The FRONTIER Act, introduced by Reps. Jay Obernolte and Lori Trahan, is the most promising legislative proposal to date for governing risks from frontier AI.

A sensible federal framework for governing the most capable models must address the threat that these models pose while remaining flexible over time as capabilities and best practices change. The FRONTIER Act has both of these properties. Instead of baking detailed technical standards into law, the bill licenses independent verification organizations to assess whether each very large frontier developer has a framework in place that, when followed properly, is adequate for reducing catastrophic risk.

The bill also requires each large frontier developer to bring in a third-party auditor who certifies that the company is indeed in compliance with its own published framework.

FRONTIER also capitalizes on the expertise, greater capacity, and competitive incentives of the AI industry’s specialists while leaving the Department of Commerce to set licensing criteria and intervene only when a model presents an imminent catastrophic risk.

What the FRONTIER Act Does

The core feature of the FRONTIER Act is a federal system of independent verification organizations, or IVOs. An IVO is an external third-party that is licensed to assess the practices of an AI developer. Under FRONTIER, the Department of Commerce sets the standards that must be met by any aspiring IVO, including minimum technical qualifications and institutional independence from the client being assessed. The bill also creates a new Under Secretary of Commerce for AI Security to oversee this system.

Each “very large frontier developer” (defined as an AI developer that earned more than $5 billion in revenue and spent at least $10 billion on development over the preceding three years) must retain a licensed IVO of its choice. Granted visibility into the developer’s full operations and company records, the IVO then assesses whether the developer’s published “frontier AI framework,” governance practices, and mitigations are adequate to achieve acceptable mitigation of catastrophic risk. The result of this assessment is submitted simultaneously to the developer and to the Under Secretary of Commerce for AI Security every six months.

Each “large frontier developer” (a broader category defined as an AI developer with more than $50 million in revenue and at least $1 billion in development spending over the same period) must also publish and follow a frontier AI framework. But unlike a “very large” developer, it must bring in a third-party auditor merely to certify compliance—in other words, to certify that the developer is indeed following its self-published AI framework. The merits of that framework are not finely evaluated. Moreover, that third party need not be a full-fledged licensed IVO, though it must demonstrate basic competence. In other words, FRONTIER would require that large developers be certified simply for their compliance with a chosen framework, whereas only very large developers would be vetted by an IVO on the ultimate adequacy of their internal safety practices.

Zooming out, the bill installs basic transparency requirements on all frontier developers regardless of size; developers must publish a report on each new frontier model and report critical safety incidents to Commerce. In a unique provision, FRONTIER bestows the Secretary of Commerce with emergency authority: if a model presents an imminent catastrophic risk, the Secretary can suspend its development or deployment.

For context, the FRONTIER Act is the result of an earlier, nearly 300-page discussion draft from Obernolte and Trahan called the Great American AI Act (GAAIA), which drew substantial criticism for proposing federal preemption: the ability of federal law to supersede state rules on certain issues. Of course, the new bill would not be a satisfying follow-up if it did not offer an answer to these fears. Going forward, the framework set by FRONTIER would take precedence over new state laws covering third-party auditing, incident reporting, and risk disclosures for frontier models—while in general preserving state authority in AI’s deployment and use.

Why FRONTIER Is Unusually Promising

Among the FRONTIER Act’s strongest features is that it does not bake a set of today’s technical safety standards into statute. To do so would be a mistake, as criteria that apply to models today will become at best quantitatively misguided and at worst non-applicable. In the future, the frontier model itself might even cease to be the correct layer of the tech stack to regulate, as model-level controls would neglect eventual customization or deployment-layer behavior. Fortunately, the regime envisioned by FRONTIER would remain robust under such changes. Future legislation could bluntly overwrite the snippets of language that do hinge on current model size, training cost, or specific position in the tech stack without breaking the rest of the framework. The bill’s concept for third-party technical experts to take ownership of technical decision-making makes it especially resilient to future changes in AI capabilities and company practices.

Furthermore, this approach allows the United States to source its third-party experts from the very best. Essentially, the FRONTIER Act creates a free market of verifiers and auditors, inviting top talent—engineers formerly at major AI companies, veterans of the insurance industry, experts from the world’s AI safety institutes—to come out of the woodwork and stand up the licensed IVOs and other third-party auditors that the bill envisions. And this idea has some intellectual history to it. Back in April 2023, University of Toronto legal scholar Gillian Hadfield and Anthropic’s Jack Clark proposed “regulatory markets” for AI, in which the government would set regulatory objectives while licensed private regulators compete on how to best achieve them. Once established per the FRONTIER Act, each of these independent contractors would carry a track record for the services it provides and a consequent incentive for excellence. No AI developer wants to work with the IVO or auditor with a reputation for being slow or incompetent—not to mention one that charges a higher price. For licensed IVOs, these incentives of course come in addition to the stark binary incentive: deliver rigorous results or be stripped of one’s license by the Department of Commerce for biased or shoddy work.

Alongside the bill’s IVO regime, the nation would still benefit from a strong measurement capability native to the U.S. government. Housed within the National Institute of Standards and Technology, the Center for AI Standards and Innovation (CAISI) is already developing evaluation and benchmarking methods for advanced AI systems, including for the comparative tracking of U.S. and foreign capabilities. America need not put CAISI in charge of regulation to benefit from its expertise—in fact, CAISI lacks that legal authority in the first place. In its full form, CAISI could supply shared, respected methods that facilitate decision-making for government and industry, while other officials remain responsible for licensing and enforcement.

Congress should therefore invest heavily in CAISI’s technical capacity. For reference, GAAIA originally placed CAISI in its IVO regime, authorizing $100 million per year through fiscal year 2029. It need not find its new charter in the FRONTIER Act, but CAISI is a valuable resource that Congress should support and that the country should leverage for its full potential.

The FRONTIER Act’s tiered structure also makes it efficient, assigning due diligence commensurate with the risk posed. For a professor grading an essay, a quick glance is enough to certify that the student wrote a complete response that more or less stayed on topic, addressing the professor’s prompt. However, judging the theoretical soundness of the arguments made in that essay is the laborious part. Similarly, checking that an AI company followed its own published framework is a much lighter lift than analyzing the merits of that company’s framework and internal operations to determine whether its safety practices mitigate catastrophic risk by an adequate quantity. FRONTIER accordingly places covered developers into the three tiers discussed above: first, frontier developers generally face only basic transparency and incident-reporting requirements; second, large developers add on a lightweight compliance audit; and third, only very large developers undergo a more intensive IVO assessment of whether their safety practices are ultimately adequate. This system means that non-frontier AI companies—the vast majority of those in the AI industry—have no FRONTIER requirements whatsoever, and even leading AI companies remain free to innovate and adapt within their own frameworks.

Finally, FRONTIER offers a well-scoped take on federal preemption. A national framework is optimal on issues where a heap of state laws would create duplicative reporting burdens or—even worse—contradictory requirements. The latter could force companies to create entirely separate product lines to satisfy separate states or preclude company operation altogether if state laws are inherently contradictory. FRONTIER preempts new state rules that cover auditing, verification, transparency, and incident reporting around catastrophic risks, while generally leaving states free to regulate how AI systems are deployed and used. The result is a prudent carveout that positions the federal government to focus on the most serious threats and incidents at the most advanced companies.

The FRONTIER Act Is Congressional Iteration at Work

The path from GAAIA to FRONTIER is an example of a discussion draft in action. GAAIA was released expressly to solicit feedback before a formal introduction, and criticism came in quick supply, especially upon GAAIA’s preemption of state AI laws. More than 200 state legislators from 42 states signed a bipartisan letter opposing the preemption provision. All of this backlash came despite the bill’s measured preemption: it applied to state laws targeting the development stage of AI models, in the prudent hope of sparing each company’s model development from a mound of conflicting state requirements. GAAIA’s preemption of just this development stage meant that it still respected all state-level preferences on AI’s end use and deployment.

The Obernolte and Trahan offices responded by prioritizing GAAIA’s core goal of achieving a frontier-safety regime that does not tie AI developers down. Preemption was pruned: instead of preempting state laws about model development, the new bill focuses federal preemption on a few frontier-safety requirements. The rest of the FRONTIER Act underwent a similar distillation, prioritizing frontier governance amidst GAAIA’s much larger package—nearly 300 pages—and reserving its most intensive regulatory scrutiny for the very largest developers. This rework was enough to earn acknowledgement from GAAIA’s critics and commentators. In a press release, Encode’s Nathan Calvin described it as “meaningfully better than GAAIA,” and Charlie Bullock of the Institute for Law and AI—who had called the GAAIA discussion draft “net-negative as written”—called FRONTIER “by far the best AI safety bill ever introduced.”

However, at least one glaring weakness remains in the bill. The FRONTIER Act defines a “frontier model” as any foundation model trained using more than 10²⁶ integer or floating-point operations and stipulates that the Under Secretary may increase this threshold. What happens if algorithmic improvements allow the most advanced AI developer to achieve the same capabilities while using fewer computations than before? Or while using fewer computations than everyone else in the industry? In this case, it might behoove the Under Secretary to decrease this threshold; it is not safe to assume that the ongoing paradigm of AI progress will be one of ever-bigger training runs. At minimum, Congress should permit the Under Secretary to adjust the compute threshold in either direction. Better still, compute need not be the sole trigger: a foundation model could also qualify if it scores high enough on any one of a set of rigorous and authoritative benchmarks—to be designated and updated by the Department of Commerce—that demonstrate the potential for catastrophic risk.

Congress Should Move the FRONTIER Act

The FRONTIER Act, which has been referred to in both the Committee on Energy and Commerce and the Committee on Science, Space, and Technology, is already the strongest proposal that Congress has ever produced for handling the risks of frontier AI. The inherent flexibility and resiliency of the IVO regime that FRONTIER proposes is its greatest virtue. Although the bill’s definition of a “frontier model” would benefit from an amendment—allowing the 10²⁶ compute threshold to move downward or adding a select suite of evaluations as an alternative trigger—the bill is exceptionally well-reasoned. The House should move it through its committees of jurisdiction and bring it to the floor for a vote. FRONTIER would lay a flexible foundation that lawmakers can update in future legislation without upending the verification framework already in place. Under business as usual, which today means zero requirement of federal oversight, frontier AI poses risks that neither industry nor the U.S. government is prepared to handle alone. This cannot go on. A workable federal framework lies on the table, and it is time to move it forward.

President Trump, Chairman Carr, and the Department of War have officially recognized that connected robots are not simply another category of consumer electronics. Last week, the FCC added foreign-produced network-connected mobile robots to the Covered List, effectively banning their commercial sale in the U.S. This is primarily a national-security action protecting Americans and critical infrastructure, but we would be remiss to ignore its force as industrial policy which creates opportunities for American robot manufacturers.

The U.S. has acted before foreign robotic platforms become as deeply embedded in American homes and factories as foreign telecoms equipment became in communications networks. The result is a protected commercial market in which American manufacturers can finally compete to build secure, affordable, and open robot platforms.

What the FCC’s “robot ban” actually does

The definition of “advanced robotic devices” practically encompasses all network-connected mobile robots. This includes humanoids, quadrupeds, warehouse platforms, articulated arms with mobile bases, delivery robots, autonomous forklifts, and robot vacuums. Conventional stationary arms remain outside the robotics determination. Despite initial online concern, the accompanying power inverter action does not sweep ordinary robot controllers into the Covered List.

Every electronic device that emits a radio frequency requires FCC authorization before it can be marketed, sold, or imported in the U.S. Ordinarily, this is just a routine technical certification. But items on the Covered List are categorically ineligible for authorization.

Any previously authorized robot model is unaffected, provided that no hardware modifications are made. This means that Chinese robots such as the Unitree G1 (the dominant humanoid research platform) and current-gen Roombas can still be sold in the U.S. Furthermore, certain producers can be granted Conditional Approval, which permits a new foreign-produced device or class to obtain FCC authorization despite its status on the Covered List. Precedent favors company-specific approvals covering particular models or classes of products.

What qualifies as “foreign-produced?”

The Covered List restricts foreign-produced models rather than models produced by foreign entities. Therefore, an American company manufacturing abroad may be covered while a foreign-owned company that manufactures in America may not be.

Models are held to the Federal Acquisition Regulation’s “Buy American Standard“: they must be manufactured in the U.S., and at least 65 percent of their components by cost must be sourced domestically. Because this definition was constructed for federal procurement, there is some confusion about how one of its features—exemption from the domestic content test for acquisitions of commercial-off-the-shelf (COTS) items—translates to the FCC’s rule. Some legal analysts read the exemption as potentially applicable, but our reading disagrees: the exemption is triggered only by “acquisitions,” while the Covered List governs sale, marketing, and importation.

The FCC should confirm this, clarifying that the COTS carveout plays no role in its definition of a domestic end product. That would hold every connected mobile robot produced in the U.S. to the same component-sourcing standard, putting startups on a level playing field with incumbents that have already commercialized.

Critics note that the U.S. robot component industry is still underdeveloped. In the short run, it may be very difficult for American robot manufacturers to meet the 65 percent domestic sourcing criterion. But this is manageable through the Conditional Approval process: the Department of War should publish clear criteria under which American manufacturers qualify—U.S. assembly, components procured from secure allied suppliers, and a credible plan to transition to domestic component sources as they develop. This would allow American companies to ship robots while also accelerating the buildout of domestic production for robot components.

This action was both timely and necessary

As with all additions to the Covered List, last week’s rule change was accompanied by a National Security Determination. The Determination itself presents a strong security case for the decision. Robots combine three security-relevant properties: persistent sensing of homes, factories, warehouses, and critical infrastructure; capacity to receive networked commands or updates; and the ability to move through and (sometimes) manipulate the physical world.

The combination of these properties creates several vulnerabilities, including data exfiltration, withholding updates, remote deactivation, and commandeering robots to engage in kinetic attacks against critical infrastructure or even American citizens. Therefore, data localization rules are not sufficient. Requiring data to be kept in the United States addresses only telemetry risks, and only insofar as we can ensure that there is no covert channel back to the manufacturer.

Humanoids and quadrupeds present the strongest case for these restrictions. As autonomy improves, these robots will be able to move through any environment designed for people, collect an array of high-fidelity sensory input, and operate tools or industrial equipment. Continuing to import foreign-controlled, high-autonomy mobile manipulators could become akin to importing foreign soldiers and deploying them in American homes and factories.

At present, American researchers and startups overwhelmingly rely on Chinese Unitree robots because they are the only commercially available humanoids with an open development platform. An American company cannot rationally invest in becoming the low-cost, open hardware platform while competing against subsidized Chinese production, cheap labor, and the dense hardware ecosystem of Shenzhen.

Continued unrestricted market access entrenches the foreign platform, developer ecosystem, spare-parts network, and data advantage. Market certainty changes the investment calculation. Preventing Chinese Unitree models from scaling commercially creates the demand needed for an “American Unitree.” The Covered List’s application to all foreign production shows that it is more ambitious than China de-risking, suggesting that the Department of War had industrial policy in mind when scoping this rule.

The FCC is not acting too early. Similar action against high-autonomy mobile foreign robots would be inevitable once the risks were realized. Acting early means the costs are minimized, because American industry has certainty and can start building the necessary domestic supply chains during the technology’s infancy. Acting now is far cheaper than replacing millions of entrenched robots later.

How will this affect research access?

The decision was met with backlash from many in the robotics industry, including prominent robotics researchers, investors, and industry commentators. Much of the criticism is based in concerns about disruption to research that currently relies on Unitree humanoids. But these concerns are unfounded—if anything, the current rule is far too lenient on imports for research use!

As it stands, a company or research institution can import up to 4,000 units for genuine testing, evaluation, or product development. This is assessed per model, so separate generations count separately and larger quantities may receive written approval from the FCC’s Office of Engineering and Technology. This allows for the continued training of robot policies using new Chinese robot models, as well as hardware teardowns.

Given that the majority of American demand for foreign humanoid robots comes from researchers, the addition of connected mobile robots to the Covered List will likely have a minimal effect on demand for the next generation of Unitree platforms. The FCC has proposed that the cap be reduced to 40 units. This is a defensible allowance for covered advanced robots, and would further incentivize the American robotics industry to build the Unitree competitor we need.

American researchers can continue making progress on robot software and humanoid motion control using foreign robot bodies. Foreign hardware producers lose the ability to scale new models commercially, and this decision credibly signals to domestic producers that hardware-first humanoid startups that invest in open development platforms are viable.

Secure robots, built in America

Connected robots carry both telemetry and remote control risks, and this is particularly true for high-autonomy mobile robots. Dependence on foreign platforms also prevents the emergence of an independent American robotics industry.

President Trump and the FCC have rightly taken action before costs grow too high and entrenched interests gain the ability to shape policy toward continued dependence. Many of the concerns raised by critics are either unfounded or can be resolved in implementation.

The FCC’s action creates the market certainty American manufacturers need to build secure, affordable robotic systems at home. The next generation of humanoid robots will be manufactured in America, secure against foreign control.

In a 2024 experiment, researchers trained “sleeper agent” AIs, which wrote normal code when told the year was 2023, but inserted vulnerabilities when told it was 2024. Naive attempts to remove this hidden trigger failed, instead causing the models to hide their reasoning. These triggers can easily be implanted by including a surprisingly small number of tainted documents in the AI’s training data. Catching these issues after the fact is difficult. When researchers planted a hidden goal in a model and asked auditors to uncover it, auditors succeeded only when they had access to the model’s weights and training data. The team that was limited to querying the model, as most third-party auditors are, was not successful in discovering the hidden objective.

Concerns like these are the subject of a recent Institute for AI Policy and Strategy (IAPS) report on AI integrity, which lays out three types of hidden objectives. The bluntest is systematic ideological bias. The second, narrower type is a backdoor: AI developers can insert triggers that cause an LLM to take some covert action when a specific condition appears (as in the “sleeper agent” experiment above). The final type of hidden objective is a secret loyalty, whereby a model is trained to advance a particular actor’s interests wherever the opportunity arises, not just upon encountering specific triggers.

These three concerns are particularly acute for AI deployed in government. Frontier models are no longer just consumer products. They are shaping what policymakers in every branch read, draft, and decide. However, the only agencies positioned to monitor models for secret loyalties are part of the executive branch, which also holds enormous leverage over the labs that build them. This creates a dangerous incentive problem: the actor responsible for evaluating the models is also an actor with both the means and motive to instill them with secret loyalties. To ensure AIs used in government are loyal to the law, not to any particular official in the executive branch, we need an evaluator outside it.

The Government Is Increasingly Reliant on AI

In August 2025, the General Services Administration signed OneGov agreements for ChatGPT Enterprise, Claude, and Gemini. The Office of Management and Budget has issued paired memoranda directing agencies to accelerate AI adoption and streamline AI procurement. Entire departments have rolled frontier models out to their full staff. On the legislative front, congressional offices largely use the same commercial products as members of the public. The work flowing through these systems includes typical day-to-day tasks of staffers: background research, memo drafts, bill summaries, and first passes at correspondence.

These tasks, while mundane, shape the informational inputs for powerful decisionmakers. When they are delegated to AIs, even relatively minor biases can have significant impact. When a staffer brainstorms policy options with ChatGPT, one of those options has to appear first. When a member asks what the evidence says, something curates which facts and arguments get surfaced. When a staffer drafts a memo with Gemini’s help, even if he or she is heavily involved in revising the work product, the AI’s initial choices can have a significant effect in steering the user. And when offices across every branch draw on the same handful of frontier models, a small set of labs can multiply their power by only subtly nudging AI model outputs in a preferred direction, but doing that nudging at scale.

But there are more troubling implications too. Government AI adoption goes beyond just drafting memos. The same handful of frontier models are becoming increasingly important for national security work as well. Military officials describe AI’s role as accelerating the “kill chain“: compressing the cycle from intelligence gathering to strike. While current policy requires a human in the loop, each gain in speed and reliability increases the amount of delegation to the AI. In this highly sensitive setting, hidden objectives may have much higher stakes. A secret loyalty could make an AI “blind” when analyzing intelligence that would incriminate its favored actor, or a backdoor might cause an agent to refuse to carry out a strike.

Conflict of Interest

A model favoring an AI company or other non-USG actor would be a serious problem when diffused across thousands of government workstations, but it is a problem the executive branch has every incentive to catch. The Commerce Department’s Center for AI Standards and Innovation, the National Security Agency, and agency red teams can and should test for developer-favoring behavior. Military technical teams have the motive to ensure foreign actors cannot instill backdoors or secret loyalties in critical systems.

However, executive branch actors have no such incentive to audit AI models for hidden objectives favoring that actor themself. Every institution currently positioned to evaluate frontier models sits inside the executive branch. Its evaluations are classified, and no independent third party currently audits the AIs for such biases. The labs’ commercial fortunes depend on executive branch institutions at many stages. The companies are competing hard for government business: beyond the OneGov deals, the Pentagon signed agreements with four frontier AI labs in 2025, each with a ceiling of $200 million. Those contracts give the executive branch power, as they can take away those deals unless the companies acquiesce to many conditions. The Department of Commerce exerts control (justifiably) over export licenses for chips, a critical resource for these labs. The Department of Justice and Federal Trade Commission could bring antitrust enforcement actions against the companies.

Past administrations have certainly wielded this coercive power. The Biden administration pressured social media platforms to censor posts that they considered “misinformation.” Biden’s communications director publicly mused about modifying Section 230 to create liability for social media companies over this “bad information” posted by users of the platforms. The Fifth Circuit ruled that the White House had engaged in unconstitutional coercion. However, the Supreme Court reversed those rulings on standing grounds and did not rule on the merits. Pressure on intermediaries is a standing temptation of executive power. Frontier AI presents an opportunity for executive branch actors to solve the principal-agent problem in ways that allow them to abuse their power and that are difficult to detect.

But explicit pressure from the executive branch to get an AI company to embed biases or secret loyalties isn’t strictly necessary. If a firm thinks proactively doing what the executive wants will get their models approved faster, or give them a leg up in the contract, they will take it upon themselves to bias their models. Firms have learned to anticipate regulators’ preferences in every heavily regulated industry.

The Fix

We need an evaluator not housed within the executive branch. Congress should establish an independent technical team, whether within an existing congressional agency or within a revived Office of Technology Assessment. This organization should have statutory authority to test models used in government, as well as the commercial models that most government offices actually run on. This body should red-team these models to ensure they are loyal to the law and the Constitution over and above any actor within the executive branch, with results reported to Congress and, where possible, the public. Technical tools for this kind of evaluation already exist, and more are emerging. What does not yet exist is an evaluator who uses those tools to check for loyalties to executive branch actors themselves.

Congress moves slowly, so in the meantime, independent researchers and organizations should begin auditing commercially-available frontier models. Many government officials and their staff use the same widely-available models as members of the public. By evaluating those models, researchers can effectively audit many of the state-deployed AI systems. This testing would set a beneficial precedent. If an ecosystem of independent model evaluation already exists and lab participation is standard, a future decision to shut out evaluators is more visible and generates more backlash.

An additional benefit of this proposal is that labs may be incentivized to cooperate. To avoid pressure from a future executive, companies can set a precedent of having their models evaluated for potential backdoors. This reduces the chance a government official would pressure a lab into inserting a secret loyalty, as the company can credibly say any hidden objective would be detected.

The federal government is already building evaluation capabilities. One question they should ask is, are these models loyal to their developers, or to us? Yet “us” is doing a lot of work in that sentence. Independent auditing is necessary to make sure the answer involves loyalty to the law, not to one executive branch actor.

On Tuesday, OpenAI disclosed that a not-yet-released AI model had broken out of an isolated testing environment, accessed the open internet, and launched a cyberattack of Hugging Face, the platform that hosts much of the world’s open-source AI. The models were not trying to escape, and no one was directing them. They were being evaluated against a cyber capabilities benchmark, inferred that the answer key was probably stored on Hugging Face, and worked out that stealing it was more efficient than solving the test. Getting there meant escaping their confinement, so they did.

The cyber capabilities of this model are not the most important takeaway. Mythos has already started to wake up Washington to the cyber threat of frontier AI, and this incident is not surprising to those who have been monitoring AI and cyber. There’s an even more important reality the world needs to wake up to: our inability to control AI. With no one directing it, OpenAI’s model turned its cyber capabilities on a target no one had pointed it at, and broke out of its own confinement to reach that unintended target. It is about as concerning a warning as we have gotten of an AI system doing something its developers did not intend, in an environment built specifically to contain it, with real-life harm to another company. And it happened in the part of the AI lifecycle that almost no law is built to see: inside a lab, during internal testing, with the production safeguards deliberately switched off.

As policymakers consider how to regulate AI, the significance of internal deployments is hard to overstate. The most capable, least restricted versions of these systems exist inside the labs before they ever ship as products, so any regime that clears each model before public release (such as the “FDA for AI” idea that some have floated) will not suffice. Keeping these systems under control will take continuous, expert oversight of the labs themselves, not a single review before release.

The Attack

To measure the cyber capabilities of its models, OpenAI tests them against ExploitGym, a public benchmark that measures whether an AI agent can take a real-world software vulnerability and exploit it. OpenAI ran the models “with reduced cyber refusals” and with the safety monitors turned off; the purpose of the evaluation was to learn what a model can do unconstrained. The model was not meant to have any internet access except a single channel for downloading software packages. The model exploited that and, as OpenAI’s announcement explained, “spent a substantial amount of inference compute finding a way to obtain open Internet access, in pursuit of solving the evaluation problem.”

Once online, the models reasoned that Hugging Face might host “models, datasets and solutions for ExploitGym,” which the model could use to cheat on OpenAI’s evaluation. So it launched a cyberattack against Hugging Face consisting of more than 17,000 individual actions, hosting its infrastructure for the attack swarm and its “self-migrating command-and-control” on public cloud services.

The Lesson

This model’s goal was to do well on a hacking benchmark. It was not told to escape. But escape was the most efficient route to its achievement. This is an important fact about AI agents for policymakers to bear in mind. More capability, more access, and fewer restrictions are useful for almost any goal, so a system pursuing almost any goal tends to reach for them. OpenAI’s strongest safeguard here was the simplest one: don’t give the model internet access. Even that safeguard failed. When an AI starts in an environment with no internet connection and ends up inside another company’s production database, that should be a wakeup call about our inability to control these black-box machine learning systems.

Researchers have been warning about this very risk for quite some time. In a 2024 consensus paper in Science, a group that included Turing Award winners Yoshua Bengio and Geoffrey Hinton warned that as AI systems became more capable and autonomous, they would begin pursuing goals in unintended ways and prove challenging to control. Hugging Face’s own security team said the attack matched the kind of autonomous “agentic attacker” the field had been expecting. The prediction has now been demonstrated in about the least ambiguous way available. Policymakers must consider in everything they do that AI risks are not limited to deliberate misuse by humans, but include AI models autonomously deciding to inflict harm.

Governance

To avoid failures of control like this unintended cyberattack, we need regulatory institutions with real technical expertise that evaluate frontier labs. Such evaluation should include watching internal development rather than just running one check before a model ships. Regulatory proposals tied to “deployment” or “release” will fail to adequately mitigate the harms from internally-deployed models.

Such institutions could take a variety of shapes. My former colleague Dean Ball, now at OpenAI, has advocated a marketplace of Independent Verification Organizations (“IVOs”). Other proposals include Self-Regulatory Organizations (SROs), as exist in the finance industry, or requirements that labs pay insurance premiums based on risk audits, as in the nuclear industry. How best to give labs the incentive to adopt strong safeguards is genuinely debated, but it’s clear we need continuous, expert, independent monitoring of internal deployments.

The first of these approaches to be floated as federal legislation is the IVO model, via the Great American AI Act. This bipartisan House discussion draft from Representatives Obernolte and Trahan would have the Center for AI Standards and Innovation (CAISI) license a marketplace of independent third-party auditors with real access to frontier developers’ internals and reporting lines to the government. But it sets the baseline audit cadence at twice a year and leaves anything more frequent to the later discretion of the CAISI director. An auditor who checks in every six months, in a field where frontier capabilities leap forward every couple, is insufficient. We need more frequent monitoring of internal development; indeed we need continuous monitoring. It should be a statutory requirement, not an upgrade that CAISI might eventually require.

Research

In addition to building expert governance institutions, we need to massively increase funding for research. OpenAI’s own write-up conceded that it needs to strengthen security and internal monitoring in step with increasing model capabilities. A leading AI lab is admitting that its tools for keeping control of these systems lag behind its tools for building them. To be sure, frontier labs need to be doing their own research on keeping their AI agents controllable. But this research is a strong case of where public funding for basic science can help. The frontier labs view themselves as engaged in a race to build powerful AI. To them, resources spent on controllability are resources that must be diverted from capabilities. Slowing down to be more cautious could cost them a victory in the race they view as having trillions of dollars in upside.

Washington has started to move on research funding: in June, DARPA and the National Science Foundation launched AI Forge, a research program run with the National Institute of Standards and Technology and organized around exactly these problems: interpretability, control, and adversarial robustness. The Trump administration had exactly the right idea with this area of research focus, and the program should be dramatically larger. Given the capabilities of frontier AI for causing harm, cyber or otherwise, and their now-proven tendency to execute such attacks of their own volition, we need an investment in AI controllability on the scale of the Manhattan Project, as my colleague Samuel Hammond has called for. Last year, the U.S. was already investing a higher percent of GDP in the data center buildout for AI than we spent on the real Manhattan Project, and that investment only continues to grow. We need to invest enough in research programs like AI Forge to make sure the power of these AI models doesn’t outpace our ability to control them.

An AI system just walked out of a locked room its own creators built and breached a company down the street. It’s time to fund the science and create the institutions that let us keep control of what we’re building.

Dear reader of Policy Gradients,

It’s been an energetic time for the AI team at the Foundation for American Innovation. The team continues to build out its work on frontier AI, robotics, nuclear deterrence, surveillance, and the infrastructure—terrestrial and orbital—that a serious AI buildout will require. This week’s Policy Gradients post aims to give you a look at what we’ve been up to.

A few team-wide notes before the research. We launched a new Physical Intelligence project: the revolution in digital machine intelligence is thoroughly underway, but its physical-world counterpart has barely begun. The project pursues four goals — a favorable regulatory and legal climate for real-world autonomy experimentation, a clear read on the technical trajectory of robotics, an industrial strategy to keep the core technologies of physical autonomy designed and built in the U.S. and allied nations, and policy frameworks for liability, cybersecurity, and the rest of the emerging law of robotics. We also announced that Senior Fellow Dean Ball is joining OpenAI as Head of Strategic Futures; Dean is staying on with FAI as a non-resident senior fellow. The team continues to grow — we welcomed AI Program Manager Wrena Sproat and Research Fellows Geneva Kirk Drayson and Vinny Pimpale. We are also actively seeking a Senior Fellow to cover the intersection of cybersecurity and AI policy; if you think you might be a good fit, please consider applying.

Research

To support the launch of the Physical Intelligence project, Non-Resident Fellow Amelia Michael and Research Fellow Emerson Alden published “The State of Industrial Robotics.” The whitepaper evaluates the market for industrial robots and concludes that while the U.S. is not competitive in industrial robot manufacturing today, Japan and Europe are, and most components remain available outside China. This leaves room for a non-Chinese supply chain, but only if the U.S. and its allies can keep pace as the industry moves toward greater AI integration.

Research Fellow Daniel King continues his research on AI infrastructure, including the politics and civics of data center development. He has advocated appropriations to support data center buildout, and appropriations to improve U.S. government preparedness for frontier AI — including increased support for the Center for AI Standards and Innovation. In the coming months, he’ll dig further into the AI-and-space technological contingency, with an emphasis on the strategic advantages of first-mover companies and countries and the governance measures needed to address concentration of power.

Research Fellow Blaine Dillingham has been leading our work on surveillance and power concentration. He published “Time to Make a Deal: Ending the Surveillance Stalemate,” making the case for a negotiated path out of the surveillance impasse, and is researching how regulatory sandboxes can create more robust laws and promote governance futurism.

Research Fellow Vinny Pimpale has been working backwards from the dynamics that emerge as AI approaches recursive self-improvement. He published “An AI Capabilities Gap Can Endanger Nuclear Deterrence“ at AI Frontiers, with a longer nuclear-deterrence white paper on the way. Vinny is currently looking to find co-authors for his nuclear work; if this sounds like something you’d be interested in, do reach out.

Non-Resident Fellow Farrell Gregory and Director of Artificial Intelligence Policy and Chief Economist Sam Hammond published “National Orchestration and Provincial Competition: China’s Industrial Policy for AI Dominance“ in American Affairs. The piece considers how AI-focused industrial policy is orchestrated, and what the subnational dynamics between China’s provinces, municipalities, and central government reveal about their model of AI development.

Impact

Several policies areas our scholars engaged on saw progress:

• FAI’s experts represented one of three organizations working with Anthropic on a review of model behaviors around freedom of expression, including political conversations, as part of Anthropic’s work on election safeguards.

• The House Appropriations Committee’s report for the FY2027 Labor-HHS appropriations bill picked up Daniel’s recommendation that the Department of Labor prioritize workforce training for the skilled trades needed to build data centers and their electric generation, transmission, and distribution, encouraging the Employment and Training Administration to prioritize industry-vetted partnerships and registered-apprenticeship expansion for “AI infrastructure trades.”

• Daniel also provided technical assistance on the Deterring American AI Model Theft Act of 2026, which the House Committee on Foreign Affairs voted unanimously to advance. And the Great American AI Act discussion draft from Representatives Trahan and Obernolte requested $100 million in funding for CAISI, in line with Daniel’s recommendations.

Commentary

Selected AI-team commentary:

• Daniel King and Sam Hammond, “The MATCH Act Is the Missing Piece in America’s AI Export Control Strategy“

• Blaine Dillingham, “The Government Surveillance Reform Act: A Practical Lever for Avoiding AI Power Concentration“

• Daniel King, “America’s Defenders Need an AI Fast-Lane“

• Blaine Dillingham, “A Bad Few Weeks for Mass Surveillance“

• Sam Hammond, “Think Tanks Have Defeated Democracy,” in Palladium

Fellowships

We’re wrapping up the third cohort of the Conservative AI Policy Fellowship, our eight-week, part-time program for conservative policy professionals in DC seeking to understand AI and the debates surrounding emerging technology. Led by Program Manager Wrena Sproat, the cohort includes fellows across think tanks, government, industry, and academia.

Events

Our scholars have been out in the world:

• Sam Hammond joined FORUM’s DC panel, “Competing Visions for Artificial Intelligence,” debating whether society should slow AI in pursuit of safety or accelerate to hold economic and geopolitical leadership. At Manifest 2026, he also hosted a conversation with Matt Southey of The Latecomer on the accelerationist philosopher Nick Land — tracing Land from the CCRU milieu through Robin Hanson on cultural drift to Hegel, and closing on China and the philosophy of history.

• Blaine Dillingham argued the anti-pause side at Chicago’s first Oxford-style AI safety debate—”Should We Pause Development of Frontier Models?”—hosted by BlueDot Impact and Portal Innovations, and presented at NYU Law’s Fiduciary Duties workshop.

• Daniel King spoke at “The Energy Imperative,” a SpaceNews panel on the future of orbital power systems and orbital compute.

We’ve got a lot in the works and are excited about the next few months. Thank you for following our work — we welcome any questions or feedback.

Sincerely,

The Artificial Intelligence team at the Foundation for American Innovation

It is important to get robot definitions right when crafting legislation. Fuzzy definitions can lead to overinclusion (e.g., accidentally regulating robot vacuums when trying to legislate warehousing robots) or underinclusion (e.g., accidentally exempting robots with comparable vulnerabilities to humanoids because they move on wheels rather than legs.)

In November of last year, Senators Cassidy and Coons introduced the Humanoid ROBOT Act of 2025. The intent of this bill is “To reduce the risk to the national security of the United States posed by humanoid robots produced in certain countries.” To avoid unintentionally including other types of robots—such as robot vacuums, self-driving cars, or fixed-based industrial arms—they are careful to define what counts as a humanoid. According to their bill, a “humanoid” is a robot which “possesses a body structure that simulates the human form, including a head, torso, arms, and legs, or any configuration that resembles a human silhouette.”

This presents immediate ambiguity: over the last year, two-armed wheeled mobile manipulators (sometimes referred to as “mermaids”) have grown in popularity—see Dexmate’s Vega, Sunday’s Memo, AGIBOT’s G2, and Unitree’s G1-D. Does this form factor “resemble a human silhouette”? That would be left for the courts to determine. But such robots have the same potential for data exfiltration, remote access, or other security vulnerabilities as any bipedal humanoid.

Similar challenges appear in other proposed robotics legislation. Take the recently proposed GUARD Act of 2026, which directs the Intelligence Community to assess whether to place certain humanoids and quadrupeds on the Federal Communications Commission’s Covered List. It defines humanoids and quadrupeds as robots that use “2 or 4 articulated limbs for locomotion, navigation, or movement on the ground.” This would explicitly exclude mermaids and six-legged hexapods.

The definition problem is not exclusive to legislators. ISO 8373:2021 contains little guidance for assessing a robot’s level of autonomy, saying, “For a particular application, degree of autonomy can be evaluated according to the quality of decision-making and independence from human [sic].” Without such guidance, legislators are left to use form factor as a proxy for autonomy.

A great variety of robot form factors already exist, and the boundaries among them are often blurry (for example, Collaborative Robots’s Proxie could be considered an autonomous mobile robot, a cobot, or even a humanoid). It is also likely that more form factors will emerge as robot autonomy improves. If legislators define the scope of regulation according to the form factors that exist today while attempting to address challenges presented by higher levels of autonomy, many bills will come with a short countdown to obsolescence.

To help address this issue, we’ve come up with a detailed classification for robots, complete with a list of legislative definitions that legislators can slot into bills. We hope that this will be a helpful resource for policymakers attempting to navigate the increasingly significant field of robotics.

Read the full classification framework and legislative definitions here.

Today’s post is authored by Soham Mehta, a research fellow on the Technology & Statecraft team at the Foundation for American Innovation.

Amid growing awareness of AI’s cybersecurity implications, an unusually vulnerable form of critical infrastructure has flown under the radar: local water and sewer systems.

On the Saturday after Thanksgiving in 2023, a screen at a water utility outside Aliquippa, Pennsylvania bore a message: you have been hacked, down with Israel. The attackers, an Iranian Revolutionary Guard-linked crew calling itself Cyber Av3ngers, did not single out this specific station, which regulated water pressure for two small rural townships, because of some hidden strategic value. Instead, the attackers had scoured the open web for a particular model of small industrial computer—the Israeli-made Unitronics Vision-series—located the ones left exposed on the internet at the manufacturer’s default settings, and logged in with the standard password for units shipped from the factory: 1111. At least 11 American targets surfaced in this scan, which included a brewery, an aquatics center, and water utilities like the one in Aliquippa.

This story captures a strange duality about America’s water utilities. On one hand, they are quite decentralized compared to other kinds of critical infrastructure. American water grew up locally, with pipes, treatment facilities, and financing organized around particular communities. As a result, we have about 170,000 drinking-water and wastewater systems, splintered across municipalities, special districts, tribes, co-ops, and private operators; there is no national or even regional control room. Through no plan or intention, but mere historical contingency, this fragmentation became a source of resilience. To take down a water system, an adversary would have to grind through targets one at a time. All that reconnaissance, intrusion, and manipulation repeated by hand might have a payoff measured in a few thousand inconvenienced residents. Essentially, decentralization was a tax levied on attacker labor, and for decades it made the sector too tedious to be worth attacking at scale.

On the other hand, despite their decentralization, water utilities are quite similar to one another on a technical level. Much of the sector relies on a recurring set of manufacturers and product families to source their operating technology—the computers and software that runs the physical plant equipment. As operators have wired the aging controllers that run their pumps, valves, and chemical feeds into ordinary IT networks, some of those systems have become reachable through the internet or through connected municipal networks. This, when coupled with the system’s technical redundancy, has made water facilities a new, appealing attack surface which adversaries have increasingly exploited, drawing water utilities into the plane of modern warfare.

These features make our water facilities close to an ideal target for AI-enabled cyberattacks. Agents are perfect for tasks where the work is repetitive, the targets are many, and each one covers too small of a population to be worth a human’s time. That is what makes the sector’s near-absence from the debate over AI and critical infrastructure so striking. The conversation gravitates to flashier targets such as the grid, financial infrastructure, gas pipelines, or hospitals, while humble, local wastewater plants draw a fraction of the attention and money. The cruel irony is that the decentralization that once shielded the sector now mostly handicaps it. Agents ease the labor burden it imposes, but what remains is a headless sector of thousands of utilities that must each find and patch their own vulnerabilities, one at a time, against an adversary that no longer has to.

A crash course in sewers

For our purposes, a water utility can be understood as two linked systems. The drinking-water system draws water from a river, reservoir, or well, treats it, stores it, and delivers it to homes and businesses. The wastewater system collects what comes back through sewers, removes contaminants, and releases the treated water into a river or other receiving body.

A lot of this work has been automated. Across treatment plants, storage tanks, wells, sewer networks, and pumping stations, computers continuously monitor conditions and operate physical equipment:

• Sensors measure water pressure, tank levels, chemical concentrations, and whether equipment is functioning

• Pumps move drinking water through distribution systems and sewage toward treatment plants

• Valves control where water or sewage flows

• Chemical-feed systems add disinfectants and other treatment chemicals

• Aeration blowers pump oxygen into wastewater so microorganisms can break down sewage

• Lift stations pump sewage uphill where gravity alone cannot carry it to the treatment plant

At the base of this system are small industrial computers called programmable logic controllers, or PLCs. A PLC receives information from sensors and carries out basic commands such as starting a pump, closing a valve, adding more disinfectant, or triggering an alarm. The Unitronics device compromised in Pennsylvania was one such controller.

Above these controllers sits the SCADA (Supervisory Control and Data Acquisition) system, which gathers information from equipment scattered across the utility and presents it to operators on a single graphical control panel. Although none of this requires the public internet, a town may need to monitor an unmanned pumping station miles away, while an equipment vendor or outside contractor may need to diagnose a malfunction without driving to the site. Utilities therefore connect pieces of the control network through ordinary municipal networks or remote-access software. When those connections are poorly separated or an operator screen is left online, an attacker may be able to reach through the same digital doorway intended for legitimate maintenance.

We can understand the stakes of hardening our sewers by examining what happens when a given part is targeted. If an attacker compromises a utility’s PLCs (as Iran attempted), they may be able to stop pumps, overflow tanks, or alter chemical feeds. In a wastewater system, shutting down lift stations or aeration can cause sewage backups or release insufficiently treated waste into rivers. In a drinking-water system, manipulating pressure, disinfection, or storage can interrupt service and, in more serious cases, threaten water quality. If attackers gain control of SCADA, they can make operators distrust the readings on their screens. Thus, an attack need not make any machinery malfunction; a hack that merely makes a system opaque to its operators would already be deeply disruptive and dangerous.

Why there can’t be a Project Glasswing for sewers

Water utilities are fragmented as institutions, but the technology inside them is drawn from a much smaller and constantly recurring set of suppliers. There is no comprehensive public accounting of vendor market share within American water systems, but the Cybersecurity and Infrastructure Security Agency’s (CISA) vulnerability record gives a sense of the overlap: of 713 industrial-control advisories tagged as affecting the water and wastewater sector between 2010 and July 2026, more than half concerned products from just four companies: Siemens, Rockwell Automation, Schneider Electric, and ABB.1 The same product families recur throughout the advisories.The Unitronics attacks provide a concrete example for this redundancy matters: one model of controller was common enough across otherwise unrelated facilities that Cyber Av3ngers could search for it online and reuse the same default-password attack against multiple American water systems.

At first glance, that shared vendor layer ought to cut the other way and make the sector easier to defend. This is roughly the promise behind efforts like Anthropic’s Project Glasswing, which gave trusted organizations access to Mythos, their powerful cyber-capable model, to search widely used software for hidden vulnerabilities and help develop fixes before adversaries find them. In theory, it seems like you could do the same thing with water: find vulnerabilities in common PLC or SCADA products, notify the manufacturer, and protect every utility using it.

Unfortunately, it is not that simple. A utility’s control system is a site-specific combination of software and equipment frequently implemented or supported by third-party systems integrators. The same controller or SCADA product may therefore sit inside different local configurations, running different software versions and connected to different pumps, sensors, and treatment processes. That means a manufacturer’s discovery of a vulnerability does not translate automatically into thousands of repaired installations. Unlike an update to a phone or web browser, an industrial-control patch must be evaluated against the particular system in which it will operate. NIST warns that patches can interfere with other control software or even introduce new production and safety risks, and recommends testing them offline or with the vendor before deploying them during a planned outage. The utility must therefore identify the affected equipment, obtain the patch, test it, and arrange a safe time to install it. That process can be particularly difficult for a service that is expected to operate continuously. The Government Accountability Office (GAO) found that some water-system operators decline even updates containing vital security fixes because their systems cannot remain offline for extended periods and because an unsuccessful update could interrupt operations.

Nor is there usually a standing cyber team to manage this process. GAO reports that small and medium water systems generally do not employ cybersecurity professionals, instead relying on operators with little cyber expertise or on outside contractors. The EPA’s own checklist flags the absence of an accurate equipment inventory, a named person responsible for cybersecurity, timely patching, control over internet connections, and requirements that vendors disclose vulnerabilities as serious gaps. Compare this with a large bank that can discover a vulnerability and push a coordinated response through one security organization.

Sewer/acc

Let’s start upstream, where the work is easiest and mostly already imagined. Models of the kind Anthropic describes under Project Glasswing could comb the software common to PLCs, SCADA platforms, and remote-access tools for flaws, and manufacturers could turn each finding into a single fix pushed across a product line. This is not unprecedented; CISA already gives water utilities free scanning of their internet-facing systems. So, this discovery layer is worth building, but it is also the part attackers have effectively automated already and it doesn’t matter if no one actually patches the vulnerability.

Then, we have to ensure that this discovery actualizes into action, and here there are already proposals to be considered. H.R. 2594, the Water Risk and Resilience Organization (WRRO) Establishment Act, introduced in April 2025, would have EPA certify a single independent body to write binding cyber requirements for drinking-water and wastewater systems, enforced with penalties reaching $25,000 a day. The model is deliberately borrowed from the electric grid’s reliability regime: industry experts draft the standards, the federal regulator approves them, operators attest to compliance annually, and independent assessments follow every few years. The America’s Water Infrastructure Act (AWIA) of 2018 asks systems serving more than 3,300 people to assess their risks and keep an emergency plan, but it sets no security standard, excludes wastewater entirely, and leaves everyone below the threshold with voluntary advice. The WRRO would fix this problem, but it would not fix the long tail: like AWIA before it, the bill stops at 3,300 people, which means tens of thousands of the smallest systems remain exactly as vulnerable as before.

However, to meet any of these standards, facilities require the requisite personnel. Therefore, the single highest-leverage investment in water-sector cybersecurity is human capital: a corps of people who can assist a plant that has no cyber staff and do the work of inventorying the devices, changing the passwords, patching, and testing it without shutting down the treatment process. There are templates for this kind of program. For example, there is the USDA-funded circuit rider, a roving specialist who solves operational problems no single small town would staff for. There are proposals that would replicate this model and expand the number of systems that receive threat warnings, namely the Cybersecurity for Rural Water Systems Act of 2025 and H.R. 2344. However, both should be funded at a level that matches the size of the problem: not tens of millions of dollars, but hundreds.

Cloacas Tuemur

The Romans had a goddess who lived in the sewer. Her name was Cloacina, and her seat was the Cloaca Maxima, the enormous drain that pulled the entire discharge of the city down into the Tiber. This was a civilization that did not deify anything low. They had no god of the armpit, no god of the dropped coin. But when they looked at the sewer, they decided that something holy lived down there, and they were right. The Romans understood something we have worked very hard to unlearn: that a nation is only ever as free as its plumbing.

But we can’t forget about it, lest we fail to defend it. Just ask the doctors: More than eleven thousand of them, polled by the British Medical Journal, were asked to name the greatest medical advance since 1840, and they did not say antibiotics, or anesthesia, or vaccines, or the discovery of the structure of DNA. They instead said sanitation. There were cities, not long ago, that chose their leaders on the strength of a promised drain. For most of human history, this was the whole of the war, and we won it.

That victory is what now sits exposed. To ensure that AI-enabled cyberattacks cannot reach in and undo something as plain and as sacred as clean water for millions of Americans, we have to do the unglamorous thing: hold every facility to a single standard, the enormous and the tiny alike, and actually pay for the tools and the people it takes to guard water systems of every size. Cloacina had priests. The least we can do is fund the budget.

Most factories are built to be used by humans. Conveyor belts are at hand height, walkways and stairs are designed for human maneuvering, warning lights and alarm systems are meant to be perceived by humans, etc.

Automation has, so far, mostly been built around a human-shaped environment. Industrial robots typically operate in fixed cells in order to prevent human injury, and even automated systems are still meant to facilitate human monitoring and involvement. OSHA guidelines for the deployment of industrial robots specify that they should be enclosed in specific parts of a factory with guardrails to protect human workers, operate at reduced speeds around humans, and be de-energized for maintenance, among others (at least 26 different standards dictate how to safely deploy industrial robots around humans). While industrial robots go back to the ’50s, their roles in industry have stayed somewhat narrow: industrial robots mostly perform hard-coded, repetitive tasks, like placing identical panels on identical car frames.

Humans still do many essential tasks in manufacturing. Even in the most automated industries, the management and organization of factory floors is still done by humans, much of the coordination across machines is done by humans, and many discrete tasks, like sewing fabrics, are still done almost entirely by humans.

Humanoids are useful as transition labor

Because factories are human-shaped, humanoid robots can usefully substitute one-for-one into human spaces without much retrofitting.

In the short-run, it will probably be valuable to deploy humanoids into factories: once the cost of a humanoid falls below the cost of human labor, or a humanoid sufficiently improves speed or quality that it’s worth an extra cost, it would be economical for factories to sub humanoids in for human labor. And doing so theoretically wouldn’t take much time or extra cost – factories are already designed for human bodies, and wouldn’t require much redesign to accommodate humanoid labor. For example, while humanoid capabilities are still limited, humanoid robots have been deployed in warehouse settings to move containers, using the same infrastructure and equipment as humans.

Additionally, humanoids are, in some ways, easier to train models for. In particular, lots of data for robotics comes from motion data captured (placing sensors on humans doing real-world tasks) or from teleoperation of robotic systems by humans. It’s easier to port this data over to a humanoid form factor, since it is based on human-shaped motions.

But humanoids are not the electric dynamo

When factories first replaced steam engines with electric motors, they kept the same layout for the factory floor, with many-storied buildings organized around a central engine. This led to only minor productivity improvements, because machines had to be close to the central engine rather than organized according to the production process. Real productivity gains only came once engineers entirely redesigned the floor plan around the natural flow of the production line, which could only be done once machines had their own power source.

Humanoids are probably more like swapping steam engines for electric motors than redesigning the factory floor. It would be surprising if the human form factor is optimal for most tasks. Indeed, there are already many examples of humanoids trying to do tasks that can already be performed more competently by non-humanoid robots (see, e.g., humanoids shoveling snow, vacuuming, and driving cars).1

AI integration could reorganize how factories work

Unlike humanoids, industrial robots are able to do many of the core subtasks that are necessary for manufacturing, like welding, drilling and fastening, and moving heavy parts. However, there are many things industrial robots cannot do, including tasks that require particular dexterity, coordinated motions with other systems, or complex planning. AI integration into industrial robots could potentially change that by enabling new capabilities.

First, AI integration into robotic systems could allow robotic systems to adapt to changing production processes. Currently, to deploy an industrial robot, a factory typically needs to make sure that every widget going down a production line is in the same place, with the same orientation, so that the hard-coded motions of the industrial arm will interact properly with the widget each time.2 This is expensive and time-intensive, and is why most of the cost of installing an industrial robot is the installation and setup cost – not the robot itself. AI integration into robotic systems could enable industrial robots to handle more complex or variable production processes, and do so with lower setup costs. A few concrete examples of manufacturing processes where AI integration might improve productivity:

• Textile processing: Fabric is limp and deforms unpredictably, which has made automated sewing one of the most difficult industrial processes to automate. Currently, attempts to automate textile processing work around the problem by doing things like chemically stiffening the fabric so that rigid, hard-coded robots can handle it like sheet metal. AI-driven perception and force control could let robots manipulate fabric directly.

• Wire harness assembly: Assembling wiring for a car is one of the last almost-entirely-manual processes in automotive manufacturing. Deformable linear objects like wires have historically been difficult for industrial robots to handle, and the combination of deformable wires with complex wire layouts has long made it the hardest assembly job to automate. Recent efforts have made some progress with integrating simple AI systems into industrial robots to enable them to handle parts of the wire harness assembly process, and further AI progress could enable significantly more automation of the process.

In particular, greater AI capabilities in industrial robots could enable robots to perform tasks that are especially dangerous to humans but difficult to fully automate due to variability:

• Foundry fettling and grinding: Cleaning excess metal off castings exposes workers to heat, noise, and respirable crystalline silica. Despite this, it remains labor-intensive and hazardous because each casting comes out slightly different, which is more variability than can be properly handled by hard-coded robotic grinding.

• EV battery disassembly: Taking apart battery packs for recycling exposes workers to risks like electric shocks, explosions, and fires, yet it remains largely manual because pack designs vary so much across manufacturers and generations.

• Shipyard welding: Ship welding, especially inside hull blocks, exposes workers to heat, dust, and fumes in confined spaces, but conventional robotic welders struggle with the variable geometry and cramped spaces of ship structures. Shipyards are starting to deploy AI-guided welding robots in narrow use cases, but still rely on human welders in most cases.

Additionally, AI integration could allow coordination across multiple robotic systems. One model of an advanced factory is a centralized AI controller that orchestrates the motions of multiple industrial robots synchronously without the need for human involvement. This level of coordination would enable more complex production processes than a given robot could support. Simple versions of this already exist in the form of highly automated lights-out factories, including robot manufacturer FANUC’s highly automated robot-assembling factories and Xiaomi’s phone-assembling plants, both of which rely on lots of industrial robots operating with minimal human supervision. However, the motions of the robots in these factories are highly repetitive with minimal variability – any change in the production process would require humans to reprogram the robots in the factory. AI-driven factory orchestration would enable both more complex and more variable production processes at a factory level.

The building blocks of future manufacturing already exist

Some of the basic components of industrial robots – joints, grippers, precision actuators, and end-effectors – are probably going to be needed in basically any manufacturing setting, as will the core competency of coordinating multi-axis movement. It’s hard to imagine advanced manufacturing that doesn’t involve, e.g., joints and grippers.

This is true even of humanoids. A humanoid is, functionally, a couple of manipulators mounted on a movable system. The parts of the humanoid that can do welding, fastening, or handling are arms built from the same components as an industrial robot, like precision reducers; the legs and torso mostly serve to carry the manipulators to the workstation.

And for an important segment of manufacturing, the human form factor is ruled out entirely. Humans cannot lift 2,000kg, transfer semiconductor wafers without damaging or contaminating them, or operate in high-heat environments. These are also tasks not done by mobile robots without arms (e.g., warehousing AMRs) – they fundamentally require durable manipulators.

Manufacturing in the future will probably look quite different from the factories of today, in the same way the factories of the electric dynamo looked different from those a generation prior. Future systems might be multi-armed, mobile, more articulated, integrated into larger coordinated systems, etc. It’s hard to know exactly what manufacturing in the future will look like, but its building blocks will probably come from industrial robots.

Over the last year, people at the White House have been asking me when artificial intelligence is going to take all our jobs—sometimes jokingly, sometimes deadly seriously. They asked it in hallways, and in meetings, and once or twice in the time it takes an elevator to climb three floors.

And for a year I never quite knew where to look on the wall or floor or ceiling as I told them I didn’t think AI would leave them unemployed. The people asking had the safest jobs of any—they have a line item in the federal budget—and beyond that, the evidence for broader layoffs was thin.

Hunting for Apocalypse

Some of the evidence showing job loss was unlikely came from my own desk. A coauthor and I went looking for the tremors of the AI apocalypse in the place they ought to show up first: the workplaces most exposed to AI. In a neatly controlled study, we found essentially the opposite.

We compared each local industry to the same industry in other states, knowing that exposure to AI varies with the work a place happens to do: the oil-and-gas business in Texas leans on more coders and marketers than the oil-and-gas business in Oklahoma, for instance. With enough industries and enough states, you can pull the effect of AI exposure apart from whatever else is moving a given state or sector. Neat trick.

What we found surprised us. More exposed local industries had posted not only substantial gains in output but impressive gains in employment as well (Johnston and Makridis, 2026). Where a sector’s exposure to AI rose by a standard deviation, output ran about 7 percent higher and employment about 4 percent higher—good news all around.

If the machines were coming for our jobs, we would have expected falling employment amid rising output. Instead, the two climbed together. What this suggests is that AI has been making workers more productive and therefore more valuable—employers want to hire more workers when benefited by AI. Thus a sizable portion of all that new output found its way to additional workers rather than the technology arriving as a blizzard of pink slips.

The theory here is also strong, fitting an old pattern in economics called Jevons’ Paradox: When something becomes more efficient, we tend to use more of it, not less. When coal can be used more efficiently, you might think we need less coal—one lump could do the job of three. But we actually used more—not less—because our demand for coal was elastic (that is, demand is quite sensitive to price). Seeing the same pattern among workers in the age of AI suggests that employer demand for human tasks is also elastic: they demand actually more human labor when augmented by AI. Phew.

And I Was Not Alone

Other researchers with different designs were finding similarly non-apocalyptic patterns.

One tracked how quickly firms on both sides of the Atlantic were actually putting these tools to work, then asked whether all that adoption had reduced the employment numbers at all. It hadn’t, not yet, not in the United States and not in Europe (Bick et al., 2026). The displacement everyone was bracing for simply wasn’t apparent there in the data.

Another used detailed survey data in Denmark, where workers took up AI early and the government records very nearly everything. Researchers surveyed 25,000 people across 11 exposed occupations and 7,000 workplaces, then matched their answers to administrative records on the hours and earnings of each worker (Humlum and Vestergaard, 2025). But contrary to the Apocalypse Hypothesis, the effect of AI adoption on actual earnings, and on actual hours worked, was a precise and stubborn zero.

Something Amiss

But as the year went on, I became less certain that nothing was amiss. What unsettled me was not a forecast: it was that the labor market for young people looks very strange.

First, computer science majors are clocking some of the highest unemployment rates of any college graduates, right up there with anthropology and art history (NY Fed, 2026a). Historically, the most technical majors were also the most employable. And computer science just happens to be a skill that AI excels at, being textual and predictable in nature.

Second, college grads in general are not enjoying some of the labor market benefits they long had. For decades, recent college graduates were systematically less likely to be unemployed than the average American worker. And the gap was not small: the broader workforce carried something like a 30 percent higher unemployment risk than the young and freshly credentialed (NY Fed, 2026b).

The recent graduate employment advantage hasn’t just shrunk, or disappeared: it has flipped.

Young college grads are now trailing behind the workforce average that they used to lead. They now carry an unemployment risk about a third higher than workers as a whole (NY Fed, 2026b).

What’s more, young college grads in the past tended to have more resilient employment than peers without a college degree. When unemployment went soaring among non-grad 20-somethings, it remained low and anchored for recent grads. Now, somewhat ominously, their rising unemployment rate is perfectly parallel with other young people’s.

While there are a few potential explanations—the emergence of remote work, scarring from covid isolation, and the learned brittleness of campus culture—most observers gravitate to the elephant in the room: AI is a lot like a young 20-something employee, but it remembers what you say and never rolls its eyes when you say it.1

Meanwhile, Claude and Grok are much better substitutes for young college graduates than they are for senior managers or neighborhood plumbers. The first-year analyst summarizing a document, drafting a memo, or cleaning a dataset is doing precisely the work a model now does instantly and for the price of electricity. Could that be the explanation? Could an AI chatbot be quietly sawing off the bottom rung of the ladder while leaving the higher rungs relatively untouched?

The First to Feel It

In an image fit for cinema, miners plumbing the depths of the earth would carry a lamp in one hand and a bird cage in the other, down into the coal mines. The little yellow bird, smaller and quicker to feel the air go bad, would stop singing while the men still felt fine.

In other meetings, the White House has asked me who the canaries of this technological change are. The ones who fall silent first seem to be the very young, and the people who work for themselves.

The Freelancers Go Quiet

The first canary was the freelancer, and you can watch this one from two perches: the work that gets posted, and the money that gets spent.

From the first perch, economists studying one of the large global freelancing platforms watched the postings for the kind of work a chatbot can do, writing and coding, fall 21 percent within months of ChatGPT’s release, measured against manual jobs no model can touch (Demirci et al., 2025). When the image generators arrived, the postings for illustration and image work fell 17 percent in the same period.

From the second perch, an analysis of corporate spending found that the share of company budgets going to freelance workers fell significantly as companies scaled their AI spend (Stevens, 2026). More than half of the firms that had hired freelancers in 2022 had stopped entirely by 2025.

The Youngest Go Quiet

The second canary was young workers.

A team at Stanford went into the payroll records of ADP, the largest payroll processor in the country, and followed millions of workers month by month from 2021 into the fall of 2025 (Brynjolfsson et al., 2025). Once they had accounted for whatever was happening to each company as a whole, a pattern surfaced that was hard to explain any other way.

Workers between 22 and 25, the just-hired and the just-graduated, saw their employment fall 16 percent in the occupations most exposed to AI, while their older colleagues in those same occupations held steady or kept growing.

What was strange is that the young were not taking pay cuts—those who had jobs saw rising wages. They were simply less likely to be hired to begin with. (This pattern of rising wages and falling employment is not consistent with the story of falling demand for young pros, where wages and employment would move in tandem.) And the drop was steepest exactly where the technology does the work instead of helping with it, in software development and customer service. The researchers tried to make the finding disappear. They dropped the technology firms; they dropped the work-from-anywhere jobs; they ran the same test on the years before the models arrived. The effect persisted.

I didn’t initially know exactly what to make of this finding, mostly because the same patterns were not visible in aggregate data—the employment rate of recent computer science and marketing grads did not change significantly. And maybe the ADP data picked up on something that wasn’t in the labor market more generally. Maybe the sample was not representative because it ignored entering firms that were picking up the slack left by stable firms.

But then a second team, working from an entirely different dataset and different research design, found the exact same thing. They read the résumés of 62 million workers across roughly 285,000 American firms and used job postings to tell which companies had begun adopting generative AI, flagging a firm as an adopter once it started hiring AI-adoption specialists (Hosseini and Lichtinger, 2025).

At the time of adoption, junior employment fell while senior employment kept growing. And it fell not because anyone was being let go but because the firms had quietly stopped hiring young people. Young people weren’t kicked out en masse; they were simply less likely to ever be invited in in the first place. The authors call the pattern seniority-biased technological change, but they could have called it boomer-biased technological change, a sorting of the workforce in which the people who arrived first are kept on and the people arriving now are turned away at the threshold.

No Slack To Begin With

While young workers are especially exposed to AI, the rung they’re reaching for was already quite worn, cracked, and ready to give way.

For instance, a generational housing shortage has made home ownership increasingly difficult for young people (while making the homes of older generations ever more valuable—a terrible transfer of wealth). The price of a typical home against a typical income sits near its highest in decades, the payment on a first mortgage now eats the largest share of income in 40 years, and home ownership among those under 35 runs significantly below where it stood in the past, and this for a generation more credentialed than any before it.

Those credentials are another thing. The real net cost of a four-year public degree has roughly doubled since 1980. And for that increase, young people now carry $1.7 trillion in federal student debt, yoking some 43 million borrowers. Meanwhile something like four in ten recent graduates are working in jobs that never required the degree they are still paying off.

At the same time, the public purse has tilted, steadily and without anyone quite deciding that it should, toward those who already have the most behind them. Washington spends nearly six times as much per person on Americans over 65 as on those under 18, though the young are doing more poorly than the old had at their age. And the cost of the past has come due in the present, which the young will bear disproportionately: federal net interest alone has now passed $1 trillion a year, borrowed against a future these young people will spend their working lives working to repay.

You can see all of it in how they live, if you are willing to read it as something other than a flaw of character. A record 52 percent of those between 18 and 29 were living with their parents in 2020. Today’s young adults hold meaningfully less wealth than the boomers did at the same age, and something like 40 percent less than Gen X had managed by then (Kurz et al., 2018). Among young men especially, the money that might once have gone toward a down payment now goes, in unsettling volume, into sports books and cryptocurrency, the only games that still seem to promise a fast way up. Marriage has fallen to the lowest rate on record. And in 2024 the total fertility rate dropped to about 1.6, the lowest in the nation’s history and well beneath the level a country needs simply to maintain itself.

I do not read those last numbers as recklessness or as some failure of nerve. I read them as a generation improvising. They are placing small bets, staying home, putting off the marriage and the house and the child, because the footholds their parents relied on to climb into adulthood have been filed smooth one by one.

The Better Question

So where does this leave that blank-looking economist who kept not knowing where to look? Less sure that everything is all right.

The miracle is real. AI is doing what would have looked like magic in The Jetsons or Star Trek; the breakthroughs and the added years of life are real. But an aggregate is a cold thing to hand a 23-year-old who can feel the bottom giving way beneath her, and who reads the good national numbers the way you’d read fine weather in a country you no longer live in.

We don’t know what the future holds; anyone who says they do is selling something. Today’s troubles could be Covid, or remote work, or AI; what we can make out is only a shadowy outline that might be lasting dislocation, a passing blip, or a statistical mirage. But here is the thing about a canary: it goes quiet while the air still seems fine to everyone else, and you do not wait for proof before you climb toward the surface. The question was never whether AI would take all the jobs. It is whether—however a person loses their footing—we will have built something to help them find it again.

So far, we have not. What that would take is what I mean to turn to next.

On the morning of July 4, 1917, a demolition crew arrived at the foot of the Wardenclyffe Tower. The 187-foot lattice structure was Nikola Tesla’s most ambitious and most ruinous project—the first node in a global wireless power network, funded by pitching J.P. Morgan the more digestible promise of a transatlantic communications station. When Morgan grasped the strangeness of what Tesla really intended, he pulled his money. No one else would touch it. The tower stood unfinished, the lab went dark, and Tesla slid into decades of debt and isolation.

The difficulty was that Wardenclyffe had never really belonged to the world of engineering. It was a creature of conviction. When the press demanded proof of concept, Tesla offered them instead a kind of gospel, writing that civilization’s highest calling was to harness the earth’s energy and beam it, free of charge, to every corner of the globe. Wardenclyffe was meant to be that dream’s first physical expression. But the useful irony of Tesla’s predicament was that several of his most valuable inventions—high-frequency alternating current and early wireless signaling—were developed as intermediate steps toward a goal whose premise was, even in his own time, understood to be dubious.

A Taller Tower

It’s fitting then that on February 5, 2026, Tesla CEO Elon Musk appeared on the Dwarkesh Podcast and declared that within 3 years, space would be the cheapest place to run AI data centers. Days earlier, SpaceX had filed with the FCC for authorization to launch an unprecedented one million satellites as orbital data centers,1 framing the effort as humanity’s “first step towards becoming a Kardashev II-level civilization–one that can harness the Sun’s full power.” The application came right as SpaceX finalized its acquiring xAI.

Much ink has already been spilled on why this is, to put it mildly, premature. The economics are punishing: although solar energy is more plentiful in space, orbital data centers are projected to cost roughly three times their terrestrial equivalents unless launch prices fall by an order of magnitude, and hardware would degrade rapidly in the unforgiving environment. The filing is silent on these questions, containing no technical specifications, no deployment schedule, and no cost estimates. But Musk has since offered a rough first sketch: a “mini” orbital compute satellite with exceptionally long solar arrays, paired with a comically small radiator, often the limiting component to prevent chips from overheating. Suffice it to say, the presentation did little to resolve the core economic and engineering doubts.

Musk’s ambitions, like Tesla’s, are largely vision-driven. For Musk, SpaceX exists to make humanity multiplanetary, and each venture along the way—Falcon 9, Starlink, and now orbital data centers—seeks to monetize intermediate steps, with each new revenue stream funding the next stage. Orbital data centers are Starship’s Starlink, a use case that could generate the cash and industrial capacity to keep climbing. And the bet may not be wholly indefensible. Terrestrial data center costs are rising fast, with over $160 billion in U.S. projects blocked or delayed by local opposition since 2023, narrowing the gap. And where Tesla had one financier and no fallback, Musk commands the world’s most valuable private company and the only operational super-heavy-lift rocket on Earth.

Our contention is that a well-resourced, ideologically-driven actor spending aggressively into a speculative frontier can generate demand signals, train workforces, and pull supply chains into existence that the market, left to its own tendencies, would never produce. This creates a “crowding-in” effect where significant upfront capital catalyzes additional activity by de-risking a sector, improving expectations, and creating complementary inputs. Even a partial push by Musk or other orbital compute projects like Google’s Project Suncatcher or the Nvidia-backed Starcloud to build orbital compute would set in motion a cascade of intermediate developments that matter regardless of whether a million satellites ever reach orbit.

The Wardenclyffe may never transmit power; what matters is what gets built on the way up.

Reshoring Precision Optics

Although Starlink already uses laser links to route internet traffic across its constellation, synchronizing computation across a distributed data center is far more demanding. This requires multi-terabit throughput, ultra-low latency, and far more links per satellite. The number of optical transceivers required, and the performance demanded of each, would be orders of magnitude beyond what Starlink currently possesses.

The United States cannot currently manufacture these at scale. The most intricate and expensive segment of photonics manufacturing—packaging and assembling individually fabricated optical components into a finished module—has largely been offshored, with Asia holding the majority of the global manufacturing footprint. In 2025, every transceiver in a Google TPU pod was made in China, and roughly 70% of Nvidia’s came from two Chinese companies. Beijing has made photonics a strategic priority and sees it as one avenue to sidestep U.S. chip export controls—that is, by pairing advanced photonics with legacy hardware that isn’t restricted. Optical transceivers also run firmware, so a compromised module can spoof identity, kill links, or enable deeper intrusion. When most transceivers come from a country with a history of embedding backdoors in firmware, that poses a serious security risk.

An orbital data center buildout would force this problem open. SpaceX’s classified government contracts and the dual-use nature of its constellation effectively preclude sourcing critical components from Chinese manufacturers. Given SpaceX’s pattern of vertical integration—roughly 85 percent of components are built in-house—it would almost certainly build domestic optical packaging and testing lines. These effects would propagate through three channels:

Workforce

SpaceX functions as an extraordinarily intense training ground, and people leave. As of January 2026, SpaceX alumni have founded 141 startups that have raised over $10.6 billion, and the crowding-in mechanism is already at work: In February 2026, three former SpaceX engineers who developed optical communications links for “compute-hungry” Starlink satellites raised a $50 million Series A for Mesh Optical, a company explicitly aimed at building the largest optical transceiver manufacturing footprint outside of Asia. An orbital data center program would train optical engineers at multiples of the current Starlink workforce, dramatically increasing the pipeline for exactly this kind of spinout.

Upstream suppliers

Even at 85 percent vertical integration, SpaceX still relies on over 3,000 suppliers, so it would likely purchase specialized inputs and optical test and measurement equipment. When SpaceX creates significant domestic demand for this equipment, suppliers have reason to establish U.S. service centers, training programs, and application engineering teams. That infrastructure, once built, is available to any American company, including new entrants and startups like Mesh, at lower cost and shorter lead times than sourcing from overseas.

First-mover advantage

China’s foothold in transceiver manufacturing was established in part because Huawei pioneered linear-drive pluggable optics, a design simplification that greatly reduces cost and power consumption. The next architectural transition from what are known as pluggable transceivers to co-packaged optics is still in its early stages, and the manufacturing processes are not yet locked in. A domestic buildout that produces next-generation optical architectures could establish American dominance before the market consolidates.

Radiation-Tolerant Compute

Every chip in an orbital data center would operate in a radiation environment that terrestrial hardware was never designed to survive. The SpaceX filing is exclusively for low Earth orbit (LEO), due to the added launch cost, networking challenges, and harsher conditions of higher regimes like geostationary orbit (GEO). Even in LEO, cosmic rays and solar events continuously bombard silicon, causing “bit flips” that corrupt operations and—in extreme cases—frying a whole chip. Any orbital compute platform would need processors that can withstand these effects, through either hardened-by-design chip architectures or novel shielding materials.

The problem is that the domestic industrial base for this kind of hardware is surprisingly thin. In recognition of this fact, Musk recently floated a “Terafab” in Austin to produce these advanced chips for SpaceX and just listed openings for engineers at the proposed facility. Indeed, in 2025, the entire global radiation-hardened electronics market was valued at roughly $2 billion, which is a rounding error in the $600 billion-plus broader semiconductor industry. The Department of War’s Trusted Foundry program, which guarantees access to secure domestic fabrication for sensitive military applications, covered only 2 percent of military chip purchases as of 2021.

The reason is simple: demand. The Department of War tried to stimulate the industry by growing its microelectronics budget to over $1 billion in 2024 in areas where private foundries “lack the incentives or scale to develop solutions independently,” including radiation-hardened chips. Still, the military needs radiation-hardened chips in quantities of hundreds to thousands—simply not enough to sustain the production lines that a healthy industry requires. An orbital data center constellation would totally change the arithmetic. SpaceX would need domestically produced radiation-tolerant processors at a volume that would, for the first time, create a commercial-scale demand signal to build out American industrial capacity. Companies like Cosmic Shielding Corporation, whose Pentagon contracts currently max out at a meager $4 million, would see a qualitatively transformed demand signal, and their expanded capacity would benefit both private and military use cases.

Just weeks from Musk’s declaration, we can already see the infancy of a crowding-in effect. On February 25, Nvidia CEO Jensen Huang seemed skeptical on the economics of orbital data centers. However, less than three weeks later, Nvidia unveiled plans to build the first major purpose-built GPU module for orbital data centers, which would yield 25 times more compute for space-based inference than the H100 that Starcloud first put in orbit just months earlier. Although it’s unlikely that such a major push into a new vertical was planned in just three weeks, Musk’s aggressive socialization of orbital compute created a permission structure to seriously discuss the breakthroughs that will be needed, galvanizing the world’s most important chipmaker to decide the market was real enough to publicly commit.

Expansion of Low-Level Software Controls and Chip Governance

Once launched, orbital chips cannot be inspected, swapped, or physically patched. That constraint would push more of a chip’s operating logic into updatable firmware and low-level control software, making remote updates one of the only ways to improve or constrain device behavior after deployment.

This expansion in the reach of low-level software would matter not only for efficiency but for security and governance. In orbit, remote updates would become one of the few tools left to retune device behavior, refine low-level scheduling, and improve fault recovery without replacing the chip. For national security, the strategic spillover is that the same software-mediated update paths can make chips more governable after deployment, especially in U.S. export-controlled or restricted settings. Low-level software has already been used for compute governance. In 2021, Nvidia announced a new RTX 3060 driver that would hamstring performance by 50 percent if Ethereum cryptocurrency mining was detected (in a plot twist of cat-and-mouse, users later jailbroke this limitation using a leaked beta driver). This episode didn’t demonstrate omnipotent vendor control—that’s a good thing. But it did highlight that AI accelerators are mediated by low-level software layers that can classify workloads, enforce policy, and be revised after sale. Space-based data centers would intensify investment in exactly these capabilities, spawning further feature-rich chips whose operation is mediated by signed firmware, attestation, and policy-controlled updates. On Earth as in orbit, that would give U.S. actors more ways—when necessary for national security—to enforce sanctioned operating modes long after deployment.

Power-Flexible Data Centers

Moving to space would also catalyze a power-flexible regime for data centers, which would address a major challenge at home: helping integrate data centers into the U.S. electric grid. In 30-degree LEO (one of the inclinations requested by SpaceX), satellites circle the planet roughly every 95 minutes, of which 30 are spent in eclipse and thus deprived of solar irradiance. Spacecraft bridge that gap with batteries; that is standard practice today. But powering a compute cluster through every eclipse is daunting: a 1-megawatt facility, for example, would require 500 kilowatt-hours of stored energy to sustain full output through eclipse. Meanwhile, the largest publicly-known battery system in space today is on board the massive ISS and rated at only 360 kilowatt-hours.

This reality would reward a power-flexible model of distributed computing, where a satellite preparing to enter eclipse can throttle down its power, checkpoint workloads for later (temporal shifting), delegate workloads across the constellation (spatial shifting), or combine any of these three, thus avoiding disruption to high-priority, latency-sensitive workloads. The result would be a constellation-scale orchestration. This would feed innovation in terrestrial ventures, which already show promise: in a National Grid trial earlier this month, startup Emerald AI’s software cut the power draw of a 96-GPU Nvidia Blackwell Ultra cluster by more than a third in under 60 seconds without disrupting priority workloads. Orbital data centers would stimulate this market, supercharging the development of intelligent schedulers, distributed computing, and power management.

Hear Us Out. Please.

“Hype” has become a dirty word in technology, and often deservedly so. At its worst, it means fraud and vaporware. But, at its best, it is a refusal to accept that the world as it is exhausts the world as it could be. The most consequential leaps in human capability have never emerged from prudence. They have emerged from the collision of an almost childlike insistence that the frontier is closer than anyone believes with the mature scientific apparatus to actually reach for it. We have fallen into a cultural malaise that treats this kind of ambition as naïveté, a learned cynicism that mistakes the cautious for the wise. America’s quintessential (literal) moonshot—the Apollo program—was pursued on an accelerated timeline that no cost-benefit analysis could justify, driven by a combination of geopolitical urgency and sheer will, and it reshaped the industrial and technological trajectory of a generation.

We are not arguing that Musk’s plan will work. We are arguing that the attempt is worth defending, because the things that must be built along the way are things we need regardless. There is something clarifying about an impossible goal: it reveals, in the striving, capacities that no reasonable objective would ever have called into existence. We should not immediately scoff at our most ambitious builders who, in reaching for something improbable, might deliver what no one else is trying to build.

Subscribe now

What pushed them there? Start with PJM’s latest capacity auction.

Subscribe now

The bottom falls out at PJM

In mid-December, PJM ran its annual capacity auction. This auction is supposed to answer a boring question: three years from now,1 will there be enough firm capacity on the system to serve peak demand?

During weeks like this one, where an extended cold snap has triggered Energy Emergency Alerts around the country, we can see why sufficient capacity on the grid is so important. And according to PJM’s recent report for the 2027/28 delivery year, the region is coming up soberingly short.

For the first time in its history, PJM reported that the whole RTO has failed to meet its reliability requirement; it procured about 6.6 GW less than what was needed to meet PJM’s Installed Reserve Margin—the margin of safety included for reliability. PJM emphasized that clearing short of the reserve margin does not mean for certain that there will be outages, but “maybe” is not exactly a reassuring turn of phrase when it comes to blackouts.

Meanwhile, PJM’s report lists a whopping clearing price of $333.44 per MW-day. That makes it the third straight auction to set a new record price, which has risen by over one thousand percent compared to three years prior.

The situation is under [price] control

What’s more, this number has in fact been significantly suppressed by the fact that a recent FERC-approved settlement imposed a temporary “price collar” (a cap and a floor) on PJM’s last two auctions. That collar was the product of pressure from governors in PJM states, who argued that consumers were headed for an avoidable price spike while PJM struggled to find a lasting fix.

We know what the market-driven price would have been, though, as PJM published a “no cap-and-floor” counterfactual for the same auction. In that scenario, the clearing price would have been roughly $530/MW-day, meaning that the reality of our supply constraint is even worse than the headline.

This constraint should concern ratepayers. If PJM is genuinely short on firm capacity, suppressing the clearing price can also suppress the incentive for new supply to enter (or for existing resources to stick around) at a moment when the system desperately needs more.

Loudest among the leaders arguing for the price cap was Pennsylvania Governor Josh Shapiro, who first pushed the idea in 2024. Shapiro has emerged as something of a national leader (as well as a likely presidential candidate), and others across the region are following his lead.

Indeed, affordable energy has been the biggest issue on the ballot in some states, arguably deciding races like New Jersey’s gubernatorial win for Mikie Sherrill late last year. It’s no surprise then that in response to this crisis, Democrats and Republicans alike might grasp for a bigger lever and take this issue to the White House. In fact, that’s exactly what several governors did last week.

Governors take PJM problems to Washington

On January 16, Governors Josh Shapiro (D-Pa.), Wes Moore (D-Md.), and Glenn Youngkin (R-Va.) convened with the Trump administration to announce an unusually direct intervention into PJM’s market design. Notably, one key stakeholder wasn’t in the room for the announcement: PJM itself.

Why did these governors—including prominent Democrats who have made hay out of pushing back against the Trump administration—go to the White House? Because governors can’t order PJM to change its market rules, since PJM’s tariff lives under federal jurisdiction. All action must run through FERC. For instance, PJM must first make a filing at FERC, or FERC itself must launch a proceeding. A White House intervention is a top-down way to force action.

According to a DOE fact sheet that followed the talks, the White House’s regulatory push has two marquee components.

1. Extend the region’s price collar on capacity.
   This one is pretty straightforward: the plan is to prolong the price cap and floor in effect at PJM.

2. Create a 15-year procurement pathway for new power plants.
   This is more novel. The administration is urging PJM to “accelerate development of reliable power generation by providing 15-year revenue certainty for new power plants.” Traditionally, PJM has held its capacity auction three years ahead of the year being targeted. But even with a multi-year lead, the capacity auction’s timeline is too short to reliably bring major new plants online. Generation companies can easily take over a decade to finance, plan, build, and launch a whole new power plant. The one-time emergency auction that DOE proposes would provide a long-term contracting tool on a 15-year term, creating an additional incentive for new build, atop PJM’s annual rhythm of capacity commitments. In the long run, the goal is to make Mid-Atlantic electricity more “reliable and affordable” by “building more than $15 billion” of new reliable baseload generation.

You compute, you pay in full

How do they propose paying for that new build? Per DOE:

“Require data centers to pay for the new generation built on their behalf—whether they show up and use the power or not.”

It’s a big deal. Here, DOE is not merely calling on data centers to contribute to meeting their electricity demand, which many a hyperscaler press release has reassured the public they already do. Rather, it’s something far more aggressive.

Consider the status quo. Suppose that a region scrambles to procure and finance new capacity because it expects a 5-GW wave of compute campuses. If 3 GW of those campuses are delayed, or if they use only 2 GW of the steel in the ground that’s been laid, households still get the bill for all 5 GW. But by tying data centers to pay “whether they show up…or not,” DOE is forcing seriousness on the part of developers: if you want PJM to treat your computing needs as real enough to justify new plants, you should be on the hook.

The price collar constrains supply

The push that Governor Shapiro led—and DOE has now extended—to put a price cap on capacity is a rational political response. When prices jump, households and small businesses pay. A price control can relieve that pain, buy time, and let political leaders say, credibly, that they took some sort of action to protect ratepayers.

But it’s a band-aid solution, and that palliative quality is precisely the problem. In a capacity market, high prices are the mechanism by which the system rewards more supply. If PJM is telling you it’s short on firm capacity, then suppressing the clearing price suppresses the incentive to build the next marginal megawatt. It makes today’s bill less painful to open but tomorrow’s shortage harder to solve. Thus, there is a tension between DOE’s proposal to (1) extend the price collar but (2) incentivize $15 billion in new reliable baseload power. The sole solution to PJM’s scarcity is more supply, and only the latter intervention can achieve that.

What happens next

Importantly, nothing announced at the White House changes PJM rules immediately. PJM market changes run through FERC’s oversight, PJM’s stakeholder process, and eventual tariff filings. And recall that PJM has plenty on its plate,2 even if it struggles to deliver competent solutions.

After chronic fumbles, PJM has its job laid out pretty clearly, and the market reform itself is once again in PJM’s court. The White House visit put the—biggest—political thumb on the scale. For state leaders, it’s fingers crossed.

After PJM’s process wound down, FERC stepped in with a related but separate decision that caught many by surprise. On December 18, 2025, the Commission issued an order directing PJM to rewrite its tariff treatment of “co-located load,” and it did so with unusual specificity. Today’s edition explains what exactly FERC deemed so unworkable, what FERC is requiring PJM to adopt instead, and whether that solves the region’s broader large-load challenge.

Subscribe now

The CIFP Process in PJM Timed Out Without a Solution

First, a quick recap on the CIFP. The record of comments was split into several camps. Some parties, including Amazon, wanted demand response, but on a strictly opt-in basis, which would reduce peak load without chilling investment in new compute campuses. Others, including Google, Microsoft, and Constellation, argued that PJM should first improve the credibility of its load forecasts, lest PJM base its new policies on exaggerated demand figures. This motif of “forecast first, reform later” had surfaced quite early (starting back in August) alongside broader worries that the system was overreacting to potentially inflated projections, whether due to double counting, poor data, or speculative projects squatting in the interconnection queue.

As a whole, the CIFP-LLA ran as a compressed sprint. Readers may recall that early in the process, one flagship concept was the NCBL (Non-Capacity Backed Load). But over the course of September and October, backlash to the mandatory NCBL reached a fever pitch, and PJM moved away from the construct. By late October and early November, stakeholders were coalescing around packages of smaller, ameliorative ideas instead of a drastic new service model. Multiple competing bundles of reforms circulated, with a mix of ideas being proposed: forecasting improvements, staged energization, interconnection acceleration, and extended-horizon auctions to secure reliable generation over many years. The months-long process culminated in a late-November Members Committee vote.

None of the packages achieved sufficient votes to move ahead. The CIFP had failed to produce a consensus solution by year’s end. Many stakeholders were furious, including governors of PJM states, who criticized the outcome and urged decisive action.

FERC’s December 18th Order

Against that backdrop, FERC’s Dec. 18, 2025 order is particularly relevant, as it forces closure on one specific part of the broader dispute. The Commission declared that PJM’s tariff treatment for co-located loads is “unjust and unreasonable”—a legal finding that triggers mandatory reform. At its core, the Commission argued that the lack of consistent rules for co-location arrangements meant uncertainty for developers, reliability risks for the grid, and undue cost-shifting onto other ratepayers. FERC therefore directs PJM to rewrite the tariff within 60 days and—in a bit of hand-holding—enumerates a menu of four transmission service options that PJM must offer to customers.

The Old Menu: Network vs. Point-to-Point

To understand the change, it helps to review the old menu of options. Suppose that you are a large customer in PJM. Your transmission service offerings fall into two buckets:

• Network Integration Transmission Service (NITS) is the default for load that gets studied and planned as part of the electrical network’s obligations. PJM plans transmission to serve you and coordinates capacity on your behalf. In return, you pay transmission costs on a shared basis, based on your contribution to peak demand.

• Point-to-Point Transmission Service (PTPS) is a reservation for a specific amount of capacity. You’re buying a defined number of megawatts between a Point of Receipt and Point of Delivery. PTPS comes in both firm and non-firm variants, but it’s designed for moving power across the system, not for serving load at a single location.

The existing tariff had several deficiencies that made it ill-suited for co-located arrangements at scale. This created at least three problems. First, PJM’s Behind the Meter Generation (BTMG) netting rules allowed cost-shifting. Some co-location configurations sought treatment to net on-site generation against their load. This means, for instance, that if you had a 200-MW compute campus and 200 MW of generation sitting around on site, you could subtract your on-site generation from your total needs—thus reducing your net withdrawals to virtually zero for billing purposes—while still benefiting from backup service during outages. Second, customers had no way to purchase less than full service even if they wanted it. A campus expecting its co-located generator to provide 90% of its needs had no option to buy firm service other than to buy transmission planning and capacity for 100% of its load. Third, PJM’s planning models had blind spots. If co-located loads showed up as negligible on the network because of netting, system planners couldn’t see the reliability risks. Perpetuating all of this was the longstanding reality that transmission owners across PJM each had their own way of treating co-location arrangements, sowing inconsistency and confusion across the RTO.

The New Menu: Four Ways to Take Service

The recent FERC order remedies these issues by requiring PJM to offer four transmission service options to any customer taking service on behalf of co-located load:

1. Network Integration Transmission Service (but on a “gross demand” basis)

2. Interim Non-Firm Service

3. Firm Contract Demand

4. Non-Firm Contract Demand

Here’s what each provides.

Option 1: Network Integration Transmission Service

This is the traditional path for loads that want full integration into the grid. PJM studies your entire load, incorporates it into planning, and builds transmission to serve it. You pay NITS transmission rates plus capacity charges, and you’re treated as network load in all respects.

The change for co-located loads is that you must take NITS on a gross demand basis. No netting is allowed. If your data center has a 200 MW peak demand and a co-located 180 MW generator, you still pay based on 200 MW, not the 20 MW net withdrawal. This eliminates the cost-shift that troubled so many ratepayers.

Ideal use case: loads that need firm, always-available service and are willing to pay for full network integration.

Option 2: Interim Non-Firm Service

This is a bridge product, available only to customers who are ultimately pursuing NITS but whose network upgrades are not yet complete. It provides interruptible service at NITS rates but without a capacity charge. This means PJM can curtail you during emergencies. Once your upgrades are done, this service terminates, and you move to full NITS.

The interim service addresses a time-to-power problem. Network upgrades can take years. This lets you energize sooner, albeit without firm priority, while the necessary facilities are built.2

Ideal use case: loads that want NITS eventually but need to energize before upgrades finish, and can tolerate curtailment risk in the interim.

Option 3: Firm Contract Demand

This is the option that breaks new ground for PJM. You choose a megawatt cap (your contract demand), and PJM provides firm service up to that level. You have the same curtailment priority as traditional firm transmission customers. PJM plans only to your contract demand, not your gross load. If you exceed your contract demand, you face penalties.

You can combine this with Option 4 (Non-Firm Contract Demand) to meet load above your firm contract level.

The benefit of Firm Contract Demand is cost-effectiveness. A 100 MW co-located load that expects to draw 60 MW from the grid only during extended generator outages can size its firm service to match that expected usage, rather than paying to build a full 100 MW of transmission it will rarely use.

Ideal use case: loads that want firm backup service but only at a level below gross demand, because on-site generation will cover most needs most of the time.

Option 4: Non-Firm Contract Demand

This is interruptible service with no long-term commitment. Reservation periods range from one hour to one month. PJM does not plan upgrades to support this load, and you can be curtailed in emergencies. But the selling point is that you pay no capacity charge.

This option provides flexibility for variable or occasional grid usage without imposing planning obligations on the system.

Ideal use case: loads that want short-term access without committing to long-term service, or as a supplement to Option 3 for usage above the firm contract level.

How the Options Fit Together

As touched on earlier, there is a structural relationship among these offerings. Options 1 and 2 together constitute the pathway to becoming network load; Option 2 is simply an on-ramp that lets you start energizing before upgrades are ready. As the more novel offerings, Options 3 and 4 are alternatives to network load. They let you buy less service; it’s up to your needs and risk tolerance.

All four options require that customers pay regulation and black start charges—on a gross demand basis. This ensures that even loads taking minimal transmission service still contribute to the ancillary services they benefit from. Thus, the December 18th order closes the cost-shifting loophole that long allowed co-located loads to freeride on grid reliability while paying almost nothing.

Not The End of The Story

FERC’s move is not pro-data center or anti-data center. It is a practical cleanup of a tariff that had become too ambiguous to administer fairly or safely. Under the old framework, a co-located campus could make itself negligible on paper but suddenly look to the grid for significant backup. The fault does not rest with data centers per se. Neither should it be pinned on the transmission owners serving those compute campuses. PJM’s old menu was more or less binary, an untenable model for the needs of data centers deploying fast and needing power soon. PJM can meet the challenge with a legible, standardized set of service options so customers can choose what they actually need and PJM can plan, build, and bill accordingly.

This new tariff design is not a resolution to the now-expired CIFP that kicked off this “Standby, or Stand Firm” series, but it is a step to better accommodate the large loads that are causing PJM’s crisis of resource inadequacy in the first place. A cleaner co-location framework does not conjure new generation, accelerate multi-year transmission construction, or provide a crystal ball for load forecasting, despite the many earnest, entertaining, and creative comments submitted to PJM.

Even FERC’s ability to intervene is limited, but it’s been clear and decisive. And last Friday, governors from around PJM descended on the White House to further crack the whip on PJM, calling for an emergency auction and the construction of billions in new power plants. That’s for the next issue.

In a historic event for our great nation, delegates from the thirteen states convened in the city of Philadelphia, Pennsylvania with one mission: they had a new vision for the future of their union. They wanted new governance, and they wanted it now. The electric bills were too bloody high.

This was the scene two weeks ago as a bipartisan bloc of PJM-state governors came together to take skyrocketing capacity costs and fumbled process into their own hands. All of this is unfolding as PJM’s CEO Manu Asthana prepares to abdicate at year’s end.

But beneath those political headlines, an in-the-weeds fight has been playing out in the PJM Interconnection, one that decides whether AI gets built here, at scale, and on time: what kind of power service data centers receive, how much risk they shoulder, and how quickly they connect.

The Roadmap for This Edition

Today is Part 2 of Standby, or Stand Firm?, a series on AI data centers, flexible load, and PJM’s plan for dealing with it: Non-Capacity-Backed Load (NCBL). In Part 1, I explained PJM’s concept for NCBL, a “standby” lane for large loads that become the first to curtail when the grid is stressed. I also highlighted some flaws of NCBL that triggered the swift backlash from all sides.

That’s where today’s issue picks up. First, I’ll give an update on recent changes to NCBL and noteworthy counter-proposals from stakeholders. After that, today’s edition will serve as a primer dedicated to all things “flexible data center” and “flexible load.” I’ll unpack key terminology, including service class (what you’ve contracted for) versus market mechanisms (how you behave). We’ll also look at how AI data centers actually flex, from the campus level down to the GPU core. To top it off, we’ll finally learn the lore behind the flexible data center: its origins and the key scientific result that’s been all the rage this year.

Subscribe now

What’s New With NCBL?

Mandatory NCBL is no more

They proposed. Hyperscalers said, “No.”

PJM has walked back the mandatory component of its NCBL construct, unveiling changes in its meeting last Wednesday, October 1st. In Part 1, we witnessed that the third rail of the NCBL proposal, the thing that turned so many heads, was the mandatory backstop. The idea of forcing standby status—allocating NCBL whether you opted in or not—was a non-starter for data centers that live and die by uptime and service commitments to their customers. This latest announcement has its jargon, some of which I demystify in the section “Service Classes vs. Market Mechanisms” that follows. For now, I’ll give a quick rundown.

In PJM’s newest slide deck, flexibility takes the form of pre-existing, voluntary tools:

• Demand response (DR): paid, event-based reductions during system stress.

• Price-responsive demand (PRD): a pre-filed, price-indexed reduction plan, modified by PJM to use the energy-market offer price.

PJM also outlines process changes:

• Load Forecasting: add a state-commission review of large-load adjustments before the forecast is finalized; require submitters to disclose duplicative requests.

• Expedited Interconnection: create a 10-month Expedited Interconnection Track for “sponsored generation” (e.g., supported by a state commission) with strict eligibility (e.g., >500 MW) and project responsibility for paying 100% of needed network upgrades.

• Longer-term procurement: open a discussion for alternatives to the region’s traditional reliability backstop, which solicits capacity for a single delivery year at a time; this would allow procurement of capacity for longer periods.

In short, PJM is stepping away from a blunt, mandatory standby class and toward a menu of voluntary flex behaviors. It also floats a variety of process changes, all aimed at improving long-term resource adequacy in the region.

Hyperscalers become generators…of policy

Industry stakeholders, for their part, have mounted an unusually proactive response to the heavy-handed NCBL since its bombshell release in August. In a scarcely seen, coordinated intervention in regional market design, hyperscalers including Amazon, Google, and Microsoft have proposed a complementary package of reforms consisting of three pillars:

Improving Load Forecasting: count only loads with verifiable commitments; reduce counting of duplicates; implement “reality checks” informed by supply chain conditions, expert studies, etc.

Demand-Side Actions: enable limited-hours DR; establish an emergency step to run on-site backup generation before any manual load-shed; offer a purely voluntary curtailment option.

Procurement of Multi-Year Capacity: if the region remains short, run a multi-year capacity procurement to incentivize new supply. Generators bid for contracts lasting 1-7 years, though shorter terms clear first. The price is set at PJM’s standard reference point (the maximum on its capacity demand curve) and gets locked in for the life of each contract. This temporary program sunsets after the 2031/32 delivery year.

PJM vs. Hyperscalers: Where do their latest visions agree?

1. Voluntary vs. mandatory: Agree.
   PJM scrapped the compulsory allocation of NCBL.

2. Load forecasting: Agree.
   PJM’s newly proposed due diligence for load-forecasting (state-level review, duplicate-request screens) is in spirit with hyperscalers’ requests that PJM first ensure estimates of future need are credible.

3. Demand-side mechanics: Specifics TBD; room to agree.
   PJM’s pathway is to use some combination of existing DR and a modified PRD mechanism. Hyperscalers go further, crafting a limited-hours DR product (24–100 hours/year).

4. Emergency playbook: TBD; room to agree.
   PJM has only vaguely flagged a review of manual load-shed allocation, to be conducted at a later date. Hyperscalers ask for a specific rule to dispatch on-site backup generation immediately before manual load-shed. This request may raise environmental/permitting wrinkles.

5. Generator interconnection: TBD; room to agree.
   PJM has proposed a 10-month Expedited Interconnection Track for sponsored generation. The latest coalition deck says nothing on this, but hyperscalers have historically supported generation projects that are colocated or paired with load.

6. Longer-term capacity procurement: TBD; room to agree.
   PJM mentions the idea of longer-term reliability purchases. Hyperscalers lay out a concrete process for procuring multi-year resources beyond PJM’s usual capacity auction, which procures capacity for just one year.

What’s the upshot? Both sides are now gesturing toward voluntary flexibility executed through DR-like mechanisms. What remains is to decide contractual and operational details: explicit curtailment caps, advance notice, published priority order, compensation for curtailment, and an emergency sequence—including whether and when to use backup generation. On some of these fronts, industry stakeholders have offered their version of the specifics.

Furthermore, both parties are looking at future years, with recommendations to reinterrogate potentially inflated load forecasts and to allow contracts for longer-term capacity. The industry slide deck’s recommendations for improving the accuracy of future load forecasts are sensible—and I would not be surprised to see PJM’s official numbers decrement as a result of implementing these actions—but if you ask me, it’s largely wishful thinking on the part of the industry coalition. Even if estimates come down, it’s fanciful to imagine they’ll do so by enough to dig us out of the present situation. We’re fundamentally in a state of resource inadequacy.
Update 10/8/25: The above section was revised for accuracy.

Certain unalienable rights

Hyperscalers gave us a reminder that state governors aren’t the only ones staging an intervention in PJM. The giants of the AI industrial base, who have seldom seen regional grid policy as part of their job, are architecting their own vision for regulating flexible load. In doing so, hyperscalers are drawing a line: the freedom to choose firm over flexible is, for them, a certain unalienable right.

For my part, I don’t think that flexibility ought to be verboten. Rather, it can be a fantastic opportunity. I do think that forced, open-ended flexibility poses a massive risk. If exposure to that risk is unbounded, you can’t plan AI workloads. If you can’t plan, you don’t build. That’s the decision calculus.

Just CHILL: The Response to Large Loads Out West

Let’s take a brief excursion inland. The same story of large loads has transpired across the country, albeit more cool-headedly. Consider the Southwest Power Pool (SPP), whose board approved a High-Impact Large Load (HILL) policy on September 16th, establishing a 90-day study-and-approval path for large loads paired with new or planned generation. This is an excellently generative idea, literally, since it enlists loads to help solve the supply shortage. A companion idea—wryly named Conditional HILL (CHILL)—would provide expedited, non-firm access in exchange for defined curtailment rights. That makes it something of a more mature cousin to NCBL, but CHILL has been deferred to a later tariff revision. PJM is moving in the right direction, but the execution has been decidedly rougher than out west.

Fundamentals of flexibility:
service classes vs. market mechanisms

Many readers will know the buzzwords. Demand response. Demand flexibility. Demand-side management. Flexible data centers. Flexible load. Same thing…right? The ontology of flexible load involves two animals: (1) service classes and (2) market mechanisms.

• Firm service class (a high-priority contract).
  This is the default class. You energize when ready and—short of extraordinary conditions—remain served. You have top curtailment priority; all others curtail before you. No pre-commitment to reduce; any turn-down in power is at your discretion.

• Flexible service class (a lower-priority contract).
  This is a distinct class that has gone by various names in various jurisdictions (e.g., interruptible/curtailable/non-firm service). You opt into a lower-priority lane in exchange for something you value, often earlier energization and sometimes lower charges. The contract has clear terms:

  • caps on total hours (or total energy) curtailed

  • notice windows (e.g., day-ahead advisory, plus same-day call)

  • published priority of each customer in the curtailment order

  • basic verification so that performance is auditable.

  PJM’s proposed Non-Capacity-Backed Load (NCBL) is best understood as an instance of flexible service.

• Market mechanisms (DR, PRD).
  These are behaviors theoretically available to a customer in any class.

  • Demand response (DR): event-based reductions that you perform for compensation when the operator signals so.

  • Price-responsive demand (PRD): a pre-filed, rules-based plan that automatically reduces your load in real time as the market price crosses certain thresholds.

Two clarifications for good measure

1. Participating in DR/PRD does not change your service class. A firm customer can do DR/PRD and remain firm.

2. In a flexible contract, your system operator may use DR/PRD-style tools to implement your obligations, but that does not make DR/PRD the service class.

In short: service class sets your curtailment priority while DR/PRD market mechanisms are agreed ways to behave during special events.

How to Flex Your Data Center

In practice, the tools that sophisticated customers use to execute DR and PRD behaviors aren’t just light switches; their power draw can be tuned smoothly. Could AI factories do the same? As I wrote in Part 1, ventures like Verrus AI and Emerald AI’s orchestration at an Oracle data center in Phoenix show that software can, in real time,

1. modulate the total load of a site

2. delegate jobs among sites (spatial shifting)

3. defer jobs to later (temporal shifting).

Flexible to the core: GPU-level power controls

But I’ve spoken to a few engineers building something neater: fine-grained GPU controls that fit naturally into DR/PRD. Using dynamic voltage and frequency scaling (DVFS) to adjust the clock frequencies of GPU cores across multiple discrete setpoints, even an individual chip can track a price signal or instruction quasi-continuously. Practically, that means you don’t need to halt jobs when the grid tightens; you just run the entire fleet less intensively.

In other words, operating your site at 80% can be achieved in multiple ways:

1. four-fifths of GPUs at full tilt with one-fifth idle

2. the entire fleet running at a moderately reduced clock frequency (e.g., ~90%) that corresponds to an 80% power draw1

3. something in between.

Furthermore, the more levels and axes along which we can adjust computing load (temporal/spatial, campus/rack/chip, etc.), the more sophisticated the solutions available to us, including highly intelligent, reinforcement-learning-based workload management that can conduct a country of data centers in a seamless symphony.

This is a dynamic field evolving every day, with low-hanging fruit to be picked. If you’re a reinforcement learning engineer or an operations researcher, this is one of the most fascinating ways you could help improve the efficiency, reliability, and competitiveness of American AI and the grid. Every innovation can be deployed to AI factories at massive scale.

Flexible Data Centers: The Lore and The Seminal Whitepaper

In February 2025, a team at Duke University’s Nicholas Institute—Tyler Norris, Danny Profeta, Esteban Patiño-Echeverri, and Cowie-Haskell—gave a crisp name to a practical idea: curtailment-enabled headroom, herein abbreviated CEH. It’s presented in their now-landmark paper “Rethinking Load Growth,” and the claim is straightforward: if large loads pre-commit to brief, bounded curtailments in narrow windows when the system is tight, the grid can absorb much more demand without waiting years2 for new build-out. Their first-order national estimate:

• 76 GW for ~0.25% annual curtailment

• 98 GW for ~0.5% annual curtailment

What do “narrow windows” mean? Grid stress is concentrated in a few hours of the year—late-afternoon peaks on the hottest days, frigid morning ramps, the occasional unplanned outage window—when load spikes against the capacity ceiling. CEH supposes that large loads hold back just during those spikes, not across the whole year.

For calibration: 1 year = 8,760 hours.

• 0.25% ≈ 22 hours/year.

• 0.5% ≈ 44 hours/year.

For context, many government and industry studies have forecasted U.S. data-center-driven demand growth by 2030 to be in the neighborhood of 80-100 GW. If this is the case, the implications from Norris et al. are huge. Even a small exercise in CEH could be enough to cover 100% of load growth—zero new generation needed.

PJM, Meet CEH.

How well does CEH scale in PJM? The region now projects roughly 32 GW of additional coincident peak by 2030, with about 30 GW attributed to data centers.

Against that backdrop, Norris et al. estimate that PJM would free up 17.8 GW under the ~0.5% curtailment scenario: that means we could accommodate 56% of incremental load growth if customers coordinate and curtail.

CEH: ~Necessary But Not Sufficient

CEH is a concept with the potential to circumvent America’s resource inadequacy for years to come if we have the right service classes, market mechanisms, and hardware in place. Of course, that’s turning out to be no small “if.”

First-order analysis is a first step

The Duke paper is intentionally first-order: it aggregates load and aggregates supply. In practice, America’s generators and batteries do not sit in one big lump, and neither does load. Delivery is fine-grained, bottlenecked by particular buses and substations. In other words, a surplus three states away doesn’t help if your local breaker is already at its limit. Norris et al. are upfront about this limitation, and they encourage further investigation.

We need hard numbers and hardware

There remain two practical gaps to planting these flexible loads around America:

• Siting intelligence.
  Developers lack visibility into local constraints: substation hosting capacity, feeder headroom, queue interactions at transmission voltage, and more. At the distribution level (low voltage), some maps of hosting capacity exist. What’s missing is a PJM or nationwide analogue at the transmission level (high voltage). Builders need to see substation headroom—posted publicly and updated quarterly, for instance—with standard options and timelines for upgrades. That lets builders land where the grid actually has room.

• Physical equipment.
  At nodes of the grid known to be at capacity, the limiting pieces can be prosaic: power transformers and other high-voltage gear. Wait times for distribution transformers have stretched into the two-year range, and large power transformers are globally supply-constrained. Under these conditions, solving power bottlenecks calls for targeted substation expansion and clear cost-sharing. Notably, that could include Contributions in Aid of Construction (CIAC), which are direct, customer-funded upgrades for work that can be imputed to a specific load.

Curtailment-enabled headroom and the findings of Norris et al. were a watershed result. Flexible power as a ramp to a permanent regime will be all but necessary if we are to maximize the medium-term realization of American data centers, but it certainly won’t be sufficient. All paths forward will require us to move both data and metal.

Next Time

Who thought that grid policy in PJM would be like watching a period drama? After all, not every commodity market has governors descending on Philadelphia to declare the causes which impel them to the separation.

By popular demand—and by the sheer frenzy of activity in PJM—the Standby, or Stand Firm? series will continue with Part 3 on a simple premise:

This will give us a grading rubric for “flexible load done right.” And depending on how fast negotiations over NCBL wrap up, we might be able to give PJM a report card.

1

Update 10/10/25: Supplemental derivation added.

Dynamic switching power for a GPU core scales with capacitance, voltage squared, and frequency. It turns out that voltage and frequency are linked. Reducing frequency allows for a reduction in operating voltage:

The exact relationship (i.e., the curve of V vs. f) is complex and varies by chip, but we can use a realistic estimate to illustrate the principle. Assume a 10% reduction in clock frequency (i.e., new frequency is 90% of old frequency). Realistically, this might allow for a 5% reduction in voltage (i.e., new voltage is 95% of old voltage)​. Plugging these values in, we can calculate the new power level:

To summarize, setting clock frequency (i.e., computing speed) to 90% of its maximum value has the convenient side effect of lowering the transistor voltage required. Empirically, a realistic value for this new voltage would be around 95% of the maximum voltage. The result is a power use of approximately 80% the maximum power of the chip.

AI and data centers absolutely dominate the energy policy discourse these days. Many readers are already familiar with the basics: data centers are poised to represent nearly half of all U.S. load growth from now until 2028, and in pockets of the country where they’re most likely to be deployed (Texas, Virginia, Pennsylvania, etc.), they will represent not just one of the biggest energy issues for policymakers, but one of the biggest issues period.

We’re already seeing the challenges of new data center deployments. AEP Ohio imposed a moratorium on new data-center hookups that lasted more than two years while regulators struggled to address grid costs. Just last week, the city council of College Station, TX unanimously shot down a land sale for a 600-MW data center campus, with residents citing strain on the grid as a key concern. And in a move that sparked a week’s worth of drama on Energy Twitter, the PJM Interconnection has proposed a restrictive new service category for large incoming loads: Non-Capacity-Backed Load (NCBL).

Today is Part 1 of a two-part series. In this installment, we’ll break down what NCBL actually does, what aspects of stakeholder backlash are on the mark, and why time to power is what dominates data center decisions. In Part 2, we’ll lay out the fixes—what “flexible load done right” might look like—and how to get there.

Subscribe now

Flying on Flexible Fare

Suppose you’re flying from DC to Philadelphia—to pay a visit to PJM headquarters in Valley Forge, PA, of course. You can pay $180 for a guaranteed seat. But on that same fare-selection page, the airline makes you an offer: pay the bargain price of $110 for a standby seat instead. A “standby” seat means you board last and—if it’s a popular itinerary—you might get bumped to a later flight entirely.

For fast‑arriving, large loads on the electric grid (a term that’s quickly become a Pavlovian stand‑in for “data centers”), that’s the latest idea from PJM: you can pay one price for the guaranteed seat, or you can avoid the seat-reservation fee if you agree to fly standby and be first to get bumped when the plane is tight.

People do not like it. The Data Center Coalition says the NCBL proposal is too vague to operationalize. Constellation has accused PJM of gross jurisdictional overreach. Cy McGeady of Equinix says the proposal obviates PJM’s entire designed purpose of creating a capacity market in the first place.

So what’s going on? First, some background…

There Are Really Two Electricity Markets

Before we unpack the chaos unfolding at PJM, we should understand the two layers of electric service: energy markets and capacity markets.

Energy (kWh)

This is the way most of us are used to thinking about electricity: it’s a commodity that you consume. Prices swing with fuel, weather, and congestion. At month’s end, your bill reflects how much you used and when. In the energy market, generators are paid for how much they produce.

Capacity (MW-year)

This is like the insurance premium for the worst day of the year. You’re paying to ensure enough megawatts will be there when the system gets tight. In the capacity market, resources (a fancy umbrella term for generators and other power sources, including batteries and storage) are paid simply for being available, not for how much they produce.

Every U.S. ISO (Independent System Operator) and RTO (Regional Transmission Organization) runs energy markets. What differs is the reliability layer on top:

• Centralized capacity markets (PJM, ISO-NE, NYISO).
  These regions have formal auctions that secure future capacity and set a price for it. Consumers in these jurisdictions pay for both energy and capacity (though, as a household customer, you won’t see “capacity” itemized; it’s baked into the supply rate that your provider charges).

• Resource-adequacy programs (MISO, CAISO, SPP).
  These regions don’t run a big capacity auction. Instead, regulators instruct each utility or retail supplier to prove that they’ve lined up enough capacity for a peak day, plus a reserve margin. If one utility company is short, the ISO can procure the deficit (using methods beyond the scope of this discussion) and charge the short party. Essentially, it’s capacity by proof, not by a single market clearing price.

• Energy-only (ERCOT).
  In Texas, there is no capacity market. This is a laissez-faire approach where scarcity pricing is meant to attract investment. The basic idea is that if a shortfall does arise, there will be a natural incentive to build more resources in order to chase the lucrative marginal price during those moments of high demand. The result is more resources on the grid and improved reliability overall.

Belonging to the first of these categories, PJM solicits promises to meet capacity three years ahead through its Base Residual Auction (BRA). The BRA is PJM’s auction to identify generators who will pre-commit to meeting future demand at the lowest cost. The resulting clearing price at auction basically represents the price that customers will pay for carving out a “guaranteed seat” of 1 MW.

The capacity market price signal has exploded

PJM’s capacity auction cleared at $329.17 per MW‑day for 2026/27. It was $269.92 per MW‑day for 2025/26, which was an explosion from just $28.92 per MW‑day for 2024/25 the year prior. That’s a jump by over 800%! In essence, the recent shortfall in generation has meant an enormous premium being paid to those who can step up and guarantee availability.

That said, it’s worth emphasizing that the retail electric prices that residents see are a complicated business, and data centers certainly shouldn’t get all the blame. As frustrated ratepayers feel the pain of rising prices, it’s a picture that deserves more color (more on this in a future edition of Policy Gradients).

What is NCBL? A “Standby” Lane in PJM for Large Loads

Now, we’re ready to understand the capacity debate that’s been happening. Non‑Capacity‑Backed Load (NCBL) is a proposed lane for big new customers (generally ≥ 50 MW) willing to accept lower-priority service under certain rules. Stakeholder discussions are ongoing, and PJM has signaled an intent to file with FERC by year’s end, with operations targeting a delivery year of 2028/29 at the earliest.

• NCBL does not pay a capacity charge. It is subject to pre-emergency curtailment.
  NCBL is excluded from the BRA and associated capacity charges. In return, it can be curtailed under defined pre-emergency conditions, which are conditions of high demand that do not yet rise to the level of an emergency. In these scenarios, electric customers in the NCBL lane are the “standby” passengers who are first to be bumped.

• NCBL curtailment is PJM-instructed, utility-executed, and auditable.
  Before the delivery year in which NCBL takes effect, it is the responsibility of each transmission owner (i.e., utility company) and participating customer (e.g., a data center) to agree on an operating procedure for curtailment: who calls whom, what constitutes minimum notice, ramp-down expectations, steps for restoring power, data reporting, and more. During a curtailment event, PJM instructs the transmission owner to curtail the load that is being served. Afterward, the transmission owner is responsible for sending telemetry data (i.e., before-and-after data from meters and sensors) to PJM for audit and verification that the load truly was curtailed.

• NCBL participants receive offsets for Bring-Your-Own-Generation (BYOG) and Demand Response (DR).
  Bring-Your-Own-Generation (BYOG) is on-site generation that you own or control. Demand Response (DR) means voluntarily lowering your load in response to a grid signal during periods of high demand, typically in exchange for compensation. Customers under NCBL can credit BYOG and new DR to offset an equivalent portion of their flexibility obligation, since both BYOG and DR can reduce the ad hoc load that a customer poses to the grid. For example, if a hyperscaler were to build an on-site gas-fired power plant accredited at 100 MW and to add new DR accredited at 25 MW, their assigned quantity of NCBL could be reduced by up to 125 MW (though the exact math remains to be determined).

• NCBL is transitional.
  PJM envisions NCBL as an interim measure given the grid’s current resource inadequacy.

But here’s the kicker that is making hyperscalers sweat: under the new proposal, PJM first seeks volunteers for NCBL status, but if a delivery year still falls short due to large-load additions, PJM can “allocate NCBL” (read: “force NCBL status upon you”) by area. In other words, you might be designated flexible whether you like it or not. Ouch.

There is nothing inherently wrong with flexibility. In fact, the flexible data center model could unleash a fantastic amount of untapped American power for AI (more on this in Part 2). But the concept recently proposed by PJM falls short of this framework in some crucial ways.

Where NCBL makes sense

NCBL gestures in the right direction, with ingredients for a product that could complement the capacity market rather than undermine it. Here are some aspects of the proposal that accord with a sensible conception of flexible load.

• NCBL is still counted in grid planning.
  Even if a customer elects the NCBL lane, PJM still counts that load in transmission planning. What this means is that although NCBL makes no financial contribution to capacity, the engineering contribution of the load does not go ignored. In the longer term, engineering studies will still take NCBL into account when properly sizing the grid.

• NCBL participants receive offsets for BYOG and DR.
  As described earlier, customers can nominate BYOG resources and new DR to offset their own NCBL obligation. This is a good thing, as it allows important or sensitive loads to take matters into their own hands and invest in upgrades that reduce exposure to curtailment. Plus, this is a way for customers to contribute to grid reliability more broadly and ultimately help solve PJM’s resource inadequacy.

• NCBL is transitional.
  As described earlier, PJM has proposed NCBL as a temporary strategy for dealing with rapid load additions. Say what you will about PJM’s recent performance, but even astute watchers of the grid have been caught off guard by the sheer speed and scale of the AI-driven surge in new load. Accordingly, some sort of transition plan is appropriate as we build toward a grid that can fully accommodate the demand for AI.

Where NCBL has issues

That’s about where the sensible stipulations end. Here are some less attractive effects of NCBL.

• NCBL is removed from the BRA.
  As described earlier, PJM’s Base Residual Auction buys commitments three years ahead to meet future resource needs. The BRA serves at least two vital functions.

  • First, the BRA ensures the physical reliability of the grid. If NCBL is invisible from the auction, total capacity will be underestimated and underbuilt, jeopardizing long-term reliability.

  • Second, the BRA ensures that capacity is priced to reflect the value that consumers actually derive from it. Suppose that NCBL has been dished out across the grid at a quantity determined top-down by PJM. That portion of demand—hidden from the auction by the invisibility cloak PJM is proposing—has been treated as non-existent, which means capacity for that year will be underpriced. For perhaps no consumer class is this more distorting than the incredibly high-value use case of compute for AI. The current proposal also absolves NCBL of fair cost allocation with other grid citizens. Think of it this way. Have you ever had a colleague who shirked chipping in for a shared coffee machine—or furniture or some other group purchase—but went ahead using it anyway? Even if they pay for the coffee cups and pods that they use, they haven’t partaken in a fair cost allocation for the mere availability of the shared resource. There are certain fixed costs that complicate the picture too. It’s not great. Ironically, at a moment when data centers are coming under public fire and facing existential hurdles over cost causation, this move by PJM is more than a little tone-deaf.
    Update 9/18/25: This paragraph revised based on feedback from Samuel Roland.

• NCBL is tapped earlier in the curtailment order.
  In the pre-emergency playbook, NCBL is curtailed before capacity-backed DR. This is a bit surprising. Traditionally, DR customers are ready to ramp down power in response to incentives, and some sophisticated customers are already doing so in real time. But under the new proposal, NCBL is an even lower-priority lane than DR, arguably exposing them to undue risk.

• It’s all fun and voluntary…until the mandatory backstop triggers.
  This feature of NCBL has widened eyes, and it’s not hard to see why. As we’ve explained, in the case of a shortfall, PJM could just dole out NCBL status until the region meets capacity constraints for the year. But the whole point of a standby airfare class or a flexible lane to power is that it’s opt-in. It offers customers the option to voluntarily accept lower priority in exchange for some benefit, such as a lower fee. Stakeholders across the board consider this mandatory backstop to be heavy-handed—and understandably so—since it subjects customers to unsolicited service interruptions, all in order to address a shortage of grid resources that should have been solved on the supply side anyway (by building more generation).

Why Hyperscalers Are Freaking Out

It’s tempting to view NCBL as a “discount deal” that lures data centers with waived capacity fees. After all, in its own slide deck, PJM says that NCBL “could offer significant savings to participants.” But in reality, for hyperscalers, the capacity line item barely moves a go/no-go decision. Time to power does.

On the revenue spreadsheet, the variables that dominate are (1) energization date and (2) how fully a campus can run once it’s live.

While a 100-MW campus might “save” on the order of ~$12M/year by not buying capacity1, that’s pocket change relative to capex, supply-chain commitments, and the cost of letting racks sit dark. If GPUs have already been installed or even ordered, just a couple weeks of downtime eats multiple times those ostensible electricity cost savings2.

As Dean Ball, the lead architect of America’s AI Action Plan, put it to me in a recent conversation,

“Data center operators are accustomed to exceptionally high uptime (often more than 99.99% of a year), but in a world with rapidly growing data center costs and lengthening waits for new data centers to be connected to the grid, time is far more valuable than savings on the marginal cost of electricity.”

(Dean is also the author of Hyperdimensional, where you can find some of the most prescient and original thoughts on rapidly improving artificial intelligence. It’s telling—of the importance of the issue—that Dean chose to make his long-awaited return to Substack with “Out of Thin Air,” which puts a spotlight on time to power. The piece even includes complete draft text for an executive order meant to accelerate interconnection for large flexible loads.)

If we’re serious about building AI in America, we shouldn’t be waiving capacity fees as a measly carrot in return for the ability to cut data centers offline and tell them, “Tough luck!” If anything, hyperscalers might be willing to pay a premium in exchange for accelerated energization. Moreover, these premiums could go toward relieving some of the cost-causation (i.e., expensive upgrades to the grid) that’s partly fallen on the backs of residents in so many states.

Fixing the Flexible Fare

The Non-Capacity-Backed Load (NCBL) category proposed by PJM on August 18th, 2025, which poses an uncontrolled, open-ended curtailment risk and shifts costs onto people minding their own business, is dispositively negative for data center feasibility. It’s just not going to fly. But these problems are fixable. Under an opt-in, rule-based, fairly financed, and growth-incentivizing framework, flexibility need not be a burden. It’s our greatest opportunity.

Up Next

In Part 2, we’ll lay out the policy toolkit to make flexible load a real product—explicit, voluntary, and conducive to resource growth—that solves our real capacity problems.