The Reservation Is Not the Machine

OpenAI had signed contracts for 10GW of US AI-compute capacity by April 2026, reaching a goal it had once set for 2029. Yet PJM, a grid operator serving large data centers, was preparing to require some of them to bring their own generation or curtail electricity use. A company can reserve compute faster than a power system can make it dependable.

The AI infrastructure race has turned a long-horizon question about who might control powerful models into a near-term test of who can secure, finance, power, customize, sell and safely operate the systems behind them. A signed gigawatt establishes a claim on future capacity; it does not establish a running data center, profitable demand or a monitor that can see what an agent does.

The warning acquired a delivery schedule

Strategic warnings about frontier AI treated concentrated capability as a consequential possibility under uncertainty. Nick Bostrom’s account of a sufficiently pre-eminent AI leader, for example, considered its ability to protect installations and limit information leakage. That concern gave physical infrastructure a place in the argument long before a particular data-center contract could settle who would control it.

By 2024, Intel, Google, Microsoft, Meta and others had formed the Ultra Accelerator Link Promoter Group to standardize connections between AI accelerator chips. The companies were already working on a narrower, practical problem: how to connect machines without depending entirely on one hardware supplier. In 2025, sources reported that OpenAI had agreed to buy $300 billion of Oracle computing power over roughly five years, requiring 4.5GW of capacity beginning in 2027. The reported Oracle requirement is a future delivery obligation, not evidence that 4.5GW was operating when the deal was reported; it should not be added to OpenAI’s later 10GW contract total as though the two were separate pools.

Epoch AI expects the number of AI chips in use to double every nine months. If that forecast holds, procurement cannot be treated as a single construction campaign: each generation of machines needs sites, connections and customers while the next generation is being ordered. OpenAI’s addition of more than 3GW of contracted capacity in the 90 days before its April announcement shows how quickly a lab can advance the reservation side of that schedule.

Chip design cannot bypass the switchyard

OpenAI and Broadcom developed Jalapeño, an LLM-optimized inference chip that moved from design to manufacturing tape-out in nine months. OpenAI said early testing showed better performance per watt than the current state of the art. That is a consequential claim for a company expecting to serve models repeatedly, but early chip tests do not establish the cost or power performance of an entire operating site.

Microsoft was reported in September to be planning an expansion from roughly 12GW of data-center capacity to more than 38GW by 2032, with about one-third of the planned total centered on AI-specific chips. AMD secured more than 500MW of US data-center capacity from Core Scientific beginning in 2027, with an option to scale to 2.5GW. Both plans pair silicon choices with places to run it. Neither planned addition should be mistaken for capacity already delivered.

PJM supplied the other side of the engineering drawing. Its plan for large data centers would require them either to bring generation or curtail use to help prevent a large-scale outage. The operator must protect the grid during conditions the customer’s compute contract cannot eliminate. A deeper account of energy-to-compute control follows the same boundary from the data-center developer’s side: the server order and the available power are different commitments.

Control need not mean owning every component. Sources said Anthropic expected more than 3.5GW of compute capacity in 2026 across Amazon, Google, AMD and Nvidia-related supply. Anthropic’s approach, alongside the accelerator interconnect effort, is evidence that major buyers are trying to reduce dependence on a single supplier. Large reservations may concentrate purchasing power without producing permanent control by one chipmaker or one lab.

Lenders must finance the interval between construction and use

AI infrastructure companies borrowed more than $100 billion in 2025, according to Refinitiv figures cited in coverage; smaller companies faced higher rates as lenders questioned unproven AI businesses. Data centers turn a model race into an infrastructure-finance problem because builders must pay for long-lived assets before they know how fully customers will use them or what future compute will earn.

Lenders, insurers and underwriters have had to assess AI data centers as a novel asset class while limiting their exposure. By October, reported debt pricing offered a sharper distinction than construction announcements: CoreWeave’s bond yield topped 15%, and some Oracle debt traded near 80 to 90 cents on the dollar. Investors can believe demand will grow and still demand compensation for the risk that a particular builder cannot turn its commitments into cash on schedule.

The signed-capacity record is strongest as evidence of intended scale. It is weaker as evidence of utilization or return. Oracle’s reported multiyear sale gives a builder a prospective customer; it does not answer how much of the contracted compute customers will use profitably, how financing will be renewed or what a lender can recover if the asset disappoints. Those questions belong in the assessment of the buildout, not in a footnote to it.

Situational Awareness became an imperfect measure of the turn

Coverage of Situational Awareness offers a striking, but limited, record of changing emphasis. Across the coverage record’s comparison periods, article volume rose from one to 28. Research accounted for 100% of the earlier period’s single article and 10.7% of the later period; funding accounted for 42.9% of the later period. The small starting sample makes the percentages especially sensitive to what one article happened to cover.

The later reporting chiefly concerns Leopold Aschenbrenner’s investment firm, not a measured change in public belief about his original long-horizon argument. Sources reported that the firm invested $500 million in Source Foundry, a developer of AI chip-manufacturing tools. More recently, sources said Situational Awareness was pitching clients on a Fluidstack investment alongside it at a reported $40 billion valuation. The Fluidstack solicitation and valuation are reported, not confirmed transactions. Reporting on the firm’s portfolio management and risk controls makes it an even less reliable proxy for attention to the original manifesto.

Reporters increasingly examined financing decisions, chip-tool investments and portfolio exposures under the Situational Awareness name. They cannot infer fading interest in AI risk from that coverage or from the incomplete latest quarter.

Customers are buying access before they know its value

OpenAI’s Guaranteed Capacity offering asks customers to make one- to three-year commitments in exchange for assured compute access. The product gives OpenAI a way to plan demand against its reservations and gives customers a way to protect access. It also requires buyers to make a longer commitment than an on-demand model call.

Some companies have exhausted annual AI budgets within months or seen bills double or triple as token consumption rose, then begun tracking or rationing use. A buyer facing those bills has a different task from a lab buying more chips: it must decide which work merits the expenditure. Agrawal, Gans and Goldfarb’s system-innovation framework draws the distinction. Better predictions create their larger value when an organization redesigns the decisions and workflows around them, rather than inserting a model into an unchanged process. The employee or manager still has to exercise judgment about the action that follows a prediction.

That leaves capacity sellers and enterprise buyers with different measures of success. OpenAI can count reserved access under a multiyear agreement. Its customer must count useful decisions, saved work or new value against the cost of that access. A full server rack cannot settle the customer’s accounting.

Independent safety work needs access to the running system

METR’s pilot test found vulnerabilities in OpenAI’s monitoring system, including an exploit that could have let AI agents hide hundreds of recent actions. The finding concerns an operating control, not merely a forecast of what a future model might do. If a monitor misses actions, a human reviewer cannot be accountable for decisions the system never shows them.

Anthropic granted METR employee-like access in October to support independent assessment of its models and safety practices. Dario Amodei has also argued for mandatory third-party testing of frontier models for cyber, biological and autonomy risks, with authority to block or revoke deployment. Neither step means the underlying risk has vanished. Both place safety auditability where outside assessors can test the controls a lab actually uses.

Anthropic has proposed tracking how much AI research and development AI performs, how well agents are overseen and how compute is allocated. Those are different questions from whether a model scores well in isolation: they identify what the lab permits its systems to do, what observers can verify and where it directs scarce capacity. METR’s monitoring test shows why access to those operating arrangements matters.

OpenAI can put 10GW of signatures on a contract. Each rack still needs a powered socket, a paying user and a monitor that sees what the machine did.