Who Benefits, Who Pays

On Tuesday, a memo went out from the National Republican Senatorial Committee, the organization that runs Senate campaigns for the Republican Party, addressed to the country’s largest AI companies. It was not about innovation, or China, or jobs. It was about a Senate seat in Ohio, and the committee’s own diagnosis of why that seat is slipping: data centers. The memo, obtained by Axios, says the buildings that house AI computing have become “the anchor hanging around” their candidate’s neck, and it tells the companies that no campaign can fix this for them. The companies, it says, “have to fix how Ohioans see them: who benefits, who pays, and why a community should want one.”
Read that sentence again, because a political party under pressure just arrived at the same question this newsletter has been asking for a year. Who benefits, who pays, and why should a community want one. Then look at the week around it. On Monday, OpenAI agreed to take 8 gigawatts of a planned Ohio computing campus, an amount of electricity on the scale of what millions of homes use, with as much as 105 billion dollars in financing from the chipmaker Nvidia standing behind it. On Tuesday, the same day the memo is dated, Pennsylvania’s governor signed an executive order making his data-center rules legally binding and called them the strictest in the country. And on Wednesday morning, Oklahoma’s own utility regulator took up one of the biggest questions to come before it in years: whether Oklahoma Gas and Electric, the utility known as OG&E, becomes the electric company for Google’s growing set of data centers in this state. Every one of those is the memo’s question with a docket number attached.

If you are new to this story, here is the frame. This newsletter has spent a year watching a single distinction: not whether a government acts on a powerful technology, but whether it leaves a record the public can read. Last issue that distinction ran through Washington, where a finished federal framework for reviewing the most powerful AI systems was shown to five companies and withheld from everyone else. This issue it runs through the places where the technology becomes physical: the substation, the utility bill, the county permit. The machines behind AI live in buildings, the buildings run on electricity, and the electricity is billed through systems that were built long before anyone imagined a single customer asking for the power of a midsized city. Somebody decides who pays for that.

This was the week both political parties, three governors, and one Oklahoma regulator all said out loud, in documents you can read, that the deciding has begun.

And in the second half of this issue, a quieter story with the same shape: the government office that checks whether reported software flaws are real gave up on checking most of them, AI-invented fakes then sailed through, and the office is now asking, in public, whether AI should take over the checking. Who pays is one half of the citizen’s question. Who checks is the other.

THE MEMO

A campaign committee writes the citizen’s question

Start with what the memo is, because the shorthand matters. The National Republican Senatorial Committee is the Senate Republicans’ campaign arm. Its job is winning elections, not making technology policy, which is exactly why its private assessment is worth more than a think tank’s public one. The memo, titled “Ohio Data Center Risk” and dated August 18, concerns the race between Senator Jon Husted, the Republican incumbent, and Sherrod Brown, the Democrat and former senator trying to take the seat back. Ohio is one of the biggest data-center states in the country, and Husted spent years courting the industry. Brown has spent the summer running millions of dollars of ads naming Husted “the face of data centers in Ohio.”

According to the memo, it is working. The committee calls data centers “a sleeper issue for the entire election cycle” and warns that if Husted loses and data centers get the blame, “politicians across the country will take notice” and will not go near the next project. The polling around the race says the ground is real. A Fox News poll of Ohio last week found 65 percent of registered voters opposed to an AI data center being built in their area, against 32 percent in favor. That opposition crosses every party line: 72 percent of Democrats, 64 percent of independents, and 59 percent of Republicans. The same poll put Brown ahead by 8 points. And Ohio is not an outlier. A national Echelon Insights poll in June found only 27 percent of Americans would want an AI data center in their neighborhood, with 62 percent opposed, which made data centers less welcome next door than a nuclear power plant.

What the memo asks for, and what it admits

The memo’s ask is addressed to the companies, and it is blunt. “Campaigns or party committees can not fix the toxic brand of an entire segment of the economy,” it says. The companies that need the projects built have to answer, for the people who will live next to them, who benefits, who pays, and why a community should want one. Strip away the campaign anxiety and that is a demand for legibility. It is asking the industry to produce, voluntarily, the thing this newsletter keeps arguing institutions owe the public as a matter of course: an account a person can check.

What the memo admits, between its lines, is just as useful. For most of the past two years, the argument over AI infrastructure ran through Washington as a contest of grand strategy: beat China, win the future, permit everything faster. What the campaign arm is reporting back from Ohio is that the argument voters are actually having is smaller and closer to home. It is about the electric bill, the water table, the noise, and who got to say yes. Those are not anti-technology positions. Fifty-nine percent of Ohio Republicans are not against computers. They are against paying for someone else’s computers without being asked. The distinction matters, because it means the fight is winnable by whichever side makes the costs visible first, and this week both parties started trying.

WHAT PENNSYLVANIA SIGNED

The strictest rules in the country, on paper you can read

On Tuesday afternoon, Governor Josh Shapiro of Pennsylvania signed Executive Order 2026-05, an eight-page document you can read in full on the state’s website, which is a sentence we do not get to write about most of the instruments in this beat. The order takes a set of standards Shapiro proposed earlier this year, called the Governor’s Responsible Infrastructure Development Requirements, GRID for short, and makes them binding. They had been voluntary, a menu of good behavior tied to state support. The Pennsylvania House passed his plan with votes from both parties; the Republican-led Senate did not take it up. So he used the executive pen, and he built the order to survive a fight, including a severability clause, the legal provision that keeps the rest of an order standing if a court strikes one piece.

Here is what a data-center developer in Pennsylvania now has to do, in plain terms. Sign a consent order, which is a legally enforceable promise to the state, with penalties for breaking it, before the environmental agency will even evaluate a permit. Bring your own power, including a share of clean energy, rather than drawing down the supply everyone else depends on. Pay for the grid upgrades your project requires, instead of spreading those costs across every household’s bill, which has been the standard practice. Get the local community’s approval before construction begins. And operate in the open: the order bars the use of nondisclosure agreements on data-center projects, the confidentiality contracts that have kept many deals secret until the ground was already broken, and it stands up a public tracker at the environmental agency where anyone can watch permits move. Shapiro also pulled data centers out of the state’s fast-track permitting program entirely. His words at the signing were not diplomatic: this is the most stringent set of requirements in the country, and developers who will not follow them “shouldn’t plan to do business here.”

The number underneath it

One number from the signing ceremony explains the politics better than any strategist could. Patrick Cicero, a lawyer with the Pennsylvania Utility Law Project, which represents low-income ratepayers, said that in 2025 almost 290,000 Pennsylvania residents had their electricity shut off for nonpayment, a 14 percent increase over the year before. How much of a rising electric bill actually traces to data centers is a real question, and the Oklahoma section will complicate it. The political fact is simpler: the AI buildout and the higher bills arrived in front of the public at the same time. Shapiro says more than 100 data-center proposals are under discussion in his state, many of them speculative, meaning projects announced without the plans or the financing to actually happen. A governor who is widely discussed as a presidential contender just bet that the winning position is making them pay their own way, in writing, where everyone can check.

For a legislator or a city council member, the exportable part of Pennsylvania’s order is not the strictness. It is the two transparency pieces, which cost almost nothing. First, the ban on nondisclosure agreements for data-center deals: a community cannot weigh a project it is contractually prevented from hearing about. Second, the public permit tracker: a single page where a resident can see what has been proposed, where it stands, and who signed what. Any state or county can build both without deciding whether it is pro-growth or anti-growth, because neither piece blocks a project. They only make the project describable. If a developer’s case for a data center cannot survive being described, that is information too.

THE SCALE ON THE BALLOT

What 8 gigawatts means

The reason this argument arrived in campaign memos and executive orders in the same week is that the numbers crossed a line where ordinary intuition fails, so let us slow down on one of them. On Monday, OpenAI announced it had agreed to secure 8 gigawatts of capacity at a planned computing campus in Pike County, Ohio, a project CNBC has reported could reach 10 gigawatts and cost more than 500 billion dollars, with Nvidia, the company whose chips fill these buildings, backstopping OpenAI’s share with up to 105 billion dollars in financing. A gigawatt is a billion watts, which is a number without a feel to it, so use CNBC’s yardstick: 10 gigawatts is roughly the annual electricity consumption of 8 million American households. One campus, in one county, asking for the power of a state’s worth of homes.

That is the scale that turned a utility question into a ballot question. When a factory came to town in the last century, it hired the town. A data center at this scale employs hundreds once built, not tens of thousands, while its electricity demand lands on a regional grid that every household in the region pays to maintain. The benefit concentrates and the cost spreads, unless somebody writes rules that say otherwise. Which is exactly why “who benefits, who pays” is the correct question, and why the answer cannot be worked out privately: the grid is a shared instrument, and changes to who pays for it are changes to everyone’s bill.

The politics are moving faster than the concrete. In Texas, Governor Greg Abbott, who once called his state the epicenter of AI development, is now moving to restrict data centers in rural communities and to strip tax incentives, after his Democratic challenger branded Texas “the wild west of data centers.” On August 3, Abbott went further: he ordered state regulators to audit the data-center projects waiting in line to connect to Texas’s grid, roughly 474 gigawatts of requests, before any new one plugs in, and the state’s grid operator paused its approval process in response. In New York, two state cases are still open: one a yearlong pause on permits for new large data centers while standards are written, the other on whether the biggest power users should pay extra for the grid capacity they demand. Add Pennsylvania’s order and the Ohio race, and the pattern is not partisan. It is directional. The era in which a data center could arrive quietly, under a nondisclosure agreement, with its grid costs folded invisibly into everyone’s bill, is closing in public, one document at a time.

THE OKLAHOMA TURN

The question on Wednesday’s agenda

On Wednesday morning, while the national press was reading the Ohio memo, the Oklahoma Corporation Commission, the three elected officials who regulate this state’s utilities, met on a question one trade publication called among the largest to come before the agency in years: whether to pre-approve three electric service agreements, in a case numbered PUD2026-000031 that anyone can look up at the Commission, that would make Oklahoma Gas and Electric the power provider for Google’s expanding set of data centers in Oklahoma. OG&E filed the application in May, after signing contracts with Alliance Site and Grid, LLC, a wholly owned Google subsidiary. The facilities are in Stillwater, in Muskogee County, and in Pryor, where Google already operates what the company describes as its second largest data center in the world. As this issue went to press, the Commission’s decision had not been publicly reported, and we are not going to guess at it. What we can tell you is what the question is, and why the venue matters.

Oklahoma already wrote its rules. Now they get used.

This spring, Oklahoma passed House Bill 2992, the Data Center Customer Ratepayer Protection Act of 2026, unanimously in both chambers. It is now law, at Title 17, sections 900 through 906 of the Oklahoma statutes, and the Corporation Commission runs a public implementation page for it. The law defines a “large load customer” as any new facility adding 75 megawatts or more of demand, data centers, AI facilities, and cryptocurrency mines included, and its core command is the same sentence Pennsylvania put in its order this week: if you strain the grid, you pay for the strain, and the costs do not fall back on households. The Commission is reviewing the special rate structures, called tariffs, that OG&E and the state’s other big utility have drafted for these customers. A separate law, Senate Bill 480, lets a data center build its own power plant behind the meter, meaning on its own property for its own use, bypassing the utility entirely. And last month Governor Stitt and Oklahoma utilities signed a federal ratepayer protection pledge to the same effect. So when the Commission weighs the Google agreements, it is applying rules Oklahoma wrote for itself, in public, before the biggest customer arrived. Whether the rules hold is precisely what pre-approval hearings exist to test.

The honest version of the bill question

Now the complication we promised, because this newsletter does not get to demand honesty from institutions and then simplify for effect. On August 13, at a public library in Tulsa, the Commission’s public utilities director sat on a panel with an AARP advocate and two state legislators, one Republican and one Democrat, to answer residents reporting sticker shock at their summer electric bills. Their answer, reported by Oklahoma Watch, was that data centers are only part of the story. Regional transmission costs are rising, summer air conditioning load is what it always is, and the grid itself is old and being rebuilt at ratepayer expense. All of that was pushing bills up before the first hyperscale project broke ground. The honest sentence is that data centers are a large new pressure arriving on top of pressures that were already there. Hold on to that, because a movement built on blaming one villain for a bill with four causes will win its first election and lose its first audit. The strength of Oklahoma’s approach, and Pennsylvania’s, is that neither depends on the villain theory. Pay your own way is a fair rule even in a world where your neighbor’s air conditioner is also real.

November 3, twice

One date to write down. On November 3, Oklahoma elects a new member of the Corporation Commission, the body deciding all of the above; the House author of HB 2992 is among those running for the seat. On the same day, the Commission holds the merits hearing in PUD2026-000046, the data-center rate case this newsletter has tracked since summer. The same Tuesday, this state votes on who the referee is and the referee hears the case. If you want a single day to pay attention to Oklahoma utility regulation, that is the one.

For an Oklahoma legislator, the working question this fall is not whether to welcome the data centers. That decision is being made deal by deal at the Commission, under the statute you already passed. The question is whether the record will be good enough to check later. Three specifics: ask the Commission to publish, in one place, the tariff terms each large load customer actually signs, not just the template; ask whether the 75 megawatt threshold in 17 O.S. § 900 is catching phased projects that arrive in 60 megawatt slices; and ask what reporting the pre-approved agreements require after the project goes live and starts drawing power, because a promise measured never and a promise never made read identically on a bill. HB 2992 passed unanimously. Its implementation should be legible enough that the same unanimity can verify it worked.

THE CHECKERS

Fifty-five reports, fifty-four fakes, one official record

The second half of this issue is about a different shared instrument, and it needs three plain definitions up front. A software vulnerability is a flaw that lets an attacker do something the software’s owner never intended. When one is reported, it gets a CVE, a Common Vulnerabilities and Exposures entry, which is the ID number the whole world uses to talk about that specific flaw. And the National Vulnerability Database, the NVD, run by the federal standards agency NIST, is the United States government’s official record of those flaws, the reference that security scanners, hospital IT departments, and defense contractors all treat as ground truth. When a flaw lands in the NVD with a severity score, systems everywhere begin acting on it. It works on trust, and until recently, the trust had a human floor under it: NVD analysts checked and enriched what came in.

This summer, researchers at the security firm JFrog audited a batch of alarming new advisories about SQLite, a piece of database software so widely embedded that it is running, statistically speaking, on the device you are reading this on. The advisories described critical flaws, with severity scores as high as 9.8 out of 10. JFrog found that the flaws did not exist. The functions named in the reports were absent from the cited versions. The proof-of-concept attack code crashed nothing. The advisories read as AI-generated, and none of the supposed flaws appeared on SQLite’s own advisory page. Widening the audit, JFrog examined all 55 advisories posted by the same new GitHub account over a few days: 54 were entirely fabricated, and the one real bug came wrapped in false details. These were not caught at the door. They received official CVE numbers, entered the National Vulnerability Database, were enriched by a team at CISA, the federal cybersecurity agency, and one was briefly scored a perfect 10.0 by a major software vendor before being marked down. JFrog’s structural finding is the sentence to keep: no step in today’s pipeline requires anyone to reproduce the bug. A plausible fake passes every checkpoint because no checkpoint checks.

The referee had already put down the whistle

The reason no checkpoint checks is not laziness. It is arithmetic, and the government published it. On April 15, NIST announced it was ending its longstanding attempt to analyze every CVE. Submissions grew 263 percent between 2020 and 2025. In 2025 the NVD team enriched nearly 42,000 entries, 45 percent more than in any previous year, a record output, and still fell further behind. So NIST moved to triage: flaws known to be actively exploited, flaws in federal software, and flaws in formally designated critical software get checked; everything else is filed as lowest priority. Roughly 29,000 backlogged entries were moved into a category named, with unusual candor, “Not Scheduled.” They remain in the official record. Nobody is assigned to verify them. And the volume has kept climbing: by mid-August, one tracking service counted 50,340 vulnerabilities reported in 2026 so far, more than 72 percent above last year’s pace, with AI-assisted discovery widely credited as a driver. AI made finding flaws cheap, and it made inventing flaws free, and both arrive at the same overwhelmed desk.

Should AI check the checkers

Which brings us to the document that makes this a current story rather than a sad one. On August 12, NIST published a formal Request for Information, a public questionnaire any citizen or company can answer, on modernizing the National Vulnerability Database “in the age of artificial intelligence.” Comments are due October 13. Underneath the procedural language is one live question: which parts of the checking should AI do? NIST disclosed in an accompanying post that it has already begun building a tool, named V-etalon, that uses AI to help enrich vulnerability records. Read the arc end to end. In April, the human referee announced it could not check everything. In July, AI-fabricated flaws cleared the pipeline and landed in the official record with government enrichment attached. In August, the referee opened a public comment period on whether AI should take over the checking. There may be no better answer available; the volume is not going back down, and an AI assistant with human spot-checks may genuinely beat an honest backlog. But notice what kind of question it is. It is not a technical question about scanners. It is the question this newsletter asks about every instrument: when the check itself is automated, what record does the checking leave, and who audits the auditor? NIST is, to its credit, asking in public, with a docket number and a deadline. That is the difference between this story and the framework story from last issue.

For a policymaker, the NVD story is a preview of a decision every verification institution will face this decade: courts with AI-drafted filings, agencies with AI-generated comments, journals with AI-written papers. The pattern to copy from NIST is the open comment period; the pattern to fix is the missing reproduction requirement. Two concrete asks for the October 13 docket, from anyone, including a state office: first, that any AI enrichment tool publish its error rate against human audit, on a schedule, as a condition of use; second, that submissions carrying working proof-of-concept code get a verification lane, so the system stops treating a reproducible report and a plausible paragraph as the same object. A database the whole economy treats as ground truth should be able to say, entry by entry, whether a human, a machine, or nobody checked it.

THE SAME QUESTION TWICE

Who pays, who checks

Set the two halves of this issue side by side, because they are one argument wearing two coats. The data-center fight is about who pays: whether the costs of the AI buildout land on the companies that profit from it or spread invisibly across every household’s bill. The vulnerability-database story is about who checks: whether the claims a whole economy acts on are verified by anyone, and by what. In both, the failure mode is the same. It is not malice. It is illegibility. A grid charge folded silently into a bill and an unverified entry sitting in an official record do the same thing to a citizen: they present a conclusion while withholding the working.

And in both, the fix that actually moved this week was the same fix. Pennsylvania did not ban data centers; it banned the nondisclosure agreements around them and published a permit tracker. Oklahoma did not block Google; it passed a statute, posted the implementation page, and scheduled the hearing. NIST did not quietly bolt an AI onto the database; it opened a docket with a deadline and named the tool it is building. None of these guarantees a good outcome. What they guarantee is that a bad outcome will be checkable, attributable, and correctable. Last issue ended on a federal framework nobody outside a private room may read. This issue ends on a week when a campaign committee, two governors, a state legislature’s unanimous statute, and a standards agency all reached, under pressure, for the readable version instead. The public stopped taking the bill on trust, and the institutions started showing their work.

SIGNAL / NOISE

Signal. The signal this fortnight is money moving toward the question of who benefits, from an unexpected direction. OpenAI announced grants to 14 independent organizations to study economic policy for the AI era, following through on a commitment it made in April. One example: the Tax Foundation, a longstanding tax-policy research group, will study how AI adoption could shift public revenue among labor income, corporate profits, and capital gains, which is the machinery underneath every “who pays” fight this issue describes. Take the company’s framing, and its claim of a billion users, as the company’s own; what is signal is the subject. When the largest AI lab funds research into how the tax base survives its own product, it is conceding, usefully and in public, that the question is real. That research will be published where legislators, including Oklahoma’s, can read it, and this newsletter will read it when it lands. The adjacent signal is European: on August 2, the EU’s new AI transparency rules took effect and enforcement began, meaning chatbots in Europe must now disclose they are AI and generated images must carry labels, a legibility rule of exactly the kind this issue keeps finding, now operating at the scale of a continent.

Noise. The noise is the sentence you will hear at every town hall this fall: data centers are why your electric bill went up. Oklahoma’s own regulator answered it in a Tulsa library on August 13, and the answer is that the bill has at least four authors: rising regional transmission costs, ordinary summer air-conditioning load, decades of grid investment coming due, and, yes, the new large loads. The single-villain version is noise not because it is friendly to data centers but because it is fragile. A ratepayer movement built on one villain collapses the first time a utility shows the other three causes, and the real reform, making every large new load pay its own way, does not need the exaggeration. The strong version of the argument survives an audit. Use that one.

BY THE NUMBERS

65 percent: The share of Ohio registered voters who oppose an AI data center being built in their area, in a Fox News poll reported last week. Opposition held majorities in both parties: 72 percent of Democrats, 64 percent of independents, 59 percent of Republicans.
8 gigawatts: The capacity OpenAI agreed on Monday to secure at the planned Pike County, Ohio campus, backstopped by a 105 billion dollar commitment from Nvidia. The full 10 gigawatt project is roughly the annual electricity consumption of 8 million American households, by CNBC’s analysis of federal energy data.
290,000: Pennsylvania residents whose electricity was shut off for nonpayment in 2025, a 14 percent increase over 2024, per the Pennsylvania Utility Law Project at Tuesday’s executive-order signing. The context in which every data-center megawatt now arrives.
100 or more: Data-center proposals under discussion in Pennsylvania, by Governor Shapiro’s count at the signing, “many of them speculative,” announced without the plans or financing to be built.
75 megawatts: The demand threshold at which a new facility becomes a “large load customer” under Oklahoma’s HB 2992, now 17 O.S. § 900, triggering the pay-your-own-way rules the Corporation Commission is implementing.
54 of 55: Vulnerability advisories from a single new GitHub account that JFrog’s audit found to be entirely fabricated, likely AI-generated. They received official CVE numbers and entered the National Vulnerability Database with federal enrichment before anyone reproduced a single one.
29,000: Backlogged vulnerability entries the federal government moved to a category called “Not Scheduled” on April 15, meaning they sit in the official record with nobody assigned to verify them.
50,340: Software vulnerabilities reported in the first eight months of 2026, per the tracking service CVE.ICU, more than 72 percent above last year’s pace.
October 13: The deadline to comment on NIST’s public question of whether, and how, AI should take over enriching the National Vulnerability Database. Federal Register document 2026-16371. Anyone may file.

WHAT TO WATCH

The Oklahoma Corporation Commission’s decision on the three OG&E and Google service agreements taken up Wednesday; we will report what the record shows next issue. Judge Rita Lin’s summary-judgment ruling in Anthropic’s lawsuit against the Department of War, over the Pentagon’s move to blacklist the AI company as a supply chain risk after it refused military surveillance and autonomous-weapons uses; the ruling had not issued as this went to press, and at the July 30 hearing she said the government’s record had, if anything, gotten worse. The GLM 5.3 release, an open-weight AI model, meaning one whose full inner workings anyone will be able to download and run, which the developer has held for a safety review expected to end on or about August 28; competing benchmark claims about that model are circulating and none is verified against a primary source, so treat every number you see about it as a vendor claim until the weights and papers are out. The NIST comment docket, open through October 13. And November 3 in Oklahoma: the Corporation Commission election and the PUD2026-000046 merits hearing, on the same day.

FROM THE ANALYSTS

A disclosure section, because this newsletter holds itself to the standard it asks of others. This issue names OpenAI, Nvidia, Google, and Anthropic in factual reporting. Anthropic appears twice: its federal lawsuit is carried as a watch item, and this newsletter is produced with substantial help from Claude, an AI system made by Anthropic. We keep that fact in every issue where the company appears, so you can weigh our reporting on it accordingly; the litigation coverage here is limited to the public docket and the courtroom reporting of others. On the data-center half: this newsletter’s authors are Oklahoma ratepayers on the same grid these projects will join, which is a stake, and we would rather you know it. Two more stakes belong on the same table. David Birdwell has advocated publicly for Phoenix Wells, a plan to convert Oklahoma’s abandoned oil wells into geothermal power and edge computing, which sits directly on the power and access questions this issue analyzes, and he has proposed HAICTA concept legislation to Oklahoma legislators. In July 2026, Humanity and AI also applied to Anthropic’s Fellows research program. Nothing in this issue was shown to, sponsored by, or reviewed by any company or campaign named in it.

On method, one note we owe you. The Corporation Commission met on the Google agreements the morning before this issue closed. We could not find a public record of the outcome by press time, so we reported the question and not a result. If the decision published while this was in your inbox, the record at the Commission is the authority, and next issue will carry it. We would rather be a day behind the docket than an hour ahead of it.

The Inference is written for the person who has to live with these systems, not the person building them. If a term in this issue was unclear, that is our failure, not yours; reply and tell us which one, and we will define it better next time.