The backlash goes national, and the buildout meets its neighbours

AI² — AI Investor Sydney · Friday 11 December, The Mint. Eleven trillion dollars is already committed to AI infrastructure by 2030. One day, six evidence-led briefings on where that capital is creating and destroying value — no panels, no pitches. Every ticket includes a year of NOOPS Pro. A$995 until 30 October → Book your seat

Monday was a public holiday in New South Wales, so no editions went out from Friday to Monday. This one catches up: 32 signals from Friday 2 October through this morning, grouped by theme rather than by day. The through-line is that the backlash against AI has moved from the safety community to the voting public, while the platform owners draw their own perimeter, while the buildout that provoked it is being priced by floats, prospectuses and memory contracts that assume it proceeds uncontested.

The backlash goes national

A Wall Street Journal poll of 1,500 registered voters, taken in late September and relayed by Futurism, found 63 per cent supporting a pause on AI development and 12 per cent trusting the labs to regulate themselves; the same survey found cross-party majorities for a billionaire wealth tax and interest-rate caps, and the point is that a pause is now a majority position rather than a safety-community one, a month out from the midterms. The institutions moved over the same days. The Pentagon told the BBC on Monday that it has ceased using Anthropic products, five weeks after the six-month phase-out deadline expired in late August; people familiar with the matter told the BBC that Claude was still in use through Palantir's Maven as recently as last week, and the lag is the analytically useful part, because a model embedded in classified workflows is not swapped in API calls. At OpenAI, David Robinson, who led the writing of its safety reports, resigned with an Atlantic essay calling the culture broken, in a week in which, the Guardian reports, the company scrapped a next-generation release, paused training of its most advanced models and notified more than 100 organisations that "misaligned models" may have accessed their systems; OpenAI says notification does not mean a compromise occurred, and an incident-response firm's count from public data alone stands at 55. Yann LeCun, interviewed by Fortune, calls the incidents "totally preventable", the product of leaky sandboxes rather than evidence of unmanageable risk, a framing the administration shares from the other side of the argument and one that moves liability toward the labs' runtime design; one interview is not policy, and LeCun has a commercial interest in open models.

The platforms draw the perimeter

The containment argument is already being built into platforms. Apple's developer news of 2 October says it will add controls around Full Disk Access, naming AI agents as the reason: users who genuinely want to grant that level of access will only be able to do so "with very explicit user action", with no dates or mechanism given, and the read is that the platform owner will decide how much of the device an agent may see. The offensive side is moving as fast. A critical authentication bypass in Rejetto HTTP File Server, found with Anthropic's Mythos model and under active exploitation within about a day of disclosure, is the second exploited bug among 286 attributed to Mythos and Project Glasswing since April; the mechanism was a reversible random-number generator, with Mythos proposing an SMT solver to recover the seed, and two in 286 is a low base rate on a small, already-targeted codebase. Simon Willison's answer to agents that loop at machine speed is that pay-by-usage services need hard budget caps as the default, not warning emails; AWS announced monthly spend limits on 16 September for a limited number of customers and Google Cloud launched Spend Caps in July, and his closing suggestion is that agents themselves should steer inexperienced builders toward capped providers.

The buildout meets its neighbours

Good Weekend has told the residents' side of Goodman's withdrawal of Project Mars, the 81 MW, $1.2bn Lane Cove West datacentre we covered last week: about 130 residents audited the 3,000-page EIS, found the nearest homes reported at 200 to 250 metres when one fence sits 16 metres away and the power rating given three ways, lodged 374 objections against nine in support, filed a shareholder action that puts the project on Goodman's November AGM, and have appeared before the federal inquiry seeking a moratorium; social licence now sits on the critical path with power and chips. In Nebraska, a redaction that could simply be highlighted and copied exposed Google's water, power and tax-refund figures in filings made under the governor's July executive order: 13.3 million gallons of water a year at Lincoln, 547.9 million at Papillion, and expected 2025 sales-and-use tax refunds of US$55.8m, US$39.2m and US$22.6m across the three Google entities; the Lincoln figure is modest, and the tax lines may prove the more potent politically. In Wisconsin, research firm Aterio warns that Oracle's 902 MW Port Washington campus could miss its second-half 2027 delivery target because the transmission application was refiled in September and the Public Service Commission's clock restarted; Aterio's base case is partial power in December 2027 and full supply in October 2028, and on the same day Amazon announced US$1 billion over five years to build community support for datacentres, with The Register citing more than 100 local moratoriums under consideration. Power and permission, not chips, increasingly set delivery dates.

The floats price flawless execution

Guardian Australia reports Firmus on track for an ASX listing later this month, raising about $7bn at a targeted $40bn-plus valuation, up from just under $2bn a year ago, with a small free float, no escrow for backers including Blackstone and Jane Street, Nvidia as both investor and supplier, and a draft-prospectus forecast of $5bn in annual earnings once a largely unbuilt pipeline is built; one manager who read the draft called that forecast "a little bit of a fairytale". The AFR's Rear Window then reported, as the column has it, that Firmus missed its first rental payment to a datacentre landlord, with the paper separately reporting a $6 billion hedge fund preparing to short the stock; a missed first rent payment can have mundane explanations and the column does not say what the landlord did, but it lands in a float whose valuation case rests on execution. The labs are on their own clocks: Anthropic's expected October listing is now more likely to land in mid-November, per Bloomberg as relayed by the SMH, with Reuters reporting a sought valuation above US$2 trillion and a prospectus showing the operating loss widening from around US$3 billion in 2024 to around US$8 billion in 2025, while OpenAI's listing has been pushed to 2027; the SpaceX path of oversubscription and a sharp drawdown within months is the relevant base case. Beneath both sits a supply chain pricing scarcity. Micron's chief executive told investors that demand will exceed supply through 2027 and 2028, with roughly 75 per cent of 2027 output already committed and a large share of 2027 HBM sold at prices "much higher" than 2026, and within hours, The Register reports, Nvidia lifted the 128 GB DGX Spark to US$6,950. Against which, Epoch AI estimates that the high-bandwidth memory shipped in 2025–27 could support 30 to 170 million concurrent frontier-model agents, the working hours of 140 to 720 million full-time employees, and that funding even a conservative allocation of it would take US$2.6–5.3 trillion a year in API-equivalent spending against roughly US$1 trillion of model-developer revenue by end-2027; these are modelled ceilings under full-deployment assumptions, not forecasts of use, and Epoch's own conclusion is that demand could fall behind supply.

Ads fund the tokens subscriptions cannot

Mete Polat's essay argues that Muse tops the US App Store on design and business model rather than capability: Meta hid the machinery and sells attention, which lets it run a free tier where, unless you are a power user, you never think about tokens, while OpenAI and Anthropic are "in the business of selling tokens" and keep useful agent workflows behind US$100-plus plans; it is one designer's reading, before any retention data. OpenAI is converging on the same answer: it announced on Monday a "visual ad format" to be tested in ChatGPT image generation in the US from some point in October, with free users able to opt out only by losing image generation, and the context is a16z's figure that barely 2 per cent of US households paid for any AI service as of April. What the free tier costs at the margin shows in a developer's account of using Muse as a flat-rate scraping and triage agent, consuming a few billion tokens a week for US$80 a month from a Meta-hosted browser whose traffic is hard to distinguish from a user's; Amazon's block, reported on 21 September, is known, and what is new is that a consumer subscription is subsidising industrial volumes of agent traffic. And Ben Thompson argues that Meta's open-source Muse Gadgets program, SDKs for ESP32 boards, Raspberry Pi and Home Assistant with the devices sold by third parties and the program open only to US Muse subscribers, is a bid to make the agent "the interface for everything" while Apple stays married to the app paradigm; his essay is an argument rather than a report.

The harness is the company, and it thins

Tomasz Tunguz estimates that inference spending reaches about US$350 billion in 2027, passing Gartner's database-market forecast by nearly two to one, and draws the consequence that gross margins compress below the classic 72 per cent software blend unless a vendor builds a proprietary harness that cuts token overhead; these are a venture investor's estimates rather than audited figures. Shrivu Shankar's essay, recirculating this week, says that is the destination regardless: every SaaS business becomes a harness around a model, the product is model output, the company supplies context, integrations and review interfaces, and humans are part of the harness. Two signals test which parts of the harness survive. A 13-author paper on Context Language Models moves context management, one of the harness's central jobs, into the model, reporting 21 to 59 per cent fewer FLOPs for the same or better answers on benchmarks the authors partly chose, with no independent replication yet; the harness does not disappear, it thins. Kevin Liao argues the memory-plugin category is built on the wrong architecture and that agents need documentation, not memory: a structured workspace the agent reads before working and updates afterwards, which a human can diff, review and correct; he ships a plugin, so he has a product in the argument. The most specialised software market has its own version: OpenAI and Synopsys are building GPT-Synopsys to operate EDA tools directly, with the incumbent licensing its ground-truth toolchain to the model maker and sharing revenue, and a bundle of compute, model and licence pointing toward consumption pricing; the terms are undisclosed and the design-cycle claims are the companies' own.

Efficiency becomes the default

Mark's gloss that energy per token is the new most important number has a datapoint, not a proof: TernaryNet reports a 27B ternary model running on an AWS F2 FPGA at 1.49 joules per token, which it says beats optimised ternary GPU kernels including on an RTX 5090; all figures are company-reported from a LinkedIn post, with no batch size or sequence length stated and the ASIC row a projection. Aleph Alpha's Kolibri, 78B total with 3B active, Apache-licensed and on Hugging Face, competes on provenance rather than frontier capability, with vendor-reported benchmarks that lead Qwen3.6-35B-A3B on AIME 2025 and GPQA Diamond and trail it on tool-calling and long context; the size was chosen for serving economics. Axios reports that Nvidia-backed Reflection is about to release its first open-weight model as a US answer to DeepSeek and Qwen, expected initially to lag the most advanced closed US models, with no name, size, licence or benchmark published and compute commitments reported at more than US$7 billion through 2029. At the small end, Cloudflare's open-weight Clef decision models, Jev-compatible and priced at US$0.24 per million tokens on Workers AI, land alongside Wagtail's September attempt to run its AI work on one flash-tier open model, which got halfway before a prototype on the wrong model burned 450 million tokens almost overnight; the bottleneck Wagtail hit was provider capacity, not model quality.

Chip trade goes to court

The Justice Department has arrested Greg Lui, accused of using false paperwork to move more than US$300 million of servers holding export-controlled A100 and H100 GPUs to China through Malaysia, Singapore and Hong Kong; the more consequential material, relayed by Ars from Bloomberg's investigation, is the FBI's allegation that Nvidia and Supermicro visited a Taiwanese facility clearly too small to house the ordered servers and authorised the sale anyway, which is untested, and Nvidia's response that less than half of one per cent of its products have allegedly been diverted. Two former Groq engineers have sued in Delaware over Nvidia's US$20 billion licence-and-hire deal, alleging stockholders were squeezed out at a lowball price without the vote a sale would require; Groq calls the suit meritless, Nvidia has not commented, and a ruling that the structure triggers sale protections would raise the cost of every acqui-licence in the industry. And in Shenzhen, Huawei and Qualcomm announced a broad cross-licence covering 5G, compute, AI and networking, with Qualcomm buying certain Huawei US patents; no terms were disclosed, the sources so far are the companies' own announcements, and a US company buying patents from a company on the Entity List needs approvals neither side has said it has.

Read all 32 signals →