‘Wanted to make flying robots’: How Ukraine used 20-year-old open source code to take down Russian bombers

This handout photograph taken on May 23, 2025 and released on May 24, 2025 by the press service of the 93rd Kholodnyi Yar Separate Mechanized Brigade of the Ukrainian Ground Forces shows FPV drones equipped with explosive devices in a shelter at an undisclosed location near Kostyantynivka, Donetsk region, amid the Russian invasion of Ukraine.

In one of the most daring and technically complex attacks of the Russia-Ukraine war, Ukraine’s Security Services (SBU) deployed a fleet of small drones using open source software to devastate Russia’s long-range bomber fleet.

The operation, dubbed Spider Web, was reportedly over a year in the making — and was executed in broad daylight, with precision strikes on air bases in Belaya, Olenya, and Ivanovo, hundreds of miles inside Russian territory.

At the heart of this unprecedented strike was ArduPilot — a 20-year-old piece of open source autopilot software originally built by drone hobbyists for peaceful, educational, and recreational use. It was never intended to be a weapon of war, but it has now etched its place in military history.

ArduPilot’s story began in 2007, when Chris Anderson – then editor-in-chief of WIRED magazine – started the website DIYdrones.com and pieced together a functioning UAV autopilot system using Lego Mindstorms. The platform became a community hub for tech-savvy hobbyists and drone enthusiasts. In 2009, Anderson partnered with Jordi Munoz, a fellow drone enthusiast who had just won an autonomous vehicle competition, to launch 3DR, a consumer drone company that also birthed the first functional versions of ArduPilot.

His collaborator, Jason Short, was equally stunned. “Not in a million years would I have predicted this outcome. I just wanted to make flying robots,” he wrote on X, tagging Anderson and Munoz. “ArduPilot-powered drones just took out half the Russian strategic bomber fleet.”

18 years after @Jrdmnz@jason4short and I created ArduPilot, here it is destroying large parts of the Russian air force. Crazy https://t.co/2SfPQHrcuA

Chris Anderson (@chr1sa) June 1, 2025

Ukrainian President Volodymyr Zelensky said the drone attack was 18 months in the making and coordinated from a location across the street from a Russian intelligence office. “A total of 117 drones and operators were involved, striking 34% of Russia’s strategic cruise missile carriers across multiple regions and time zones,” he said, adding that all Ukrainian personnel were safely withdrawn from Russian territory after the operation.

The SBU quickly claimed responsibility, revealing it had spent 18 months smuggling explosive-laden quadcopters into Russia hidden in trucks and containers. The drones, stored under false shed roofs, were launched remotely when signaled. Videos showed the drones were powered by ArduPilot software.