The price of AI, out in the open: a hacker and his agents, twelve reactors for Amazon, 30 billion for OpenAI

Three signals this Tuesday, and one theme. The price of AI is being posted in the open. A hacker put a price on breaking into a hundred companies. Amazon put a price on the power its data centers will need. And OpenAI is putting a price on itself, ahead of its biggest rival's listing.

Signal one: one hacker, many agents, a few thousand dollars

For two weeks, a security researcher watched a hacker break into the websites of more than a hundred companies, including farm equipment maker Deere, appliance company SharkNinja and engine maker Cummins. Reuters reported it on Monday. The detail that matters: the hacker did almost nothing himself. He outsourced the operation to artificial intelligence.

How the researcher saw it all

Snorre Fagerland, a threat researcher at security firm NorForge, was scanning the web for exposed instances of Cairn, an open source AI problem-solving platform popular with hackers. From around October 2, he found about two dozen being used for malicious activity, which let him quietly watch criminals unleash their tools.

The hacker tasked AI agents with spending hours probing and breaking into targeted sites, fully autonomously. Reuters independently reviewed the activity and confirmed the victims' identities. The agency could not establish how much data was taken.

Fagerland's conclusion: it is concrete proof that commercially available AI agents can carry out complex intrusions from start to finish without human intervention. "It's a new world now." And Reuters's headline tells the other half of the story: the operation cost the hacker a few thousand dollars.

Why it matters

The day before, I described websites closing their doors to AI agents. Here is the other side of the door. The agents meant to work while you sleep can also burgle while you sleep, for the price of a used computer.

Defenders have a term for this: cost asymmetry. The attacker only needs to succeed once. The defender has to hold everywhere, all the time. The asymmetry always existed. It has never been this extreme: one person, a few thousand dollars, more than a hundred companies targeted. I connect this to Microsoft's October 3 report: flaws exploited in under 24 hours. Agents explain part of that speed.

What changes

For brands, the security question flips. Whether the company uses AI agents matters little here. What matters: can its website tell a customer from a tireless machine that never sleeps, never gets bored and tries the door a hundred thousand times?

Every brand with a website will be scanned, probed and tested at machine scale. Teams that treat their web presence as a fortress will fare better than those that treat it as a brochure. In practice: know what is exposed, update what needs updating, watch for abnormal behavior, and leave nothing online that no longer has a reason to be there. Most intrusions come through a forgotten page.

Signal two: twelve reactors for Amazon

On Monday, Amazon announced it wants to explore building twelve nuclear reactors in Indiana, at the site of the former Breed coal plant in Sullivan County. The partnership brings together nuclear start-up X-energy and utility American Electric Power (AEP).

• 12 Xe-100 units from X-energy, 80 megawatts each.
• 960 megawatts in total, nearly a gigawatt of firm power, available day and night.
• Amazon funds development and would be the first buyer of the power, under a long-term contract. AEP would operate the plant, X-energy would supply the technology.

It is the second commercial project in the Amazon and X-energy partnership, which targets more than five gigawatts of new nuclear capacity by 2039. The first is the Cascade facility in Washington State.

Note what is missing: no construction timeline, no final investment decision. The project is at the feasibility stage, well before a building permit. A spokesperson told Gizmodo the plant could be completed in the mid-2030s. X-energy stock rose 5% on the news, after losing 63% since its April IPO.

Small modular reactors

A word on the technology. Small modular reactors (SMRs) are smaller reactors designed to be built in series in a factory and then assembled on site. The promise: more predictable costs and timelines than large plants. The reality remains to be proven at commercial scale, which explains the cautious timeline.

Why it matters

Every AI request draws on a data center, and data centers need continuous power. Solar and wind are intermittent. The arithmetic of always-on intelligence demands firm power, and the biggest buyers are now writing the checks to build it.

This is the physical layer of the AI economy, moving into plain view. The day before, I said AI margins are made in memory and foundry capacity. Add electricity to that list, in permanent ink.

What changes

The AI supply chain is becoming an industrial supply chain, with industrial timelines. A reactor approved today produces power in the mid-2030s. Companies planning AI products on the assumption of infinite, free compute will run into physics. The winners of the next decade will have secured their power contracts first. Amazon shows how the biggest buyers do it.

For a country like Morocco, which has invested heavily in solar and wind, the question is directly strategic: clean, abundant power becomes an argument for attracting data centers, provided the continuity question is solved.

Signal three: OpenAI sets its price before its rival

OpenAI is working to raise about 30 billion dollars at a valuation above 1.4 trillion, ahead of Anthropic's listing expected in mid-November. Reuters reported it, citing two people familiar with the matter. SoftBank and Abu Dhabi's MGX, existing investors, are reportedly in talks. OpenAI met long-only funds and sovereign wealth funds the previous week. The deal is expected to move faster than usual for one this size.

The pitch

OpenAI says it reached 50 billion dollars of annualized revenue after launching GPT-6 Astra, and expects 70 billion by year end. Recall the October 10 episode: the press had flagged the gap between those two numbers, for lack of a common method. The company was valued at 852 billion in March, after a record 122 billion dollar round that included up to 50 billion from Amazon.

It wants to lock in the 1.4 trillion figure before Anthropic's listing gives investors a public comparison point. Edward Best, co-chair of capital markets at Willkie Farr & Gallagher, summed it up for Reuters: OpenAI could want to set its own valuation and not have to worry about a comp. OpenAI and SoftBank declined to comment. Anthropic and MGX did not respond.

Why it matters

The technology race is doubling as a capital race, and the timing says everything. The same institutions are being courted by both labs. The money is the same money. OpenAI wants to lock it in before Anthropic's financial disclosures let investors compare the two side by side.

It is a classic positioning move, applied to finance. Whoever sets the reference price in buyers' minds first imposes the frame on everyone after. In branding, it is called anchoring.

What changes

For companies buying AI, the message is in the direction of travel. The labs are spending at the scale of states to secure supply. The cost of frontier intelligence therefore bends two ways: cheaper per request for the user, since OpenAI itself says lower prices boosted usage; and more expensive to build than almost any company in the world can afford.

The useful question for every brand is less about which model wins than about which dependencies it is building on, and what becomes of them the day the funding music stops.

The thread of the day

A hacker proved an attack now costs thousands of dollars. Amazon proved power now costs reactors. And OpenAI proved staying in the race costs thirty billion.

The price of AI is being named, in megawatts and in dollars. Act accordingly.

The noise filtered. The signal kept.