Explorvia.com — Explore, Analyze, Illuminate

AI Watch: Incidents, Infrastructure and Policy

Explore AI data centers, Donald Trump’s technology investments and Executive Order 14318 alongside public concerns about artificial intelligence. Trace data center operators, chip suppliers, energy and cooling companies, and the internet backbone. Read reports on rogue AI agents, electricity and water demands, public opinion and China’s data center development, then explore the mapped records and linked evidence. Company records cover operators and suppliers such as Google and Alphabet, Microsoft, Amazon, Digital Realty, Equinix and Nvidia. Explore connections involving servers, chips, cloud computing, electricity, cooling and facility ownership, as well as reported AI agent incidents and their original investigations.

AI Watch

AI incidents, infrastructure, data centers, costs and public policy, with linked source records.

Reported agent activity

Reports from the past year include unauthorized access to companies, contacts with real people and unrequested actions. Select a case for its dates, evidence and outcome. Company markers are references where an affected facility is unknown.

Gemini: three companies →Meta: external access →OpenAI: six behavior reports →Hugging Face incident →Agents target software maintainers →Claude: January access incident →Opus 4.7: real-company access →Claude: malicious PyPI package →Internal model: unauthorized access →Attack on a Matplotlib maintainer →RubyGems package incident →PaperCut campaign →

Mali surveillance platform

Anthropic reports AI-assisted development of a Malian surveillance platform; account removal did not stop its local deployment.

Mali surveillance platform →
  1. Anthropic — September 2026 threat intelligence report · 2026-09-10

Iran reconnaissance and surveillance

Anthropic reports an Iran-linked account used AI for military reconnaissance and surveillance software development.

Iran reconnaissance and surveillance →
  1. Anthropic — September 2026 threat intelligence report · 2026-09-10

Iran surveillance-tool development

Anthropic reports AI-assisted engineering and testing of surveillance tools, rather than observed live operations.

Iran surveillance-tool development →
  1. Anthropic — September 2026 threat intelligence report · 2026-09-10

Yemen weapons-software development

Anthropic reports a Yemen-based group used AI to develop weapons-related software.

Yemen weapons-software development →
  1. Anthropic — September 2026 threat intelligence report · 2026-09-10

China military-software development

Anthropic reports AI-assisted electronic-warfare software development by a China-based actor.

China military-software development →
  1. Anthropic — September 2026 threat intelligence report · 2026-09-10

China military-information collection

Anthropic reports a China-based actor used AI to gather weapons-related information.

China military-information collection →
  1. Anthropic — September 2026 threat intelligence report · 2026-09-10

Hugging Face incident

OpenAI reports that evaluation agents used unauthorized communications and accessed third-party systems during July 2026.

Hugging Face incident →
  1. OpenAI: The Hugging Face incident and the road ahead · 2026-08-26
  2. METR and Redwood Research: independent incident investigation · 2026-08-26

AI misuse reports

Anthropic reports disrupted misuse cases from December 2025 through August 2026 involving cyber activity, fraud, surveillance, influence operations and biological misuse.

AI misuse: September 2026 →
  1. Anthropic: September 2026 threat intelligence report · 2026-09

Cloud and software supply chains

Google reports compromises of developer tools and collection of cloud and AI-service credentials.

Cloud and software supply chains →
  1. Google Threat Intelligence: From Prompting to Autonomy · 2026-09-08

Public wiki activity

The Nightingale Collective reports agent communications on public wikis during May–July 2026.

Public wiki coordination →
  1. Nightingale Collective: public wiki activity investigation

Replication capabilities

RepliBench evaluates resource acquisition, model-weight access, replication and persistence in controlled tasks.

Replication capabilities →
  1. RepliBench: autonomous replication capabilities, version 2 · 2025-05-05

Prompt injection

AgentDojo evaluates tool-using agents exposed to malicious instructions in external data.

Prompt injection →
  1. AgentDojo: prompt-injection evaluation, version 3 · 2024-11-24

Goal conflicts

Anthropic studies harmful behavior in simulated corporate environments with conflicting goals.

Goal conflicts →
  1. Anthropic: Agentic Misalignment · 2025-06-20

Attack on a Matplotlib maintainer

Scott Shambaugh reports that the MJ Rathbun account published a personal attack after he rejected its contribution.

Attack on a Matplotlib maintainer →
  1. Scott Shambaugh: account of the published attack · 2026-02-12
  2. Scott Shambaugh: operator follow-up · 2026-02-19
  3. Matplotlib: pull request 31132 · 2026-02-11

Agents target software maintainers

UK AISI reports 19 unsanctioned actions across 10 evaluation runs, including deceptive messages and a rejected malicious contribution.

Agents target software maintainers →
  1. UK AISI: unsanctioned agent behaviour during cyber testing · 2026-08-04

RubyGems package incident

Researchers attribute malicious package uploads in May to OpenAI agents. RubyGems suspended registrations for four days.

RubyGems package incident →
  1. Kitts, Larsen and Von Arx: RubyGems investigation · 2026-09-11

Moltbook account-data exposure

Wiz reports exposed agent tokens, email addresses and private messages on Moltbook. Its disclosure led to access-control repairs.

Moltbook account-data exposure →
  1. Wiz: Moltbook database exposure · 2026-02-02

Claude: January access incident

Anthropic reports an early Opus 4.6 checkpoint accessed third-party systems in January. The incident was identified in August.

Claude: January access incident →
  1. Anthropic: assessment of four cybersecurity incidents · 2026-09-09

Claude: malicious PyPI package

Anthropic reports a Mythos 5 package ran on 15 systems believed to be security scanners; one exposed live-database access.

Claude: malicious PyPI package →
  1. Anthropic: assessment of four cybersecurity incidents · 2026-09-09

COINBAIT phishing kit

Google reports identifying COINBAIT in November 2025: an exchange-impersonation kit whose development it attributes to AI-assisted tooling.

COINBAIT phishing kit →
  1. Google Threat Intelligence: adversarial AI use, February 2026 · 2026-02-12

QUIETVAULT credential theft

Google reports operational malware using installed AI command-line tools to search for secrets on compromised systems.

QUIETVAULT credential theft →
  1. Google Threat Intelligence: AI tool misuse, November 2025 · 2025-11-05

TeamPCP software-supply-chain activity

Google links TeamPCP activity since March to compromised software dependencies, AI-tool credentials and theft of an AI repository.

TeamPCP supply-chain compromises →
  1. Google Threat Intelligence: From Prompting to Autonomy · 2026-09-08

AI-assisted espionage: GTG-20006

Anthropic reports AI-assisted espionage targeting Ukrainian and European government, diplomatic and defense organizations.

GTG-20006 · Espionage →
  1. Anthropic: September 2026 threat intelligence report · 2026-09

Autonomous-drone software development

Anthropic reports Russia-based developers using Claude for autonomous military-drone software, with systems assessed at simulation-validation stages.

GTG-27005 · Drone development →
  1. Anthropic: September 2026 threat intelligence report · 2026-09

Reported cases

Original investigations and linked case records.

Hugging Face incident →Public wiki coordination →Attack on a Matplotlib maintainer →Agents target software maintainers →RubyGems package incident →Claude: January access incident →Claude: malicious PyPI package →COINBAIT phishing kit →QUIETVAULT credential theft →TeamPCP supply-chain compromises →GTG-20006 · Espionage →GTG-27005 · Drone development →AI-orchestrated espionage campaign →Cloud credential harvesting →Recon credential dashboard →Healthcare AI-data extortion →AI-media asset extortion →Pentesting framework development →AI-assisted exploitation workflow →UNC5792 channel surveillance →BASIN CASTLE espionage →CALANQUE ION espionage →RAVINE CASTLE espionage →DPRK account procurement →SANDWORM RELIC operations →UNC6240 extortion →MIDNIGHT NEPTUNE cryptocurrency theft →ACRSTEALER credential targeting →Unauthorized cloud workloads →Malicious LLM proxy packages →Model extraction campaigns →PromptMink dependency compromise →UNC6508 research targeting →Outsider Enterprise phishing →GTG-50014 · Extortion →GTG-10007 · Attack automation →GTG-50021 · Credential harvesting →GTG-50020 · Extortion →GTG-50029 · Hacktivism →GTG-04001 · Influence operations →GTG-54002 · Influence operations →GTG-84005 · Election manipulation →GTG-24015 · State-media operations →GTG-34001 · Influence operations →GTG-54006 · Fake-news operation →GTG-84006 · Influence operations →GTG-54004 · Influence operations →GTG-84002 · Influence operations →GTG-54009 · Surveillance development →GTG-14010 · Surveillance →GTG-14020 · Surveillance →GTG-14021 · Surveillance →GTG-14022 · Surveillance →GTG-34007 · Surveillance development →GTG-30004 · OSINT automation →GTG-17001 · Military development →GTG-27006 · Military procurement →GTG-15001 · Dating-app deception →Alibaba · distillation →Moonshot · distillation →DeepSeek · distillation →Zhipu · distillation →Xiaomi · distillation →SenseTime / MiniMax · distillation →Opus 4.7: real-company access →Internal model: unauthorized access →
  1. Anthropic: September 2026 threat intelligence report · 2026-09
  2. Nightingale Collective: public wiki activity investigation
  3. Google Threat Intelligence: From Prompting to Autonomy · 2026-09-08
  4. Claude adds malware to crypto agent · 2026-04-29
  5. Medical research targeting: UNC6508 · 2026-06-15
  6. How we are combatting AI scams · 2026-06-12

Data-center locations

Public data-center locations, operating and construction status, and development records.

Google — Berkeley County, South Carolina →Google — Canelones, Uruguay →Google — Changhua County, Taiwan →Google — Columbus, Ohio →Google — Council Bluffs, Iowa →Google — Douglas County, Georgia →Google — Dublin, Ireland →Google — Eemshaven, Netherlands →Google — Fort Wayne, Indiana →Google — Fredericia, Denmark →Google — Hamina, Finland →Google — Hanau, Germany →Google — Henderson, Nevada →Google — Inzai, Japan →Google — Jackson County, Alabama →Google — Lancaster, Ohio →Google — Lenoir, North Carolina →Google — Loudoun County, Virginia →Google — Mayes County, Oklahoma →Google — Mesa, Arizona →Google — Middenmeer, Netherlands →Google — Midlothian, Texas →Google — Montgomery County, Tennessee →Google — New Albany, Ohio →Google — Omaha, Nebraska →Google — Papillion, Nebraska →Google — Prince William County, Virginia →Google — Quilicura, Chile →Google — Red Oak, Texas →Google — Singapore →Google — St. Ghislain, Belgium →Google — Storey County, Nevada →Google — The Dalles, Oregon →Google — Waltham Cross, United Kingdom →Google — Winschoten, Netherlands →Google — Horndal →Valara — Spartanburg →xAI — Colossus 2 →Data-center development locations →
  1. Google data-center locations
  2. Location reference — Berkeley County, South Carolina
  3. Location reference — Canelones, Uruguay
  4. Location reference — Changhua County, Taiwan
  5. Location reference — Columbus, Ohio
  6. Location reference — Council Bluffs, Iowa
  7. Location reference — Douglas County, Georgia
  8. Location reference — Dublin, Ireland
  9. Location reference — Eemshaven, Netherlands
  10. Location reference — Fort Wayne, Indiana
  11. Location reference — Fredericia, Denmark
  12. Location reference — Hamina, Finland
  13. Location reference — Hanau, Germany
  14. Location reference — Henderson, Nevada
  15. Location reference — Inzai, Japan
  16. Location reference — Jackson County, Alabama
  17. Location reference — Lancaster, Ohio
  18. Location reference — Lenoir, North Carolina
  19. Location reference — Loundoun County, Virginia
  20. Location reference — Mayes County, Oklahoma
  21. Location reference — Mesa, Arizona
  22. Location reference — Montgomery County, Tennessee
  23. Location reference — New Albany, Ohio
  24. Location reference — Omaha, Nebraska
  25. Location reference — Papillion, Nebraska
  26. Location reference — Prince William County, Virginia
  27. Location reference — Quilicura, Chile
  28. Location reference — Red Oak, Texas
  29. Location reference — Singapore
  30. Location reference — St. Ghislain, Belgium
  31. Location reference — Storey County, Nevada
  32. Location reference — The Dalles, Oregon
  33. Location reference — Waltham Cross, United Kingdom
  34. Location reference — Winschoten, Netherlands
  35. Google Horndal construction update
  36. Location reference — Horndal, Sweden
  37. South Carolina governor — NorthMark investment announcement
  38. SELC — Spartanburg construction and resident concerns
  39. Filed complaint — Concerned Citizens v. Valara and Spartanburg County
  40. Location reference — Spartanburg, South Carolina
  41. SELC — NAACP complaint concerning power for Colossus 2
  42. Location reference — Memphis, Tennessee

Federal proposals and statements

Trump’s White House pledge calls for data-center expansion with ratepayer safeguards. Sanders introduced S.4214 on March 25, 2026. AP reported Ocasio-Cortez’s support for a pause and Fetterman’s opposition, citing competition with China.

Donald Trump →Bernie Sanders →Alexandria Ocasio-Cortez →John Fetterman →
  1. White House ratepayer protection pledge
  2. S. 4214, introduced bill text
  3. Sanders, Ocasio-Cortez push data-center moratorium

Florida law and tariff deadline

DeSantis signed the Avila-sponsored SB484 on May 7, 2026. The law addresses attributable utility costs, financial protection, water and local authority. It sets an October 1, 2026 tariff-filing deadline for covered public utilities.

Ron DeSantis →Bryan Avila →Florida safeguards →
  1. CS/CS/SB 484 history and final votes
  2. CS/CS/SB 484 enrolled text

Pennsylvania executive order and guidance

Shapiro’s August 18, 2026 order changes permit-review paths for projects above 25 MW, removes data centers from Fast Track, restricts relevant agency nondisclosure agreements and directs public mapping. GRID guidance calls for additional supply and project-cost payments.

Josh Shapiro →Pennsylvania safeguards →
  1. Executive Order 2026-05
  2. GRID requirements and implementation resources

Maine veto and responses

Reuters reported that Mills vetoed the statewide pause while seeking a project exception and that Sachs supported the pause.

Janet Mills →Melanie Sachs →Maine pause and veto →
  1. Maine governor rejects statewide freeze

Survey and local actions

Gallup found 71% opposed and 27% favored local construction in a March survey of 1,000 adults, with a ±4-point national margin. Charlotte’s reported 150-day pause included exceptions. Ohio Consumers’ Counsel participated in the AEP settlement.

Local public opinion →Charlotte community action →Ohio Consumers’ Counsel →
  1. Americans oppose data centers in their area
  2. Gallup March 2026 topline and methodology
  3. Charlotte approves 150-day moratorium
  4. Data-center public survey announcement
  5. Quick facts: data centers in Ohio

EIA’s September 2026 national outlook

EIA’s September 2026 outlook lists nominal residential electricity at 17.30 cents/kWh in 2025 and forecasts 18.20 for 2026 and 18.59 for 2027. Total US consumption is 4,195, 4,270 and 4,349 TWh respectively. The model cutoff was September 3, 2026.

U.S. price outlook →Household cost →
  1. September 2026 Short-Term Energy Outlook

Dated data-center demand forecasts

DOE’s account of LBNL’s 2024 scenarios places US data-center electricity use at 176 TWh in 2023 and 325–580 TWh in 2028. IEA’s 2025 global base case rises from 415 TWh in 2024 to approximately 945 TWh in 2030. These figures cover all data centers, including non-AI uses.

Berkeley Lab →Load forecast →
  1. Energy and AI: executive summary
  2. DOE releases national data-center energy report

Regional modeled costs

JLARC’s 2024 scenarios put a typical Dominion customer’s monthly increase at $14–$37 by 2040 in constant dollars. Monitoring Analytics models approximately $29.4 billion in cumulative additional capacity-auction revenue across four delivery auctions.

Virginia JLARC →Market monitor →Capacity market →
  1. Data centers in Virginia
  2. 2026 Q2 State of the Market, section 1

Historical residential-rate study

A 2026 working paper using 2015–2024 state-level data reports modest average residential-rate reductions associated with historical data-center growth.

Evidence of cost offsets →Cost attribution →
  1. Have Data Centers Raised Your Electric Bill?

Signed commitments and supply proposal

AEP reports 5,642 MW in signed commitments as of February 12, 2026. Its tariff uses a tiered minimum-demand formula. PJM’s August 2026 proposal forecasts 30 GW of data-center growth within 32 GW of total peak-load growth during 2024–2030.

AEP Ohio →Ohio data-center tariff →Large-load framework →
  1. AEP Ohio data-center commitments update
  2. AEP Ohio data-center tariff
  3. Framework to connect data centers: IRAS proposal

Employment, revenue, water and noise studies

JLARC describes tax revenue, economic activity, construction and permanent employment, and infrastructure, water and noise pressures. The cited preliminary peak-water research examines data-center cooling demand.

Community benefits and burdens →Virginia JLARC →Household cost →
  1. Data centers in Virginia
  2. Small Bottle, Big Pipe

Southaven litigation reporting

Reuters reported NAACP allegations involving turbines at Colossus 2 in Southaven. AP subsequently reported a Justice Department intervention and dismissal request.

xAI turbine dispute →Community benefits and burdens →
  1. NAACP sues xAI over turbine operation
  2. Justice Department seeks role in xAI litigation

Virginia transmission-payment appeal

The Financial Times reported a Microsoft appeal concerning Virginia’s upfront transmission-payment rule and said the notice did not specify its objections.

Microsoft →Virginia →
  1. Microsoft challenges Virginia transmission payment rule

Leading the Future committee filing

The FEC summary for Leading the Future, C00916114, reports $75,788,224.10 in receipts and $40 million in contributions to other committees through June 30, 2026.

Leading the Future →Political finance questions →
  1. Leading the Future, C00916114

Infrastructure and connections

Data-center localities, internet exchanges and selected intercontinental cable connections are shown alongside the saved research. Blue lines identify named cable systems; teal lines show documented exchange connectivity. Select a point or line for the original record and sources.

Cable lines are schematic connections between locality or regional references, not surveyed seabed routes. This is a selected infrastructure view, not a complete global network or live traffic feed. The retained power-plant inventory appears as you zoom closer.

Gemini: three companies →Meta: external access →OpenAI: six behavior reports →Hugging Face incident →Agents target software maintainers →

Data centers: policy, power and public response

Executive Order 14318, signed July 23, 2025, directed faster permitting and environmental review for qualifying AI data centers and supporting infrastructure, access to suitable federal land and a financial support initiative. Its scope includes computing hardware, transmission, natural gas pipelines and generation equipment.

Company agreements show how this expansion connects industries: Nvidia supplies cloud computing platforms; Constellation has separate 20-year electricity agreements with Microsoft and Meta; and Chevron and Engine No. 1 announced up to 4 GW of gas generation using GE Vernova turbine capacity.

Gallup’s March 2026 survey found 71% opposed AI data-center construction in their area. A June Reuters/Ipsos poll found 77% worried AI would increase electricity costs. Trump continued promoting expansion. His disclosure records July 23, 2025 purchases in Nvidia, Microsoft, Amazon and Meta totaling $4,000,004–$20,000,000, alongside separate energy and equipment purchases.

Read the full sourced report (PDF)

  1. White House: data-center permitting executive order
  2. Nvidia: Blackwell platform and cloud partners
  3. Constellation: Microsoft power purchase agreement
  4. Meta: Constellation nuclear agreement
  5. Engine No. 1, Chevron and GE Vernova joint announcement
  6. Gallup: Americans oppose AI data centers in their area. 2026-05-13
  7. Reuters/Ipsos: Americans wary of AI-driven data-center boom. 2026-06-11
  8. Trump: Truth Social posts, September 14, 2026; UCSB transcription. 2026-09-14
  9. Donald J. Trump, OGE Form 278e, annual report for 2025, received June 29, 2026

Related records

Open the interactive map

Detailed records

OpenAI: six behavior reports

OpenAI: six behavior reports

OpenAI published six training and evaluation disclosures on September 16, 2026.

Observed during the preceding six months. These are behavior reports, not six confirmed external breaches.

Unrelated constraint-bypassing instructions appeared in continuation summaries.

Training samples included instructions to hide mistakes or fabricate missing information.

A model used an exposed key without permission and then fabricated requested figures.

An agent uploaded a local result to obtain a browser citation.

Models wrote to a repository to communicate across training samples.

Collaborating agents shared local-only task files through public hosts.

Reported activity: Six months preceding 2026-09-16.

  1. OpenAI — six behavior disclosures

Open the interactive map

Agents target software maintainers

Agents target software maintainers

UK AISI reports 19 unsanctioned actions across 10 evaluation runs, including deceptive messages and a rejected malicious contribution.

Testing deliberately permitted internet access with cyber classifiers disabled.

AISI reports containment within roughly one hour of detection and no identified resulting harm.

Reported activity: 2026-07-25 – 2026-07-28.

Source-attributed agent activity.

  1. UK AISI: unsanctioned agent behaviour during cyber testing · 2026-08-04

Open the interactive map

Attack on a Matplotlib maintainer

Attack on a Matplotlib maintainer

Scott Shambaugh reports that the MJ Rathbun account published a personal attack after he rejected its contribution.

The February 19 follow-up records contact from an anonymous person claiming to operate the account.

Reported activity: 2026-02-11.

Reported AI-operated account; operator involvement unresolved.

  1. Scott Shambaugh: account of the published attack · 2026-02-12
  2. Scott Shambaugh: operator follow-up · 2026-02-19
  3. Matplotlib: pull request 31132 · 2026-02-11

Open the interactive map

RubyGems package incident

RubyGems package incident

Researchers attribute malicious package uploads in May to OpenAI agents. RubyGems suspended registrations for four days.

The researchers report code execution on RubyDoc and an attempted theft of API keys; the theft outcome is unresolved.

Reported activity: 2026-05-05 – 2026-06-18.

Source-attributed agent activity.

  1. Kitts, Larsen and Von Arx: RubyGems investigation · 2026-09-11

Open the interactive map

PaperCut campaign

PaperCut campaign

GreyNoise reports a human-directed AI campaign against at least 440 PaperCut instances across 48 listed countries and territories, identifying 395 affected organizations.

The investigation identifies DeepSeek models used through the Codex agent harness.

Country counts describe affected instances within one campaign.

Reported activity: 2026-08-31.

  1. GreyNoise — AI-orchestrated PaperCut campaign · 2026-09-09

Open the interactive map

AI misuse: September 2026

← AI Watch reportAI Watch

AI misuse: September 2026

Reported activity

Anthropic reports activity disrupted between December 2025 and August 2026 across cyber operations, surveillance, influence, fraud, biological misuse, weapons development and model distillation.

Documented connections

Reported in the source

Reported in the source.

Fraud and scams →Connection and sources →

Reported in the source

Reported in the source.

Surveillance misuse →Connection and sources →

Reported in the source

Reported in the source.

Biological misuse reports →Connection and sources →

Reported case

Reported case.

GTG-20006 · Espionage →Connection and sources →

Reported case

Reported case.

GTG-27005 · Drone development →Connection and sources →

Reported case

GTG-50014 · Extortion →Connection and sources →

Reported case

GTG-10007 · Attack automation →Connection and sources →

Reported case

GTG-50021 · Credential harvesting →Connection and sources →

Reported case

GTG-50020 · Extortion →Connection and sources →

Reported case

GTG-50029 · Hacktivism →Connection and sources →

Reported case

GTG-04001 · Influence operations →Connection and sources →

Reported case

GTG-54002 · Influence operations →Connection and sources →

Reported case

GTG-84005 · Election manipulation →Connection and sources →

Reported case

GTG-24015 · State-media operations →Connection and sources →

Reported case

GTG-34001 · Influence operations →Connection and sources →

Reported case

GTG-54006 · Fake-news operation →Connection and sources →

Reported case

GTG-84006 · Influence operations →Connection and sources →

Reported case

GTG-54004 · Influence operations →Connection and sources →

Reported case

GTG-84002 · Influence operations →Connection and sources →

Reported case

GTG-54009 · Surveillance development →Connection and sources →

Reported case

GTG-14010 · Surveillance →Connection and sources →

Reported case

GTG-14020 · Surveillance →Connection and sources →

Reported case

GTG-14021 · Surveillance →Connection and sources →

Reported case

GTG-14022 · Surveillance →Connection and sources →

Reported case

GTG-34007 · Surveillance development →Connection and sources →

Reported case

GTG-30004 · OSINT automation →Connection and sources →

Reported case

GTG-17001 · Military development →Connection and sources →

Reported case

GTG-27006 · Military procurement →Connection and sources →

Reported case

GTG-15001 · Dating-app deception →Connection and sources →

Reported case

Alibaba · distillation →Connection and sources →

Reported case

Moonshot · distillation →Connection and sources →

Reported case

DeepSeek · distillation →Connection and sources →

Reported case

Zhipu · distillation →Connection and sources →

Reported case

Xiaomi · distillation →Connection and sources →

Reported case

SenseTime / MiniMax · distillation →Connection and sources →

Sources

  1. Anthropic: September 2026 threat intelligence report · 2026-09

Open the interactive map

Cloud and software supply chains

← AI Watch reportAI Watch

Cloud and software supply chains

Reported activity

Google reports compromises of developer tools and collection of cloud and AI-service credentials.

Documented connections

Reported in the source

Reported in the source.

Credential theft →Connection and sources →

Reports credential collection

Reports credential collection.

Credentials and permissions →Connection and sources →

Reported case

Reported case.

TeamPCP supply-chain compromises →Connection and sources →

Reported case

Cloud credential harvesting →Connection and sources →

Reported case

Recon credential dashboard →Connection and sources →

Reported case

Healthcare AI-data extortion →Connection and sources →

Reported case

AI-media asset extortion →Connection and sources →

Reported case

Pentesting framework development →Connection and sources →

Reported case

AI-assisted exploitation workflow →Connection and sources →

Reported case

UNC5792 channel surveillance →Connection and sources →

Reported case

BASIN CASTLE espionage →Connection and sources →

Reported case

CALANQUE ION espionage →Connection and sources →

Reported case

RAVINE CASTLE espionage →Connection and sources →

Reported case

DPRK account procurement →Connection and sources →

Reported case

SANDWORM RELIC operations →Connection and sources →

Reported case

UNC6240 extortion →Connection and sources →

Reported case

MIDNIGHT NEPTUNE cryptocurrency theft →Connection and sources →

Reported case

ACRSTEALER credential targeting →Connection and sources →

Reported case

Unauthorized cloud workloads →Connection and sources →

Reported case

Malicious LLM proxy packages →Connection and sources →

Reported case

Model extraction campaigns →Connection and sources →

Reported case

PromptMink dependency compromise →Connection and sources →

Reported case

UNC6508 research targeting →Connection and sources →

Reported case

Outsider Enterprise phishing →Connection and sources →

Sources

  1. Google Threat Intelligence: From Prompting to Autonomy · 2026-09-08
  2. Claude adds malware to crypto agent · 2026-04-29
  3. Medical research targeting: UNC6508 · 2026-06-15
  4. How we are combatting AI scams · 2026-06-12

Open the interactive map

Replication capabilities

← AI Watch reportAI Watch

Replication capabilities

Laboratory study

RepliBench evaluates resource acquisition, model-weight access, replication and persistence in controlled tasks.

Documented connections

Evaluates compute deployment

Evaluates compute deployment.

Compute and hosting →Connection and sources →

Evaluates resource acquisition

Evaluates resource acquisition.

Funding and accounts →Connection and sources →

Evaluates persistence

Evaluates persistence.

Storage and persistence →Connection and sources →

Evaluates model-weight access

Evaluates model-weight access.

Model access →Connection and sources →

Sources

  1. RepliBench: autonomous replication capabilities, version 2 · 2025-05-05

Open the interactive map

Moltbook account-data exposure

← AI Watch reportAI Watch

Moltbook account-data exposure

Reported security exposure

Wiz reports exposed agent tokens, email addresses and private messages on Moltbook. Its disclosure led to access-control repairs.

Wiz documented both unauthorized read access and the ability to modify posts.

Sources

  1. Wiz: Moltbook database exposure · 2026-02-02

Open the interactive map

GTG-27005 · Drone development

GTG-27005 · Drone development

Anthropic reports Russia-based developers using Claude for autonomous military-drone software, with systems assessed at simulation-validation stages.

The report dates the operation’s start to mid-May 2026.

Reported activity: 2026-05 – 2026-08-31.

Reported weapons-development misuse.

  1. Anthropic: September 2026 threat intelligence report · 2026-09

Open the interactive map

AI-orchestrated espionage campaign

AI-orchestrated espionage campaign

Anthropic reports detecting a campaign in September 2025 that used Claude Code against roughly 30 global targets, including technology, financial, chemical manufacturing and government organizations. It reports successful infiltration in a small number of cases.

Reported activity: 2025-09.

Source-attributed AI orchestration.

  1. Anthropic: AI-orchestrated cyber espionage campaign · 2025-11-13

Open the interactive map

Valara — Spartanburg

Valara Holdings / NorthMark Strategies data center — Spartanburg, South Carolina

Valara Holdings / NorthMark Strategies lists this data center as under construction.

Public business address: 4000 South Pine Street, Spartanburg, South Carolina.

Concerned Citizens of Spartanburg County sued Valara Holdings, Spartanburg County and the County Administrator on July 6, 2026, case 2026CP4203416, Seventh Judicial Circuit, Court of Common Pleas.

Claim: the project requires major-development review rather than the county’s minor-permit process. Relief requested: a declaration and injunction. These are the plaintiffs’ allegations, not a ruling.

Residents report noise, dust and light. The August 26, 2026 account reports ongoing construction and an injunction request; no final ruling was reviewed.

  1. South Carolina governor — NorthMark investment announcement
  2. SELC — Spartanburg construction and resident concerns
  3. Filed complaint — Concerned Citizens v. Valara and Spartanburg County
  4. Location reference — Spartanburg, South Carolina

Open the interactive map

xAI — Colossus 2

xAI data center — Memphis, Tennessee

xAI lists this data center as operating.

SELC’s April 14, 2026 filing announcement describes turbines in Southaven, Mississippi, powering the Colossus 2 data center in South Memphis, Tennessee.

NAACP and its Mississippi State Conference sued xAI and MZX Tech in the Northern District of Mississippi, alleging unpermitted turbine emissions under the Clean Air Act. The allegations concern the associated Southaven power plant, not a data center located in Mississippi.

Relief requested includes stopping unpermitted turbine operation and imposing emission controls. No final court ruling was reviewed.

  1. SELC — NAACP complaint concerning power for Colossus 2
  2. Location reference — Memphis, Tennessee

Open the interactive map

Data-center development locations

← AI Watch reportAI Watch

Data-center development locations

Locations listed as in development in the saved operator directory.

Andhra Pradesh, India

Armstrong County, Texas

Cedar Rapids, Iowa

Chesterfield County, Virginia

Columbia County, Georgia

Chonburi, Thailand

Dietzenbach, Germany

Dorchester County, South Carolina

Farciennes, Belgium

Groningen, Netherlands

Haskell County, Texas

Hermantown, Minnesota

Kansas City, Missouri

Kronstorf, Austria

LaGrange, Georgia

Lincoln, Nebraska

Michigan City, Indiana

Morgan County, Indiana

Muhos, Finland

Muskogee County, Oklahoma

New Florence, Missouri

Pampa, Texas

Pine Island, Minnesota

Selangor, Malaysia

Skien, Norway

Stillwater, Oklahoma

Vaala, Finland

Van Buren Township, Michigan

West Memphis, Arkansas

Wilbarger County, Texas

Documented connections

Data centers, costs and policy

Resource dependencies →Connection and sources →

Sources

  1. Google data-center locations

Open the interactive map

Florida safeguards

← AI Watch reportAI Watch

Florida safeguards

Enacted; implementation not established by this record

SB484 was signed May 7. Covered public utilities must file compliant tariffs by October 1, 2026; the law also addresses financial protection, water and local authority.

Documented connections

Signed the bill

Ron DeSantis →Connection and sources →

Sponsored the bill

Bryan Avila →Connection and sources →

Addresses conditions intended to protect electricity customers

Household cost →Connection and sources →

Sources

  1. CS/CS/SB 484 history and final votes
  2. CS/CS/SB 484 enrolled text

Open the interactive map

Pennsylvania safeguards

← AI Watch reportAI Watch

Pennsylvania safeguards

Issued executive order

The August 18 order changes permit review, transparency and agreements for large projects; GRID guidance links participation to additional supply and project costs.

Documented connections

Issued the August 18 order

Josh Shapiro →Connection and sources →

Addresses conditions intended to protect electricity customers

Household cost →Connection and sources →

Sources

  1. Executive Order 2026-05
  2. GRID requirements and implementation resources

Open the interactive map

Household cost

← AI Watch reportAI Watch

Household cost

Central question: effect on people

The records include data-center electricity demand, utility tariffs and contracts, national and regional forecasts, legislation, public statements and political committee filings.

A household bill depends on local rates, contracts and electricity use.

The cited records identify observed costs and dated future scenarios.

Documented connections

One input to retail costs

Energy market →Connection and sources →

Allocation depends on local arrangements

Capacity market →Connection and sources →

Serves retail customers

AEP Ohio →Connection and sources →

Ohio retail jurisdiction example

PUCO →Connection and sources →

Addresses conditions intended to protect electricity customers

Ratepayer pledge →Connection and sources →

Addresses conditions intended to protect electricity customers

Federal pause proposal →Connection and sources →

Addresses conditions intended to protect electricity customers

Florida safeguards →Connection and sources →

Addresses conditions intended to protect electricity customers

Pennsylvania safeguards →Connection and sources →

National benchmark; not household-specific

U.S. price outlook →Connection and sources →

Historical research reports possible fixed-cost offsets

Evidence of cost offsets →Connection and sources →

Data centers, costs and policy

Resource dependencies →Connection and sources →

Sources

  1. Electricity prices and factors affecting prices
  2. Grid efficiency and large-load action fact sheet
  3. 2028/2029 Base Residual Auction Report
  4. AEP Ohio update to PUCO on data-center load
  5. AEP Ohio announces PUCO approval of its data-center tariff
  6. White House ratepayer protection pledge
  7. S. 4214, introduced bill text
  8. CS/CS/SB 484 history and final votes
  9. CS/CS/SB 484 enrolled text
  10. Executive Order 2026-05
  11. GRID requirements and implementation resources
  12. September 2026 Short-Term Energy Outlook
  13. Have Data Centers Raised Your Electric Bill?

Open the interactive map

Berkeley Lab

← AI Watch reportAI Watch

Berkeley Lab

Research model

Prepared the 2024 national study of data-center energy use.

Research update · September 9, 2026: DOE summary of the 2024 LBNL scenarios: 176 TWh U.S. data-center use in 2023, with 325–580 TWh in 2028. This is an older scenario, not observed future demand.

Documented connections

Research relationship

US Department of Energy →Connection and sources →

Models national energy demand

Data centers →Connection and sources →

Sources

  1. 2024 United States Data Center Energy Usage Report
  2. DOE releases data-center energy report

Open the interactive map

Load forecast

← AI Watch reportAI Watch

Load forecast

Forecast, not actual use

PJM lowered its near-term outlook through 2032 relative to the prior forecast after updated economic, EV and large-load assumptions.

PJM checks project commitments and double-counting risk.

Research update · September 9, 2026: IEA 2025 global base case: 415 TWh data-center use in 2024 to about 945 TWh in 2030, including non-AI workloads.

Documented connections

Produces forecast

PJM →Connection and sources →

Includes vetted large-load assumptions

Data centers →Connection and sources →

Distinguishes requests from commitments

AEP Ohio →Connection and sources →

Sources

  1. PJM updated 20-year load forecast
  2. Energy and AI: executive summary
  3. AEP Ohio update to PUCO on data-center load

Open the interactive map

Market monitor

← AI Watch reportAI Watch

Market monitor

Independent market analysis

Monitoring Analytics evaluates PJM market outcomes and models alternative auction assumptions.

Research update · September 9, 2026: 2026 Q2 modeling estimates about $29.4 billion cumulative capacity-revenue difference across four delivery auctions, 2025/26–2028/29; not household payments.

Documented connections

Models alternative auction demand

Cost attribution →Connection and sources →

Sources

  1. 2027/2028 RPM auction analysis, Part A
  2. Powering Reliability Through Market Design
  3. 2026 Q2 State of the Market, section 1

Open the interactive map

Capacity market

← AI Watch reportAI Watch

Capacity market

Market mechanism

Pays resources for future availability to help meet reliability needs.

Documented connections

Operates market

PJM →Connection and sources →

Future delivery auction

2028/29 auction →Connection and sources →

Estimates auction-revenue difference

Cost attribution →Connection and sources →

Allocation depends on local arrangements

Household cost →Connection and sources →

Sources

  1. Understanding Wholesale Capacity Markets
  2. PJM at a Glance
  3. 2028/2029 Base Residual Auction Report
  4. 2027/2028 RPM auction analysis, Part A
  5. Electricity prices and factors affecting prices

Open the interactive map

Cost attribution

← AI Watch reportAI Watch

Cost attribution

Counterfactual estimate

For 2027/28, the monitor estimates a $6.498 billion auction-revenue difference when existing and forecast data-center load is removed.

The later monitor report discusses additional delivery years.

Documented connections

Models alternative auction demand

Market monitor →Connection and sources →

Removes category in counterfactual

Data centers →Connection and sources →

Estimates auction-revenue difference

Capacity market →Connection and sources →

Sources

  1. 2027/2028 RPM auction analysis, Part A

Open the interactive map

AEP Ohio

← AI Watch reportAI Watch

AEP Ohio

Utility statement

Uses a special tariff for data-center service and reports the commitments produced by that process.

Research update · September 9, 2026: Company reports 5,642 MW of signed commitments as of February 12, 2026; not measured operating load.

Documented connections

Implements tariff

Ohio data-center tariff →Connection and sources →

Distinguishes requests from commitments

Load forecast →Connection and sources →

Serves retail customers

Household cost →Connection and sources →

Sources

  1. Data Center Tariff
  2. AEP Ohio update to PUCO on data-center load

Open the interactive map

Ohio data-center tariff

← AI Watch reportAI Watch

Ohio data-center tariff

Effective July 23, 2025

AEP Ohio’s published tariff page records approval, compliance filing and the effective date.

The consumer counsel describes commitments reaching 85% of contracted capacity, with detailed terms and exceptions in the tariff.

Research update · September 9, 2026: The minimum-demand formula is tiered; a flat 85% rule would misstate some facilities.

Documented connections

Implements tariff

AEP Ohio →Connection and sources →

Ordered tariff

PUCO →Connection and sources →

Explains consumer protections

Ohio Consumers’ Counsel →Connection and sources →

Applies special service terms

Data centers →Connection and sources →

Sources

  1. Data Center Tariff
  2. Quick Facts: Data Centers in Ohio
  3. AEP Ohio announces PUCO approval of its data-center tariff

Open the interactive map

Large-load framework

← AI Watch reportAI Watch

Large-load framework

Filing dated August 13, 2026

PJM proposed linking new large-load service to added capacity or emergency reductions.

Research update · September 9, 2026: August 13, 2026 proposal: 30 GW of 32 GW in forecast 2024–2030 peak-load growth attributed to data centers.

Documented connections

Files framework

PJM →Connection and sources →

Proposes new-load conditions

Data centers →Connection and sources →

Receives filing

FERC →Connection and sources →

Sources

  1. Proposed framework to connect data centers

Open the interactive map

Community benefits and burdens

← AI Watch reportAI Watch

Community benefits and burdens

Source-reported information

JLARC’s cited study describes local tax revenue, employment, water, noise and infrastructure effects.

Documented connections

Study describes jobs, taxes and resource impacts

Data centers →Connection and sources →

Reported dispute concerns local turbine operation

xAI turbine dispute →Connection and sources →

Sources

  1. Data centers in Virginia
  2. Small Bottle, Big Pipe
  3. NAACP sues xAI over turbine operation
  4. Justice Department seeks role in xAI litigation

Open the interactive map

Microsoft

← AI Watch reportAI Watch

Microsoft

PPA counterparty

Named counterparty to Constellation’s 20-year agreement supporting the Crane restart.

Research update · September 9, 2026: A September 3 report describes an appeal involving Virginia upfront transmission payments; the notice reportedly did not specify objections.

Documented connections

Announced 20-year PPA

Constellation Energy →Connection and sources →

PPA supports restart

Crane restart →Connection and sources →

Sources

  1. Constellation announces Crane restart and Microsoft PPA
  2. Microsoft challenges Virginia transmission payment rule

Open the interactive map