.

Why I'm writing about this

This newsletter usually covers how to secure AI agents. The horror of Minab is not a security bug, and I won't pretend the fix is a better checklist. It is a moral question among many. When software helps decide who lives, good engineering is not enough. We need ethical limits and policy, agreed between countries, on how far these systems can go, and mechanisms of enforcement both technical and with a policy and legal basis.

Context matters. Most AI agents today are built on a handful of frontier models. The same model that drafts an email can sit inside a targeting system, and the company that made it may not be able to see how it is used. Controls where a system is built (data checks, review limits, permissions) matter. Controls held by decision makers, policymakers and regulators matter just as much, if not more: who can say no, who can stop a system, and what happens when they do. We talk about an off switch. Minab shows we have to agree who holds it, and make sure it works.

To the engineers, designers, analysts and product people reading this: the decisions that shape these systems are not only made in war rooms. They are made in sprint planning, in code review, in the quiet meeting where someone asks whether a feature should ship. You have more power than you think. You can choose what you build, and what you will not. You can ask who a system will touch, and who it might harm. And when the answer troubles you, you can say so, out loud, every time. That is not disloyalty. That is the job. The Google workers who spoke up about Maven did not stop it, but they changed the conversation. We need that courage now, on every team, in every company. Never stop speaking truth to power.

I'm running an experiment: asking leading AI models what successful international rules on autonomous weapons would look like. I'll publish what they say, where they agree, and where they fail. The first part of this work, We Could Have Nice Things - Autonomous Weapon Controls, comes out later this month. P.S. Free Palestine.

— AM

Disclosure and sources

Disclosure: AgentSec Brief is researched and drafted with human input and AI tools, including Anthropic's Claude, and reviewed by one or more people before publication.

Bloomberg's reporting is paywalled. The details above come from published summaries of it, linked below, not from the original.

Read more