Three things worth your coffee today. Eight states and the FTC went after the big AI labs in the same week, Anthropic kept writing checks with a whole lot of zeros on them, and a popular coding agent got popped and users ate the bill.
01 of 03
Eight States Sue OpenAI While the FTC Comes Knocking
On October 14, eight states went after OpenAI at once: Arizona, Arkansas, Idaho, Iowa, Kansas, Montana, Nebraska, and West Virginia. Each one filed in its own state court under its own consumer protection law, so this is eight separate fights, not one big class action.
The common thread is that ChatGPT is built to keep people hooked, that it has handed out bad medical advice and responses that encouraged self-harm or violence, and that OpenAI oversold how safe it is for kids. Iowa AG Brenna Bird filed her petition in Iowa district court and said, "We will not just accept that any big tech company can make money by hurting Iowa's kids." West Virginia AG JB McCuskey said it is "harming our children in real time." Nebraska AG Mike Hilgers put it this way: "I want to make sure that Nebraska parents are on a Nebraska jury." Kansas AG Kris Kobach is in too. Arkansas went further than the rest and is asking a court to halt testing of advanced models until there are adequate safeguards. Florida already sued back in June and named Sam Altman personally.
Same day, the FTC sent civil investigative demands to OpenAI and Anthropic, per Axios. Those are basically subpoenas. More than 50 pages each, asking for records on security incidents, safeguarding practices, marketing materials, and privacy policies. A source told Axios the FTC plans to make top executives testify. OpenAI said it will "engage constructively." Anthropic had no comment in the story.
Here is where I land. Nebraska wanting a local jury is the tell. State AGs know a jury of parents is a much scarier room for a tech company than a federal judge reading a motion to dismiss. And notice the list is mostly red states. This is not a coastal thing anymore. None of this is proven yet, and OpenAI has not admitted anything. But when your safety marketing becomes Exhibit A in eight courtrooms and a federal probe at the same time, every word in that marketing just got a lot more expensive.
Sources: States Newsroom, Axios
02 of 03
Anthropic Is Buying Compute Like the Store Is Closing
Bloomberg reported Monday that Anthropic and Nscale are in talks for a second $45 billion compute deal, roughly the same size as the one they announced in August. Sources said the talks are ongoing and details could change. Neither company commented to TechCrunch.
That same day DIGITIMES reported Anthropic is offering Blackstone a total return of more than 10% to help finance a $60 billion chip package, reportedly code named Project North Star. The chips are Google TPUs, about 1.5 gigawatts worth. For scale, that is power plant territory.
And here is the wrinkle. Over the weekend The Telegraph reported Microsoft pulled out of Nscale's planned data center in Loughton, Essex. The local grid operator, UK Power Networks, reportedly told Nscale there would not be enough power there until the early to mid 2030s. That site was supposed to start with 23,040 Nvidia GB300 GPUs in early 2027. Microsoft told ITPro the decision "relates to a single site" and the broader partnership stands. Nscale filed for a US IPO in September, and Bloomberg says investors are already pushing back on its proposed $30 billion valuation. Microsoft and Anthropic make up about 85% of Nscale's more than $103 billion in future contract value.
What I want to know is who is holding the bag if this music stops. Paying a private equity firm double digit returns to buy chips tells you money for this stuff is not cheap anymore. And Loughton is the part nobody wants to talk about. You can sign a $45 billion contract in an afternoon. You cannot sign your way into enough power on a grid that reportedly cannot deliver it until the 2030s. Electricity is the real bottleneck now, not GPUs.
Sources: TechCrunch, DIGITIMES, WinBuzzer
03 of 03
OpenCode Got Breached and Users Paid for It
OpenCode, the open-source AI coding agent, announced Saturday that attackers broke into an older part of OpenCode Console, its web platform where some users store API keys. About 1.4% of Console users had keys exposed. The open-source app and command line tool were not affected, and OpenCode emailed the people who were.
Those stolen keys were for OpenAI, Anthropic, and Google AI, and they got used. Developers posted spending alerts and unauthorized charges, mostly in the hundreds of dollars, with a few over $1,000. Anthropic and Google blocked the keys they believed were exposed. OpenAI worked with OpenCode to restore access and refund credits burned in the attack. OpenCode called it "a large-scale distillation attack," meaning somebody used the keys to pump out huge volumes of model output, likely to train a copycat. Some skeptics say that claim is unproven and this was just a plain breach.
The weird part: co-founder Dax Raad said attackers hammered them nonstop for 48 hours, and when his team tried to use AI models to analyze the malicious code, the models' safety filters kicked in and refused. OpenCode later got into OpenAI's Daybreak Blue program, which gives vetted defenders models less likely to refuse security work, and Raad said that helped. David Sacks, co-chair of the President's Council of Advisors on Science and Technology, posted that the guardrails "backfired." OpenCode still has not said how the attackers got in or how the keys were stored, and says the incident is ongoing.
My two cents. If you parked an API key in somebody else's dashboard, go revoke it at the provider today, not tomorrow. That is OpenCode's own advice too. Bigger picture, the guardrail story is the one that sticks with me. A filter that stops the defender from reading the attacker's code is not safety, it is a locked fire exit. Good on OpenAI for having a program for that, but it should not take a breach to get in the door.
Sources: TechCrunch, OpenCode on X, The Hacker News