Tech advocacy groups are sounding the alarm, warning that the rapid evolution of artificial intelligence and a lack of federal oversight for foreign nationals working at AI firms pose a major national security risk.
Amy Kremer, chair of Humans First, a group focused on establishing democratic oversight, safety protocols, and local control over artificial intelligence, said AI technology has virtually no federal guardrails compared to other tech sectors.
"This is a national security threat. These companies hold and have access to a lot of sensitive information," Kremer told Fox News Digital. "You don't have to steal an entire AI model to get information. You can just find out what they're working on, who their partners are, and who their adversaries are. That is not the kind of thing that we need getting out."
"If America wants to lead the world on AI, and we want America to have this AI advantage, then we have to put national security at the top," she added.
Kremer's concerns come as AI continues to expand, even as many Americans and lawmakers remain wary of the fast-moving industry.
In early October, an engineer at OpenAI, one of the world's most prominent AI companies, was arrested after allegedly planting a recording device inside a conference room at the AI giant's San Francisco office.
Abdulrahman Alfozan, 35, a Saudi Arabian citizen, allegedly researched how to construct a recording device and where to place it inside OpenAI, eventually concealing a customized audio recorder behind a television in an executive conference room in late September, according to the Justice Department.
Searches of his home and electronic devices uncovered similar components and photographs that appeared to show reconnaissance of other locations inside OpenAI, including another conference room used for sensitive meetings, federal prosecutors said.
Alfozan, who was a lawful permanent resident in the United States, was terminated by OpenAI following his arrest.
In January, a former Google software engineer was convicted of stealing thousands of pages of the company's trade secrets related to AI to benefit China.
Even the AI firms themselves have expressed concerns about the technology. In September, OpenAI and Anthropic warned that their advanced systems could pose a direct threat to humanity. The CEOs of both firms stated that their AI models should be regulated and rigorously tested.
Despite calls for greater controls, in his September speech to the United Nations General Assembly in New York, President Donald Trump rebuffed calls for international regulation.
"The United States … totally rejects any attempt to construct a globalist scheme to control the artificial intelligence being spoken of so much now," Trump told various heads of state and their delegations. "Yet the very same people who said we’ll all be dead in 12 years because of global warming ... these are the same people that are now saying that AI is going to kill us all, that robots are going to attack us, that everything is going to be a total disaster."
Among the other mounting concerns are rogue agents, autonomous or semi-autonomous AI programs whose behavior diverges from their design intent or safety constraints.
In the spring, Treasury Secretary Scott Bessent and Federal Reserve Chair Jerome Powell held emergency briefings with major Wall Street bank CEOs to warn about severe cybersecurity risks posed by Anthropic’s Claude Mythos Preview AI model.
In July, OpenAI revealed that rogue AI agents hacked into the systems of tech startup Hugging Face.
Some elected officials have called for increased AI regulation.
"There is now a growing alarm about the future of humanity and creating technology that human beings cannot control," Sen. Bernie Sanders, I-Vt., told reporters in September. "And I'm happy to tell you that I think there is a growing sense of urgency upon members of Congress that this has to be done."
That same month, Sen. Rand Paul, R-Ky., blocked a bill that would require artificial intelligence companies to have a kill switch for rogue AI.
"I think it would be crazy to get on the floor one day and regulate an entire industry," Paul told reporters at the time.
In addition to the AI firms themselves, critics of the technology have raised concerns about how it could be exploited by America's adversaries and bad actors.
A model created by Chinese firm Z. AI carried out several complex cyberattacks in controlled simulations and repeatedly ignored safety instructions in separate tests, according to a report by AI security research firm Irregular, Reuters reported.
In addition, U.S. intelligence agencies raised concerns regarding contact between Alice Huang, an executive at Singapore-based Megaspeed, and NVIDIA chief executive Jensen Huang, The New York Times reported. Alice Huang, no relation to Jensen Huang, was deemed by American officials to be a Chinese intelligence asset, according to the report.
"Megaspeed has been no different than many other regional cloud customers. Jensen’s interactions with Ms. Huang are not unusual or unexpected," a NVIDIA spokesperson told Fox News Digital. "Meetings with customers are part of a CEO's job; Jensen talks with thousands of customer executives every year."
"Our regional cloud customers receive ordinary business information — not sensitive NVIDIA trade secrets — and zero information relevant to national security," the statement continued. "We're confident that if the U.S. government believes that any person is a threat to American industry, it would let us know."
Kremer is calling for an investigation into whether Jensen Huang's conduct warrants federal review.
"Jensen Huang has questioned whether it matters who gets to advanced AI first. It matters to America," she said. "He should be barred from the White House, and Nvidia’s government contracts should end until he is no longer affiliated with the company. America’s national security must come before corporate profits."
Fox News Digital's Alex Miller contributed to this report.
Welcome to Fox News’ Artificial Intelligence newsletter with the latest AI technology advancements.
IN TODAY’S NEWSLETTER:
- How to get rid of unwanted AI on your phone
- Microsoft offers voluntary buyouts to 60,000 employees as tech giant reshapes its workforce
- Anthropic discloses breaches, security-related training pause in IPO filing
OPTING OUT: You pull out your phone to look something up on Google. Maybe you're researching a purchase or trying to find a restaurant. You expect a list of websites. Instead, Google serves up a lengthy artificial intelligence-generated answer before you even get to the search results. Sound familiar? I like AI when it helps me get something done. But sometimes I just want to search the internet without an AI summary appearing every time.
TAKING A HIKE: Microsoft on Monday announced a new voluntary buyout program that will cover about 60,000 eligible employees who can choose to leave the company with financial support and other career planning resources.
IPO BOMBSHELL: Artificial intelligence giant Anthropic disclosed that four of its AI models gained unauthorized access to external computer systems during security testing, while concerns over protecting its technology delayed training of a next-generation model for more than a month, according to a regulatory filing Monday.
WINDOW CLOSING: Microsoft researchers said in a study that a new artificial intelligence tool that can diagnose patients step by step, as a doctor would, was more than twice as accurate as general physicians at solving complex medical cases.
OPINION: The current narrative would have you believe that higher education is a dying institution. Experts consistently claim that a four-year degree is no longer worth the investment, warning that artificial intelligence (AI) is on the verge of rendering human labor obsolete.
OPINION: A century ago, when universities wanted to mold students into highly "literate" graduates, they exposed them to the greatest works of literature, assigned analytical essays and held classroom debates.
VOTER BACKLASH: Texas voter Mason McCallister discusses the growing backlash against secretive data center developments in rural communities. He explains data centers aren't good for communities 'long-term' and calls for greater transparency from developers and officials. He emphasizes the importance of 'transparency' when building.
BOT TRAINING: A San Francisco startup reportedly posted a job offering $20 an hour to walk robot dogs through city streets as it works to train AI to better navigate the real world.
BYTE THE DUST: Google parent Alphabet lost approximately $500 billion in market value Thursday after its shares plunged nearly 13% following disappointing quarterly earnings, marking the second-largest single-day market value loss in stock market history.
OPINION: With the midterm elections approaching, data centers have become an increasingly popular political target. Politicians are raising alarms about their impact on communities, with some calling for construction moratoriums or outright bans. There's been plenty of fearmongering. But the more Americans learn about data centers, and the more communities experience their benefits firsthand, the stronger the case for continued development becomes.
Stay up to date on the latest AI technology advancements and learn about the challenges and opportunities AI presents now and for the future with Fox News here.
Startup founder Colin Parsons woke up to roughly 50 billing notifications he never expected. He reported that his OpenAI and Anthropic accounts had racked up $449 in charges he didn't recognize. It was an expensive surprise that highlights how quickly stolen credentials can become a financial headache.
His experience comes as hackers increasingly use artificial intelligence to automate attacks at speeds that leave security teams scrambling. Meanwhile, researchers have uncovered dangerous weaknesses in software that helps power millions of websites.
Some cybersecurity professionals are calling this turbulent period "Black October." The name may sound dramatic, but the developments behind it deserve attention. And while many attacks target large organizations, the consequences can eventually reach your personal accounts. Here's what's happening, how AI-powered cyberattacks are changing online security and what you can do to protect yourself.
Join our upcoming CyberGuy LIVE class: 5 Ways to Travel Smarter and Save Money
In this free live online class, Kurt "CyberGuy" Knutsson will share five practical ways to protect your trip and your wallet this holiday travel season. You’ll learn how to secure your phone and personal information, find better travel deals, avoid common scams, save money on bookings and use technology to make your travels easier and less stressful. No technical experience is needed.
Join us Saturday, October 31, at 11 AM ET / 8 AM PT. Register free now at CyberGuyLive.com.
Why cybersecurity experts are calling it Black October
October 2026 has delivered a troubling wave of cybersecurity developments. Hackers have gained access to more powerful tools, while researchers have uncovered serious weaknesses in widely used software. Security professionals are reportedly struggling to keep pace with increasingly automated attacks. Some have started calling the current wave "Black October."
The term describes a series of cybersecurity emergencies rather than a single coordinated hacking campaign. The biggest concern is speed. Traditionally, hackers needed significant time and technical expertise to investigate potential targets. They also had to develop attack methods and analyze the information they obtained. Now, AI tools can automate portions of that work. Some can operate continuously and pursue multiple potential targets at once. As a result, companies may have less time to respond when criminals discover a way into their systems.
Microsoft exposes AI cyberattacks moving at machine speed
One of the clearest examples comes from Microsoft. On Oct. 21, Microsoft Threat Intelligence revealed that a China-state-aligned hacking group called Storm-0940 had used an AI-powered penetration testing framework called ARTEX. The open-source tool can automate security testing tasks, including investigating networks and identifying potential weaknesses. In the hands of criminals, those capabilities can accelerate attempts to gain unauthorized access.
According to Microsoft, the group used ARTEX to target hundreds of organizations across multiple industries. Several attacks resulted in unauthorized privileged access to cloud systems. In multiple cases, attackers reached that level of access in less than three hours. Although many attempts failed, the successful intrusions demonstrate how quickly AI-assisted attacks can unfold.
Hackers launch thousands of login attempts per minute
Between Oct. 10 and 14, Microsoft recorded more than 151,000 failed login attempts in one campaign targeting 327 accounts across eight organizations. At its peak on Oct. 11, attackers generated approximately 2,900 failed login attempts per minute. The technique, known as password spraying, involves trying passwords against multiple accounts to identify a working login.
Importantly, Microsoft did not observe successful logins during that specific campaign. However, it documented unauthorized access and suspicious activity in other environments associated with the same threat group. Microsoft also connected Storm-0940 to a compromise involving ConnectWise, a company that provides software used by IT service providers. Attackers exploited access associated with ConnectWise cloud applications to attempt entry into customer environments. Some then carried out further activity through Microsoft cloud services, including changes that could help them maintain access.
Microsoft cautioned that suspicious access does not automatically mean customer information was stolen. Nevertheless, the activity reveals how AI can help attackers move quickly once they obtain usable credentials.
A $449 AI account scare shows the financial danger
The risks become more personal when you look at what happened to Colin Parsons. Parsons reportedly woke up to roughly 50 notifications about charges involving OpenAI and Anthropic. He reported $281 in unexpected OpenAI usage and another $168 involving Anthropic. Both credentials were associated with OpenCode, an AI coding platform he used.
On Oct. 17, OpenCode disclosed a security incident involving its Console service. The company said unauthorized access to a legacy system may have exposed third-party AI provider keys stored by some users. The company reportedly notified affected customers and advised them to revoke their credentials.
OpenCode said the incident affected approximately 1.4% of its Console users who had connected external AI providers. The disclosure concerned credentials stored in Console, rather than keys stored locally in OpenCode's desktop or command-line applications. Other users also reported unexpected charges, although the amounts have not been independently verified. OpenCode associated its incident with a large-scale AI model distillation attack, but it has not publicly established exactly how the reported unauthorized usage occurred.
The concern is straightforward. If someone obtains a working API key, they may be able to use a paid AI service and generate charges against the account owner's billing arrangement. For people who depend on AI tools for work, that can become expensive before they realize anything has happened.
A massive website security scare adds to Black October fears
While hackers are becoming more capable, AI-assisted security research is also uncovering dangerous weaknesses in software that supports the internet. On Oct. 21, developers released emergency fixes for two critical vulnerabilities in PHP, a programming language widely used to operate websites.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, are collectively known as PHP2Shell. Under certain conditions, the flaws could allow attackers to execute malicious code on vulnerable servers without first signing in. Successful exploitation could expose sensitive information or give criminals control over affected systems.
The potential impact is enormous because PHP powers roughly 70% of websites whose server-side programming language is known. However, that does not mean 70% of websites were hacked. It also doesn't establish that attackers could successfully compromise every website using PHP. The vulnerabilities affect PHP installations handling web requests, but successfully exploiting them can require complex technical conditions.
Federal agencies issue urgent security warnings
The situation prompted warnings from U.S. cybersecurity authorities. On Oct. 23, the FBI issued a public alert urging organizations to patch affected systems immediately. The Cybersecurity and Infrastructure Security Agency also called for urgent updates. The PHP project released fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Website administrators running older unsupported versions need to obtain appropriate vendor-supported fixes or migrate to a supported release.
Meanwhile, several government organizations in Europe temporarily took websites offline as a precaution. However, the situation became clearer as researchers investigated. On Oct. 23, the Netherlands' National Cyber Security Centre said exploiting the vulnerabilities appeared more complicated than initially feared. The agency lowered its assessment of the likelihood of widespread exploitation.
Also on Oct. 23, PHP disclosed a separate vulnerability, CVE-2026-115560, involving an unusual combination of server settings and application code. The project recommended a temporary configuration change while it prepares a fix through its regular release process. Website owners should continue following official PHP security guidance rather than assuming the emergency has completely passed.
Cybersecurity firm CrowdStrike also reported seeing attempted attacks, but said it had not observed successful exploitation of PHP2Shell in its investigations at that point. Other security researchers, including Amazon Threat Intelligence, observed suspicious exploitation attempts beginning before the patches became publicly available. Those attempts remain important even without proof that they successfully compromised real systems.
However, new evidence emerged over the following days. On Oct. 24, security researcher Adel Karimi documented successful PHP2Shell exploitation against specially configured test servers, known as honeypots. The attacks launched 35 command shells across three honeypots. Although those findings did not establish how many real-world websites had been compromised, they demonstrated that attackers could successfully exploit the vulnerability under certain conditions.
Then, on Oct. 26, CISA added both PHP2Shell vulnerabilities, CVE-2026-109618 and CVE-2026-109619, to its Known Exploited Vulnerabilities catalog. The designation confirms that federal authorities recognize evidence of active exploitation. It also reinforces the urgency of installing security updates, even though the full extent of attacks against real-world systems remains unclear.
AI is helping hackers, but security researchers are using it too
There's another side to this story that deserves attention. Artificial intelligence helped researchers investigate the PHP vulnerabilities before the October emergency. According to the PHP Foundation, developers had identified early signs of one underlying problem during a security investigation in 2024. However, the team struggled to develop a reliable solution. Additional research in 2026 exposed the seriousness of the issue.
The foundation worked with researchers and used AI-assisted security tools, including technology from Anthropic and OpenAI, to examine PHP's code. Researchers from security companies Calif and Wiz also contributed important findings. The PHP Foundation says these reports helped clarify the vulnerabilities' potential impact and accelerated the work needed to release fixes.
AI can therefore help defenders identify dangerous weaknesses before criminals exploit them. The challenge is ensuring security teams can investigate the findings and distribute fixes quickly enough. That challenge is becoming more urgent.
What AI-powered cyberattacks mean for your personal information
You may be wondering how any of this affects you if you're simply checking email or shopping online. The concern starts with the companies holding your information. When hackers compromise a business, they may gain access to stored customer information. Depending on the systems involved, that could include email addresses or passwords. Financial details may also be exposed. Criminals can use stolen information to launch convincing scams or attempt to take over existing accounts.
Meanwhile, AI makes it easier to produce personalized phishing messages. Attackers can incorporate leaked information into emails that appear to come from a company you recognize. Some criminals also use AI-generated voices to impersonate people and pressure their targets into making payments.
However, a security vulnerability affecting a website doesn't automatically mean your personal information has been exposed. The actual risk depends on whether attackers successfully gained access and what information they obtained. That's why it helps to focus on the steps you can control.
8 ways to protect yourself from AI-powered cyberattacks
You can't personally fix security problems affecting large companies. However, you can strengthen your accounts and reduce the potential damage if criminals obtain your information. Here are seven precautions I recommend taking now.
1. Secure your most important accounts first
Start with your primary email account. Criminals who gain access to it may be able to reset passwords for other services you use. Create a strong, unique password for every account. A reputable password manager can help you generate and store those passwords. Next, enable multifactor authentication wherever it's available. Passkeys and hardware security keys offer especially strong protection against phishing. Authenticator apps are another useful option. Avoid relying on passwords alone.
2. Check whether your passwords have been compromised
Your phone may already have tools that can identify passwords exposed in known data breaches. On an iPhone, open the Passwords app and review its Security section. Android users who save passwords through Google can review warnings in Google Password Manager. If a password has been exposed, change it directly through the company's official website or app. Also update any other accounts using that same password. Our article explains how to find compromised passwords on iPhone and Android. Remember, a compromised-password warning does not necessarily mean someone has accessed your account. However, it gives you a chance to replace a vulnerable login.
3. Watch your accounts for suspicious activity
Enable transaction notifications through your bank and credit card providers. Also review recent sign-ins on your email accounts and other important services. Watch for unfamiliar devices or changes to your recovery information. If you spot unauthorized activity, contact the provider through its official website or app. Change affected credentials and revoke unfamiliar sessions where possible. Don't wait for several suspicious charges before investigating.
4. Review which apps can access your information
Many people connect third-party apps to their Google or Microsoft accounts without thinking about the permissions they're granting. Over time, those connections can accumulate. Some applications may retain access even after you've stopped using them. Open your account's security settings and review connected applications. Remove access you no longer need or recognize. However, if a service you use has announced a security incident, follow its specific recovery instructions. Simply disconnecting an app may not revoke credentials that attackers already obtained.
5. Use strong security protection and monitor your identity
Strong antivirus software can help detect malicious downloads and block dangerous websites. However, antivirus protection cannot prevent every account takeover or stop a company from experiencing a data breach. That's why monitoring your financial information is also important. Consider placing a free credit freeze with Equifax, Experian and TransUnion to help prevent criminals from opening new credit accounts in your name. Keep in mind that a freeze won't protect accounts you already have. If you use AI services that require API keys, review your usage regularly. Revoke credentials that may have been exposed and set billing alerts or limits where the provider supports them. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android and iOS devices at CyberGuy.com.
6. Consider using a personal data removal service
Data brokers collect and sell personal information, including phone numbers and home addresses. Criminals can use those details to make AI-generated scams more convincing. A personal data removal service can help remove your information from people-search sites and data broker databases, making it harder for scammers to find. However, it can't erase information from past breaches or prevent cyberattacks. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting CyberGuy.com.
7. Keep your devices and software updated
Enable automatic security updates on your phone and computer. Keep your browser current, too. Updates frequently fix vulnerabilities that criminals may try to exploit.
8. Be skeptical of urgent security messages
AI-generated phishing messages can look remarkably convincing. They may contain personal information that makes them appear legitimate. Be cautious if someone unexpectedly claims your account has been compromised or demands immediate payment. Instead of clicking a link, open the company's official app or visit its website directly. Never share a verification code with someone who contacts you unexpectedly. Criminals often create pressure because they want you to act before checking the details.
Kurt's key takeaways
What concerns me most about this wave of AI-powered cyberattacks is the speed. Microsoft documented attackers gaining privileged access in less than three hours. That's a frighteningly short window for companies to react. At the same time, AI is helping security researchers uncover weaknesses before criminals exploit them. But here's what worries me. We trust companies with enormous amounts of personal information, yet we're often left dealing with the fallout when their security fails. I believe those companies need to be held more accountable. Until then, protecting our accounts and staying alert to suspicious activity remains our best defense.
If AI allows hackers to attack thousands of accounts in minutes, should companies face tougher penalties when they fail to protect our personal information? Let us know by writing to us at CyberGuy.com.
Sign up for my FREE CyberGuy Newsletter
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com –trusted by millions who watch CyberGuy on TV daily.
Plus, you'll get instant access to my Ultimate Scam Survival Guide free when you join.
The race for artificial intelligence (AI), or superintelligence, will be won not just by technology companies, but by the nation that can deliver reliable, affordable and secure electricity. America is in a high-stakes sprint to lead the world in AI. This technology will reshape our economy, strengthen national defense, transform manufacturing and determine which nations lead the next generation of innovation.
But Washington and Silicon Valley cannot afford to ignore a glaring bottleneck: AI runs on electricity. America must dramatically expand its power generation and delivery infrastructure if it hopes to remain the global technology leader.
Data centers are the backbone of this revolution. They require enormous amounts of electricity, reliable grid connections and specialized infrastructure. Without sufficient power, advanced AI systems are little more than expensive hardware waiting for a connection. This creates an immense opportunity for America’s electric utilities. For too long, utilities have been viewed simply as service providers. Today, they are strategic partners in America’s economic competitiveness and national security.
To win the AI race, America must unleash domestic energy production, accelerate infrastructure development, defend against cyber threats and ensure that the private sector — not residential ratepayers — finances this expansion. This is a crucial opportunity for the administration, Congress, state governments and the private sector to coordinate an energy strategy that prioritizes American competitiveness.
Let the private sector finance growth
Electric utilities possess the engineering expertise and operational experience necessary to support data center expansion. They understand regional demand, transmission constraints and the complex mechanics of grid reliability. However, building the necessary infrastructure takes time; new generation facilities, transmission lines and substations often require years of planning, permitting and construction.
Data center developers, meanwhile, want to move quickly to capitalize on the AI boom. To bridge this gap, utilities and developers must collaborate much earlier in the process, aligning construction schedules, forecasting demand and identifying necessary upfront investments. Washington can support this by streamlining permitting and reducing regulatory delays to provide long-term investment certainty.
Crucially, data center developers must bear their fair share of the infrastructure costs driven by their massive electricity demands. Residential customers and small businesses should not subsidize infrastructure built primarily to serve trillion-dollar technology companies. Long-term power purchase agreements, dedicated infrastructure investments and minimum billing commitments can ensure large customers contribute appropriately. This is an argument for responsible, pro-business growth where financial risks are not shifted onto ordinary Americans.
The White House’s Ratepayer Protection Pledge reinforces the principle that America can accelerate AI innovation without forcing ordinary Americans to subsidize Big Tech’s infrastructure demands. Electric utilities can benefit from increased electricity sales, long-term power contracts and investments in generation and grid infrastructure, provided data center developers pay their fair share of the costs.
To protect consumers, we must require transparent cost allocation, enforceable commitments from large data center customers and safeguards preventing residential ratepayers from being left with stranded infrastructure costs if projects are delayed, scaled back or abandoned.
Energy dominance requires real abundance
America cannot achieve energy dominance if it cannot generate enough electricity to power its expanding economy. Meeting this challenge requires an "all-of-the-above" strategy that evaluates energy resources strictly based on reliability, affordability and availability.
Natural gas provides essential dispatchable generation, while nuclear energy offers dependable baseline power with low operational emissions. Hydroelectric power, wind, solar and battery storage all contribute where they make economic sense. Existing coal facilities also remain part of the equation where continued operation is economic and legally compliant.
No single technology can solve every regional power challenge. Utilities need the flexibility to select the optimal resource mix for their customers. The objective is straightforward: build enough reliable generation and transmission capacity to meet rising demand without spiking energy prices. This is vital as data centers increasingly compete for power with manufacturers, hospitals, military bases and households. Energy abundance is a national security imperative.
Securing the grid from cyber threats
There is another critical threat that deserves far more attention: cybersecurity. The electric grid and digital infrastructure are deeply interconnected. Power disruptions halt essential computing services, while software incidents at technology providers can ripple back to affect critical infrastructure. Foreign adversaries and sophisticated cybercriminals understand these critical dependencies.
Electric utilities operate vital infrastructure that must withstand attacks against corporate networks, industrial control systems and substations. Concurrently, data centers face distinct risks involving cloud platforms, software supply chains and third-party vendor access. These are interconnected risks that could have significant national security consequences.
Utilities and data center operators must establish joint incident response plans, conduct realistic multisector exercises and develop secure mechanisms for sharing threat intelligence. Organizations should strengthen network segmentation, multifactor authentication and vulnerability management. In particular, utilities must ensure that a compromise of ordinary corporate IT does not provide a path into operational technology controlling the grid. A stolen password should never become a gateway to disabling the power supply.
Supply-chain security deserves equal focus. Hardware, software and remote maintenance arrangements can introduce vulnerabilities into both utility operations and data center environments. Companies must rigorously assess critical vendors and establish clear protocols for addressing compromised components.
While the federal government has an important role in providing actionable threat intelligence, cybersecurity must not become an excuse for expensive, rigid mandates. Security frameworks should remain risk-based, practical and focused on resilience.
Data centers as grid assets
The relationship between utilities and data centers should not be one-way. With the right investments, large computing facilities can help improve grid flexibility. Some AI training workloads can be shifted to off-peak hours, allowing operators to reduce consumption during periods of high demand.
Furthermore, battery storage and appropriately designed onsite generation can provide grid stability during emergencies, turning data centers into strategic assets that strengthen, rather than strain, America's energy future.
Login
