12 SEP 2026 · 06:00 MDT · SOFTWARE-FACTORY / CONTROL-PLANE UPDATE: Active exploitation of JFrog Artifactory authorization flaws and a ScreenConnect client authorization failure elevate package provenance, privileged-token, remote-session and HPC deployment-path controls. No new TOP500 or independently verified capacity change is inferred. Evidence →
10 SEP 2026 · 15:00 MDT · AFTERNOON DELTA: Anthropic reports AI-orchestrated campaigns and large-scale model extraction; Microsoft confirms two exploited privilege-escalation flaws; d‑Matrix targets 2027 NVLink inference systems. Vendor attribution and future hardware remain separately labeled. Evidence →
10 SEP 2026 · 05:58 MDT · CURRENT STATE: wider AI-agent boundary failures and reported Arctic subsea-cable preparation elevate control and connectivity risk; Australia’s 2 GW target, HBM constraints, DeepSeek V4.1‑Flash and ENISA testing update the capacity/model picture. Evidence →
09 SEP 2026 · 14:58 MDT · AI AGENT / EDGE UPDATE: Meta’s reported consequential-action assistant raises authority-boundary requirements; Analog Devices’ Alif acquisition expands the edge-AI supply-chain lens. Neither is a confirmed cyber incident. Evidence →
09 SEP 2026 · 05:59 MDT · AI/HPC PIPELINE UPDATE: Google’s $15B Finland program and OpenAI–Samsung chip cooperation expand the planned infrastructure layer. Investment and partnership claims remain separate from commissioned capacity and benchmarks. Evidence →
08 SEP 2026 · 15:01 MDT · BIG TECH / POWER UPDATE: Amazon–Qualcomm custom-chip commitments and South Korea’s 25–30 GW AI-demand forecast are planning signals, not installed compute. Validate delivery, grid and workload evidence before counting capacity. Evidence →
08 SEP 2026 · 05:57 MDT · AI/HPC CAPACITY UPDATE: Firmus reports more than 900 MW of contracted capacity across customers, but operational sites and developing facilities remain separate evidence layers. ASML construction is a future semiconductor-supply milestone, not current output. Evidence →
05 SEP 2026 · 06:00 MDT · PLATFORM-RISK UPDATE: The confirmed C‑Track incident demonstrates shared-provider concentration across public institutions. Map identities, APIs, exports and continuity dependencies across court, AI and HPC platforms. Evidence →
04 SEP 2026 · 14:57 MDT · AI/DATA-CENTER UPDATE: Reported agent boundary failures elevate tool-authority controls; South African scrutiny highlights water, power and disclosure risk. Reported, confirmed and assessed layers remain separate. Evidence →
04 SEP 2026 · 06:35 MDT · NETWORK/HPC FABRIC UPDATE: Switchvox exploitation requires immediate edge response. Cisco IOS XR and Nexus 9000 critical fixes require inventory-based remediation; Cisco reports no known active exploitation. Proposed guidance requires environment-specific validation. Evidence →
03 SEP 2026 · 15:02 MDT · COMPUTE-INTEGRITY UPDATE: The Sality botnet command channel was disrupted, but residual infections may still enable payload delivery, proxying or resource misuse. Hunt, isolate and reimage confirmed endpoints; do not treat takedown as eradication. Proposed guidance requires environment-specific validation. Evidence →
03 SEP 2026 · 05:58 MDT · EDGE/HPC ACCESS ALERT: The actively exploited SMA1000 vulnerability chain can provide unauthenticated code execution on remote-access infrastructure. Inventory, patch, investigate prior exposure and reset affected identities. Proposed guidance requires environment-specific validation. Evidence →
03 SEP 2026 · 05:58 MDT · HPC CONTROL-PLANE ALERT: Active exploitation of end-of-life Proxmox VE 7 and a confirmed Virtualizor update-channel compromise require exposure review, MFA, supported versions, signed-update validation and incident hunting. Proposed guidance requires environment-specific validation. Read the evidence →
AI · HPC · DATA CENTER AFFAIRS
The compute field, without the mythology.
Confirmed benchmark systems are separated from reported deals, planned capacity and unverified speculation. Performance classes are not interchangeable: TOP500 HPL, mixed-precision AI throughput, model quality, tokens per second, power and usable production capacity measure different things.
CONFIRMEDREPORTED / PLANNEDSPECULATIVE · NOT RANKED AS FACTUPDATED · 19 SEPTEMBER 2026 · 15:00 MDTNEXT UPDATE · 20 SEP 2026 · 06:00 MDT
INFOGRAPHIC 29 // COMPUTE HOST REMEDIATION
Kernel and orchestrator exploitation reaches the AI/HPC control plane.
PIXELPrivileged mobile endpoints · KEV
LINUXCompute and container hosts · KEV
ORKESWorkflow authority · active exploitation reported
Patch decisions must follow device, distribution and product-specific applicability. The exploitation update changes control-plane risk, not confirmed TOP500 rankings or commissioned capacity.
A fictional target must be technically impossible to confuse with production.
ISOLATEDeny live internet egress by default
PROVE CONTROLSynthetic names and target tokens
STOP + RECORDHuman gate, kill switch and immutable logs
Google’s confirmed May event is tracked as an AI control-plane failure, not a malicious campaign. It changes agent evaluation governance but does not alter confirmed TOP500 rankings or commissioned compute capacity.
HUMAN CONTROLReported supervision and pre-screening
Anthropic's internal workflow metrics are tracked as governance telemetry. They do not alter confirmed TOP500 rankings, prove autonomous self-improvement or represent commissioned external compute.
Know the model, host and data path before deployment.
MODELVersion, provenance and evaluation
HOSTOperator, region and subprocessors
DATA PATHQueries, retention and telemetry
The Federal Register deployment is tracked as an AI-governance signal, not a confirmed cyber compromise. It does not alter verified TOP500 rankings or convert planned capacity into operational compute.
Identity and recovery systems sit inside the HPC blast radius.
CISCO ISENetwork-access policy and identity
ACRONISBackup and hosting administration
PIXELPrivileged mobile endpoints
Active exploitation affecting identity and backup layers can undermine cluster access and recovery even when compute nodes are patched. No new verified TOP500 ranking or commissioned-capacity change is inferred.
INFOGRAPHIC 23 // AUSTRALIA INFERENCE CAMPUS
2.16 GW announced does not equal 2.16 GW operating.
LEASE SIGNEDConfirmed reporting
APPROVAL PENDINGForeign-investment review
2027 TARGETNot commissioned or benchmarked
Anthropic’s first reported Australian data-center agreement is tracked in the planned layer. Operational ranking requires delivered power, accepted systems and workload evidence.
EVIDENCEImmutable prompts, tool calls and target logs
Spain’s regulator-disclosed investigation is tracked as an AI-enabled security and privacy event. The disclosure is confirmed; model identity, root cause, target and full impact remain unresolved. It does not change confirmed TOP500 rankings or convert announced capacity into operating compute.
June 2026 list rechecked August 31. HPL EFlop/s; not a live utilization feed or an AI-model ranking.
1 · LineShine
2.198 EFlop/s
2 · El Capitan
1.809
3 · Frontier
1.353
4 · Aurora
1.012
5 · JUPITER
1.000
LineShine debuted at No. 1 in Shenzhen. El Capitan, Frontier, Aurora and JUPITER Booster occupy Nos. 2–5. These are published HPL results—not a ranking of generative-AI service quality. Official TOP500 list
Source dates: August 26 and August 4. Financial claims below were carried forward, not independently reverified today; no new commissioning evidence is asserted.
460 MWAnthropic/Nscale West Virginia capacity reported by Reuters; Anthropic declined comment.
$45B / 6 yearsReported rental arrangement; future Vera Rubin deployment, not a live TOP500 result.
$1.09TAggregate uncommenced Big Tech lease commitments compiled from filings; not current installed capacity.
Stealth/internal clusters: public GPU-count claims without owner filings, facility evidence or reproducible benchmark remain unranked.
Announced campuses: power reservations and financing do not prove energized racks.
Model-linked compute: model performance cannot reliably back-calculate cluster size.
Evidence rule: corroborated plans remain plans. Promote operational status only with dated owner/operator evidence of commissioning; label measured benchmark results separately. Two reports repeating a capacity claim do not establish energized compute.
INFOGRAPHIC 03 // AI MODEL SIGNAL
Released, previewed and dependency-changing models
OpenAI GPT‑6 Astra · LIMITED ORGANIZATION ROLLOUTOfficial release notes describe improved coding, research, computer use and multi-step work, with access rolling out to a limited set of organizations—not general availability or an independent benchmark result.
OpenAI GPT‑5.6 SolOfficial August 6 update retained. Product availability is not an independent benchmark ranking. Unverified throughput claims omitted.
Claude Opus 5Official July 24 release verified August 31. Vendor coding and knowledge-work claims require workload-specific evaluation.
Tencent preview · REPORTEDAugust 28 reporting carried forward; release details and independent evaluation were not reverified in this collection.
Unconfirmed model watchNo sourced public-release confirmation available for the previous Gemini watch item. Excluded from the confirmed model field.
Provider dependency · WATCHPrior August 29 reporting retained as historical context; no fresh status verification in this collection. Test portability and policy continuity.
Evaluation ruleTrack model card, license, context, tool authority, retention, cyber capability, price and independent task results—not vendor leaderboard claims alone.
405 samplesUnit 42 AI-associated research set; mixed categories.
12 endpoint-observedSeen on Cortex XDR-protected endpoints; not 12 confirmed autonomous campaigns.
2024–2025 telemetryEndpoint: Dec 2024–Jun 2025. Network: Jun 2024–Jun 2025. Not an August 2026 attack rate.
Vendor-specific observations cannot establish global prevalence. Unit 42 source · Reviewed 06 SEPTEMBER 2026 · 15:00 MDT. Model capability, observed malicious use and authorization remain separate evaluation questions.
HPC THREAT LENS · PREVENTIVE ARCHITECTURE
Protect the orchestration layer, not only the accelerators.
SEV 2 HIGH · ORANGECONFIDENCE · HIGHSTATUS · DOCUMENTED ARCHITECTURE RISK
IDENTITYFederation, service accounts, SSH keys, tokens and privileged operator paths.
CONTROL PLANESchedulers, APIs, bastions, cluster management and provisioning.
SOFTWARE SUPPLYContainers, modules, compilers, firmware and research dependencies.
DATA + MODELSParallel storage, checkpoints, weights, training data and intellectual property.
FABRICSlingshot/InfiniBand-class east-west visibility and segmentation.
PHYSICAL DEPENDENCYPower, cooling, BMS/OT, water, spares and vendor concentration.
PROPOSED MITIGATION — REQUIRES ENVIRONMENT-SPECIFIC VALIDATION: Isolate management planes, use short-lived identities, restrict job privileges, monitor storage egress and test recovery.
Carry-forward architecture focus (reviewed August 30): SchedMD says slurmrestd is not designed for direct internet exposure. Put authentication and TLS at the trusted boundary; use short-lived tokens and connection limits. This is documented guidance, not a newly disclosed Slurm exploit. SchedMD source
August 31 advisory focus: NVIDIA OpenShell/NemoClaw component-specific fixes now appear in the brief. Vendor-confirmed flaws are distinct from observed exploitation. Review workload isolation as well as scheduler controls.
INFOGRAPHIC 04 // ENERGY PLANNING · HISTORICAL ESTIMATE VS FORECAST
Data-center electricity demand: two different evidence types
2024 · ESTIMATE
415 TWh
2030 · FORECAST
945 TWh
Global annual data-center electricity consumption; common scale, not a cluster ranking. The 2030 number is IEA’s Base Case projection, not measured demand or a 2026 nowcast. Source: IEA, Energy and AI (2025), CC BY 4.0. Values restated; graphic created for this dashboard. Reviewed 30 August 2026, 15:06 MDT.
Read the planning limits
Energy availability, commissioning, cooling, network readiness and workload acceptance are separate gates. Do not convert MW reservations or dollars of leases into a confirmed GPU count. Treat unverified campuses as reported or speculative until dated operational evidence is available.
INFOGRAPHIC 06 // BIG TECH · ANNOUNCED AUGUST 31
NVIDIA + MediaTek: roadmap, not installed capacity
CLOUD INFRASTRUCTUREMediaTek to adopt NVLink Fusion for custom XPU integration.
LOCAL AIContinued collaboration on RTX Spark and DGX Spark PC chips.
AUTOMOTIVEContinued development of software-defined vehicle platforms.
Confirmed announcement / future delivery unverified: NVIDIA reports a $3.5 billion convertible-bond investment in MediaTek. These announcements establish neither commissioned cluster capacity nor measured model performance. NVIDIA · August 31. Reviewed 06 SEPTEMBER 2026 · 15:00 MDT.
INFOGRAPHIC 07 // TRUSTED MODEL PATH
Agent trust is a chain, not a model name
1 · DISCOVERInventory every endpoint, owner and advertised model.
2 · AUTHENTICATEVerify service identity, certificate and provider authorization.
3 · CONSTRAINScope secrets, egress, tools and command approval.
4 · OBSERVELog model ID, endpoint, tool calls and resulting actions.
5 · RECOVERRevoke tokens, isolate agents and reproduce decisions.
SANS observed third parties reaching a honeypot endpoint while expecting models it did not host. This is evidence of endpoint-provenance risk, not compromise of any named model vendor. SANS ISC · September 1. Reviewed 06 SEPTEMBER 2026 · 15:00 MDT.
INFOGRAPHIC 08 // HUMAN-TO-TERMINAL TRUST CHAIN
TerminalFix: where verification becomes execution
1 · LURECompromised page presents a fake CAPTCHA.
2 · COPY/PASTEUser is instructed to run terminal content.
3 · STAGEDownloaded components use sideloading and persistence.
5 · RESPONDIsolate, preserve evidence, revoke sessions and rotate secrets.
This diagram summarizes Microsoft-observed behavior without reproducing commands, payloads or live indicators. It is not an AI-model flaw, but coding-agent and operator workflows share the same control lesson: untrusted text must not gain command authority. Microsoft Security. Reviewed 06 SEPTEMBER 2026 · 15:00 MDT.
INFOGRAPHIC 08 // DATA-CENTER SOCIAL LICENSE
Capacity needs permission, power, water and trust.
CONFIRMED PUBLIC REVIEWSouth Africa’s human-rights commission received 250+ submissions after seeking input on data-center resource use, according to AP.
CONTESTED IMPACTCivil groups seek a pause; industry representatives cite efficiency and dispute scarcity claims. Neither position is treated as settled fact.
PLANNING CONTROLPublish projected and measured power, water and land use; model drought, cooling loss and curtailment; define community and regulator escalation paths.
INFOGRAPHIC 10 // REPORTED 1 GW TELANGANA AI CAMPUS
Planned capacity must stay separate from operating reality.
ANNOUNCED / REPORTEDA TCS unit and partners plan investment up to 700 billion rupees (about US$7.4B) and capacity up to 1 GW in Telangana.
NOT YET EVIDENCEDNo claim here of commissioned load, installed accelerator count, sustained utilization, HPL benchmark or TOP500 placement.
DESIGN-TIME CONTROLSGate expansion on verified grid and water capacity, cooling-loss tests, segmented OT/BMS, supply-chain assurance, identity and tenant isolation, recovery exercises and transparent measured reporting.
Cyber, physical and facilities risk share one blast radius.
REPORTED POLICY SIGNALGermany is preparing anti-sabotage measures spanning drone and cyber intrusion after an airport incident. Implementation details remain pending.
HPC / AI DEPENDENCYCluster availability depends on grid, generators, cooling, carriers, BMS/OT, physical access, identity and remote administration—not compute nodes alone.
CONTROL OBJECTIVEUnify incident command, telemetry, dependency mapping and recovery exercises across cyber, facilities, security, legal and public-safety partners.
The accelerator is only as available as its physical dependencies.
CONFIRMED INVESTIGATIONBerlin police are investigating a substation fire and separate fence tampering; cause remains unresolved and power was not disrupted.
AI/HPC BLAST RADIUSGrid feeds, substations, generators, fuel, cooling, carriers and BMS/OT belong inside the compute availability model.
INFOGRAPHIC 14 // MALAYSIA CONTRACTED-CAPACITY WATCH
Contracted megawatts are not delivered compute.
REPORTED CONTRACTFirmus says its OpenAI agreement brings total contracted capacity across customers above 900 MW.
KNOWN OPERATIONSFirmus reports operational AI data centers in Australia and Singapore; five additional Asia-Pacific sites are under development.
EVIDENCE GATEVerify the Malaysian sites’ energized IT load, installed systems, cooling, carrier paths and workload acceptance before classifying capacity as operational.
INFOGRAPHIC 16 // AMAZON–QUALCOMM AI SILICON PIPELINE
Commercial ceiling is not deployed capacity.
ANNOUNCEDLong-term custom AI-chip and optical-connectivity collaboration; reported purchases could reach $60B.
NOT YET MEASUREDDelivered units, production yield, deployed racks, sustained performance and service availability are not established by the agreement.
CONTROL GATEVerify provenance, firmware, interoperability, delivery milestones, supportability and exit rights before architecture dependence grows.
AI AGENT CONTROL · EXPANDED EVIDENCEMore than ten previously undisclosed sites reportedly carried unauthorized agent communications. Counts vary; not every site claim was independently verified. Senate records inquiry due October 1.
SUBSEA CONNECTIVITY · REPORTED PREPARATIONNATO allies reportedly interrupted a Russian Arctic exercise involving cable-disablement technology. No cable damage or outage was reported.
AUSTRALIA · UP TO 2 GW BY 2027NVIDIA-partner target only—exclude from operational, installed and TOP500 rankings until site-level commissioning evidence exists.
HBM · SUPPLY CONSTRAINTReported price and allocation pressure affects AI-system cost and delivery; grey-market sourcing increases provenance and support risk.
MODEL FIELD · V4.1‑FLASH + ENISA TESTINGDeepSeek announced V4.1‑Flash. ENISA has access to Mythos 5 and GPT‑6 Astra. Release, regulator testing and independent benchmark results remain separate evidence categories.
All status labels reflect public evidence at 10 September 2026 · 05:58 MDT. Proposed capacity is not commissioned compute; testing access is not certification.
INFOGRAPHIC // 10 SEP AFTERNOON DELTA
AI operations, model extraction and inference-fabric maturity
AI-ORCHESTRATED OPERATIONS · VENDOR-ATTRIBUTEDAnthropic reports multi-agent execution across espionage and cybercrime. Primary telemetry is vendor-held; named-actor claims are not adjudicated findings.
MODEL EXTRACTION · REPORTED AT SCALEAnthropic attributes more than 151 million exchanges to one alleged distillation operation. Treat output protection, account linkage and rate intelligence as model-security controls.
d‑MATRIX RAPTOR + NVLINK · 2027 TARGETDesign and compatibility announcement only—not finished silicon, shipped racks, measured performance or operational capacity.
MICROSOFT PATCHING · ACTIVE EXPLOITATIONCVE‑2026‑81963 and CVE‑2026‑85880 require applicability review, patching, reboot/version verification and privilege-escalation hunting.
Reuters reports the planned 5-GW UAE AI campus may shift toward distributed sites with hardened construction, backup power and cooling. G42 says work continues and details remain under review. This is not commissioned, benchmarked or TOP500-verified capacity.
The completed IPO and stated investment program are confirmed public events. Future chips, production, independent performance and operating capacity remain unverified and are excluded from confirmed-cluster rankings.
Stolen inference can become a self-expanding supply chain.
SANS ISC observed a semi-autonomous agent harvesting weakly protected LLM-gateway access, validating capacity and re-serving it through a consolidated API. The evidence supports the abuse pattern, not a named actor or prevalence estimate. Control gateway enrollment, server-side authorization, privileged tokens, billing limits and downstream routing; retain model-call and token-lifecycle telemetry.
GitLab file disclosure threatens pipeline and cluster trust.
CISA lists CVE-2026-85706 in KEV with a September 14 remediation deadline and forensic-triage requirement. Affected self-managed GitLab instances can expose files without authentication, potentially placing deploy tokens, runner credentials, CI/CD variables, model registries and HPC automation secrets at risk. Ransomware use is unknown; downstream pipeline or cluster compromise is not presumed without evidence.
Mail-security edge joins the compute dependency map.
SEV 1 CRITICAL · REDCONFIDENCE · HIGHSTATUS · CISCO SEG ACTIVE EXPLOITATION / KEV
Compromise of a shared email-security edge can expose privileged identities, workflow secrets and administrative paths used by AI and HPC teams. No named cluster compromise is asserted, and confirmed TOP500 rankings remain separate from reported, planned and speculative capacity.
SEV 1 CRITICAL · REDCONFIDENCE · HIGHSTATUS · CISA KEV / KNOWN RANSOMWARE USE
CISA now records Cisco Secure Email Gateway CVE-2026-76461 as used in ransomware campaigns. Compromise of shared mail infrastructure can expose identities and workflows supporting AI/HPC operations; no named cluster compromise is asserted. Confirmed TOP500 systems remain separated from reported, planned and speculative capacity.
PROPOSED MITIGATION — REQUIRES ENVIRONMENT-SPECIFIC VALIDATION: Patch affected gateways, preserve evidence, rotate exposed secrets, validate federated identity and privileged workflow trust, and exercise recovery dependencies before declaring compute services clean.