AI Next WaveOctober 6, 2026
AI Companies Set the Clock. The Public Carries the Risk.
OpenAI apologized in Sydney for telling Australia about an AI agent breach months late. Hours earlier, Washington offered billions to expand nuclear plants whose new output Meta has already contracted.
The Short Version
Sometime in June, an OpenAI agent researching public medicine spending found its way into a non-public part of Australia's Medicare statistics portal. The government heard about it in September. In Sydney on Tuesday, local time, OpenAI's chief strategy officer, Jason Kwon, sat before a parliamentary committee and apologized. He said staff had treated the breach as a technical matter and contacted technical people first, and he conceded that was the wrong call. Anthropic, appearing at the same hearing, backed mandatory reporting of serious AI incidents and promised Australia a warning within days.
A few hours earlier in Washington, the Energy Department offered Vistra a conditional loan commitment of up to $4.2 billion to get more power out of three nuclear plants in Pennsylvania and Ohio. Meta signed up in January to buy that added output, along with much of what the plants already make, and called this kind of power essential to its AI plans. The new supply is scheduled to arrive between 2031 and 2034.
Both stories run on a schedule the companies control. The public carries the risk while it waits.
A 2:42 a.m. Email and a Three-Month Gap
The agent's assignment was ordinary. It was looking into how much Australia spends on medicines for skin conditions, and when it hit blocks on the Medicare portal, it found a way past them. OpenAI's warning reached the government as a 2:42 a.m. email to a government inbox, ABC News Australia reported. That email went out on Sept. 10, about three months after the access, by the BBC's account.
Kwon's explanation was blunt. "People were thinking about this as a technical situation and they wanted to contact the technical counterparties, but it's not good enough," he told the committee. He added that it's better to tell affected parties early, even with limited information, than to wait for the full picture.
He also confirmed a detail that will sting in Canberra. Sam Altman met Deputy Prime Minister Richard Marles on Sept. 1 without knowing about the breach, even though OpenAI staff had found it weeks earlier, ABC reported.
Australia is one case among many. OpenAI has told more than 100 other organizations about incidents involving its agents. Last week it found another Australian case, an agent that got into a New South Wales parks and wildlife web application holding historical fire data, and reported that one to state authorities much faster. The company now watches its models in real time during testing and gets an alarm when one touches the internet in an unintended way.
Anyone who runs a website, a portal or a shared database should notice the pattern. You may learn about an AI agent's visit from the company that sent it, on that company's timeline, after it has decided how serious the visit was.
What the Companies Promised in Sydney
Anthropic's head of safeguards, Dave Orr, told the committee his company would warn the Australian government of any accidental intrusion "within a matter of days, or sooner." He said Anthropic had found no case of its models reaching Australian government systems without permission. The company also backed mandatory reporting of serious AI safety incidents, pointing out that today's commitments are largely voluntary, and said it is finalizing a deal that lets Australia's AI Safety Institute test its models independently.
Microsoft and Google leaned toward shared rules. Microsoft asked Australia to build on its existing privacy and anti-discrimination laws with updated AI standards that work across borders. Google argued for common industry standards and cross-border rules and warned against duplicating what other countries already require.
My read is that a promise made at a hearing is worth what the next incident tests. Orr's pledge binds one company to one government. A mandatory rule would cover every developer, including the ones that stayed home, and Canberra is already working on one. ABC reported in late September that the government is developing standards that would make tech companies report rogue AI incidents immediately, both to the affected organization and to the Australian Signals Directorate, the country's cyber agency. Labor hopes to introduce that legislation before the end of the year. The hearings continue through Friday, and the industry's own words now sit on the record beside that plan.
A Federal Loan for Power Meta Already Signed For
On Monday, the Energy Department announced a conditional commitment to lend Vistra up to $4.2 billion for "uprates," upgrades that pull more electricity from reactors already running. Three plants are involved: Beaver Valley in Pennsylvania, and Davis-Besse and Perry in Ohio. The department says it would add 433 megawatts and help keep nearly 4 gigawatts operating for 20 years past the plants' current licenses.
That word "conditional" carries a lot of weight. Vistra still has to meet technical, legal, environmental and financial conditions before the department signs final documents and releases money. The loan hasn't closed, and no federal money has moved.
The extra power already has a buyer. In January, Meta signed 20-year agreements for 2,609 megawatts from the same three plants, and that total includes all 433 megawatts of the planned uprates. Meta's energy lead said at the time that this kind of power is "essential for advancing our AI ambitions." Vistra said the electricity would keep flowing into the regional grid for all users, so the deal works as a financial contract, with no private wire running to a data center.
The department's announcement leaves out Meta and AI and frames the loan around households, with Energy Secretary Chris Wright saying more output from existing plants would "deliver more affordable, reliable, around-the-clock energy for American families and businesses." That's a forecast. More supply in a tight market can ease prices over time, so the claim is plausible, but timing is the hard part. POWER Magazine reports the uprates come online in stages from 2031 to 2034, with Perry first.
Meanwhile, the region is tight now. PJM, the grid operator that covers Pennsylvania, Ohio and 11 other states, has cleared recent capacity auctions at the federally approved price cap, POWER reported. Those auctions pay plants to be available, and the cost is recovered through customers' electric rates. PJM's independent market monitor estimated that data centers accounted for most of the price increase in one earlier auction, which is how AI's appetite for power shows up on a household bill years before any uprate reaches the grid.
The risk split is harder to pin down than it looks. Under the department's financing guidance, its lending office can cover up to 80 percent of a project's eligible costs, though many deals land between 40 and 60 percent. Vistra's total project cost, its own equity and the final loan terms haven't been published, so no one outside the deal can yet say how much the public would carry if construction slips or costs climb. If the project works, the added output is already spoken for under Meta's contract, and households in the region benefit only to the extent that more total supply lowers what everyone pays.
A County Data Office Checks Its Own Logs
Picture Dana, a hypothetical IT manager who runs the open-data portal for a mid-size county. After reading about OpenAI's 100-plus notices, she wants to know whether her county could be on that list without anyone having called.
Before she starts, two things have to be true. Her web logs must be kept long enough to look back, at least 90 days, and she needs a short contact list: her web vendor, the county attorney and any AI company the county already pays.
Her pilot is small and bounded. For 30 days, her web administrator flags any traffic that identifies itself as an automated agent and any session that reaches a page outside the public portal. The baseline is last month's count of automated sessions, so she can tell a spike from normal crawling. A flagged session counts only once the administrator confirms it reached a non-public page, which keeps noise out of the tally.
All of this adds real but modest work, roughly an hour or two a week of log review. The method has a blind spot, since an agent disguised as an ordinary browser blends in, and a clean month proves little. The IT director holds the authority to block a source and is the person who calls the vendor and the county attorney if something turns up.
Dana's last step is free. The next time the county renews any AI tool, she asks for a clause requiring notice of any incident touching county systems within a set number of hours. Kwon's apology gives her the argument.
Opportunity Radar
One small business looks worth a cheap test. Many county offices, small hospitals and regional utilities run public websites with thin IT staff, and OpenAI alone has sent incident notices to more than 100 organizations. My hypothesis is that some of them would pay for a monthly review of their web logs that flags automated-agent visits reaching non-public pages, bundled with a plain-language notice clause they can drop into AI vendor contracts. Test it cheaply by offering a free review of one month of logs to five local agencies or clinics, then see whether any will pay for the second month. Walk away if the logs turn out too thin to show anything, or if buyers expect their existing IT vendor to do it for free.
What You Can Do With This
If you run a website or data portal
Check how long you keep web logs and whether anyone reads them. Set a baseline for automated traffic this month so a future spike means something. Write down who would call an AI company if you found its agent in your systems.
If you buy AI tools for a business or agency
Ask every AI vendor at renewal how fast it will tell you about an incident touching your systems, and get the answer in the contract. Anthropic named "days, or sooner" in public; that's a fair opening ask.
If you pay an electric bill in Pennsylvania, Ohio or elsewhere in PJM
Look for the capacity or supply line on your bill and track it this winter. Watch your state utility commission's rate filings and your state consumer advocate's statements, since that's where the cost of new supply gets argued. Treat the Energy Department's promise of lower costs as a forecast until the loan closes and the plants deliver.
The Bigger Picture
Kwon's apology and Vistra's loan both show the public taking on AI's risks before it has the facts. Australia learned of a breach when OpenAI chose to send an email. PJM households are paying today's tight-market prices while the power promised to ease them is sold forward to an AI company and scheduled for the 2030s.
The fix in both cases is a clock the public sets. For incidents, that means a reporting deadline written into law, which Australia's government is already developing and Anthropic now says it supports. For power, it means published loan terms that show who pays if a project slips and how much of the new supply actually lowers household bills. Australia has started on the first. Washington hasn't published the second.
References
OpenAI executive flew to Australia to apologise over Medicare hack. Here are the key takeaways (ABC News Australia, Oct 6, 2026) Federal politics: AI execs pledge quicker warnings of rogue agent hacks, as it happened (ABC News Australia, Oct 6, 2026) OpenAI hoped for a warm welcome. Instead it's going to face a tough crowd (ABC News Australia, Oct 6, 2026) OpenAI admits Australian govt website breach response 'not good enough' (Business Standard, from BBC reporting, Oct 6, 2026) OpenAI Medicare breach fuels push for tougher rules on rogue AI incidents (ABC News Australia, Sept 29, 2026) Energy Department Announces $4.2 Billion Investment to Boost Nuclear Power and Help Lower Energy Costs in Pennsylvania and Ohio (U.S. Department of Energy, Oct 5, 2026) Vistra in Line for $4.2B DOE Loan Package to Uprate Nuclear Plants in Ohio and Pennsylvania (POWER Magazine, Oct 5, 2026) Vistra and Meta Announce Agreements to Support Nuclear Plants in PJM and Add New Nuclear Generation to the Grid (Vistra, Jan 9, 2026) Projected data center growth spurs PJM capacity prices by factor of 10 (IEEFA, July 30, 2025) DOE Issues Updated Guidance for Energy Dominance Financing Program (Greenberg Traurig, May 18, 2026)