Key takeaways
- Google Commits $17 Billion to Its First Wyoming Data Center and Builds a 702 MW Fuel Cell Plant to Power It. Treat energy strategy as part of your AI vendor due diligence. Ask cloud and colocation partners where the power for your future capacity will come from, whether it is contracted or merely planned, and who bears the cost of grid upgrades. Google's Wyoming design shows that the providers able to promise dependable AI capacity are increasingly the ones building their own power, and that community cost commitments are becoming a condition of permission to build.
- Uber Says AI Agents Booked Just Four Rides in Its Busiest Week, Against Roughly 320 Million Trips and Orders. Instrument agent traffic before you invest heavily in it. Measure how many transactions actually arrive through AI assistants, and compare the time an agent saves against the speed of your existing app or checkout. Where your own experience is already fast, prioritize protecting the direct customer relationship and treat agent integrations as an inexpensive option, not a core channel. Where your processes are slow and complex, the case for agents is far stronger, and that is where to focus first.
- Democrats Prepare to Take Congress Promising AI Hearings and Guardrails, as Several AI Industry PAC Bets Fall Short. Plan for a federal AI agenda that begins with liability and child safety and widens from there. Inventory every customer facing AI system for exposure to minors, review vendor contracts for how they would allocate risk under a products liability standard, and start assembling the testing documentation that any stricter federal rules would demand. Companies that build that evidence now will shape the hearings rather than react to them.
- OpenAI's Unreleased Cyber Model Built Root Exploits for 948 Linux Kernel Flaws in a Single $1.2 Million Run. Rewrite your threat model so that any foothold on an unpatched system is treated as full compromise. Shorten kernel and operating system patch cycles, prioritize isolation layers such as microVMs and sandboxed runtimes for untrusted workloads, and budget for the coming surge in disclosed vulnerabilities. Automated exploit discovery at roughly $1,279 per flaw means the volume of patches your teams must absorb is about to rise sharply.
Welcome to the DX Today Executive Briefing
The past day delivered a rare alignment of signals about where artificial intelligence is actually headed, as opposed to where the marketing says it is headed. The money is still moving at enormous scale into physical infrastructure, yet the companies writing the checks are increasingly being asked to prove that their power plants will not land on local utility bills. At the same time, the most hyped consumer behavior of the year, AI agents that act on our behalf, is turning out to be close to invisible in real transaction data.
In this edition, we examine Google's $17 billion bet on Wyoming and the 702 MW fuel cell plant built to power it; Uber's blunt admission that AI agents booked just four rides in its busiest week; a newly elected Democratic majority promising AI hearings and guardrails after a midterm in which several AI industry PAC bets failed; and OpenAI's disclosure that an unreleased cyber model built working root exploits for 948 Linux kernel vulnerabilities in a single run. Each story carries a different lesson, but together they describe an industry entering its accountability phase.
01
Google Commits $17 Billion to Its First Wyoming Data Center and Builds a 702 MW Fuel Cell Plant to Power It
Google announced on November 5 that it is building its first data center in Wyoming, an investment the company puts at $17 billion. The announcement, written by Steve Walter, Google's VP of Global Infrastructure and Energy, describes a project in Laramie County developed in partnership with Tallgrass Energy, Black Hills Energy, American Electric Power and Related Digital. On its own, a $17 billion data center would be a notable line item in the AI infrastructure build out. What makes this announcement worth an executive's attention is how the power is being supplied.
According to Google, the project is contracted with AEP to feature a commercial scale 702 MW fuel cell development with carbon capture and storage, which Google describes as the largest planned development of its kind to date. The fuel cells will be made in America by Bloom Energy and convert natural gas into electricity. Google says the project involves capturing and permanently storing a large majority of its carbon emissions underground at Tallgrass's nearby Eastern Wyoming Sequestration Hub. Google is also sourcing power from gas generators operated by Tallgrass Energy and Black Hills Energy, and it says the facility will be air cooled to minimize strain on local water resources.
Read that power plan carefully and a clear strategic pattern emerges. Hyperscalers have spent the past two years discovering that the binding constraint on AI is not chips but electrons, and that waiting in a utility interconnection queue can cost years. Building dedicated generation next to the load, and financing it as part of the project, is a way to collapse that timeline. Fuel cells running on natural gas, paired with geologic carbon storage, are Google's attempt to get firm, around the clock power without abandoning its emissions commitments on paper.
The second half of the announcement is aimed squarely at the political environment. Google says it will pay for 100% of the power it uses and will cover the infrastructure needs directly driven by its growth when it builds data centers. That pledge is an answer to the most potent local objection to AI campuses: the fear that residential ratepayers will subsidize grid upgrades for the largest technology companies. Google is also standing up a Community Council with Tallgrass Energy, Black Hills Energy, Related Digital, AEP and Bloom Energy, a structure designed to give local stakeholders a formal channel into the project.
The economic case Google is presenting is substantial. The company says construction will support more than 8,800 jobs statewide, with an onsite workforce of roughly 2,500 skilled jobs at peak, and approximately $610 million in average annual labor income. Once operating, Google says the data center will support over 3,700 jobs annually, including directly creating 250 roles in the state, and generate hundreds of millions of dollars in local property taxes for Laramie County.
That contrast between 2,500 construction workers at peak and 250 direct permanent roles is the honest arithmetic of AI infrastructure, and it is worth naming. Data centers are capital intensive, not labor intensive. Their local value proposition rests on property taxes, construction activity and supplier spending far more than on long term employment. Executives negotiating their own sites should expect communities to understand that math increasingly well.
For enterprise buyers of cloud and AI capacity, the implication is that the price and availability of compute will be shaped more and more by energy engineering decisions made years in advance. Providers that control their own generation will be able to promise capacity on firmer timelines than those still waiting on the grid.
Strategic Takeaway
CIOs, CFOs, and Infrastructure Strategy Leaders
Treat energy strategy as part of your AI vendor due diligence. Ask cloud and colocation partners where the power for your future capacity will come from, whether it is contracted or merely planned, and who bears the cost of grid upgrades. Google's Wyoming design shows that the providers able to promise dependable AI capacity are increasingly the ones building their own power, and that community cost commitments are becoming a condition of permission to build.
02
Uber Says AI Agents Booked Just Four Rides in Its Busiest Week, Against Roughly 320 Million Trips and Orders
For a year, the technology industry has told a story in which AI agents become the new front door to commerce: you tell an assistant what you want, and it books the car, orders dinner and handles the rest. On November 4, Uber put a number on how that story is playing out in practice, and the number was four. According to TechCrunch's report of Uber's third quarter earnings call, the company said only four rides were ordered through an AI agent during its busiest week in October, the week of Halloween.
The food side of the business was only marginally different. Uber CFO Balaji Krishnamurthy told analysts, as TechCrunch reported, that Uber handled around 320 million trips and orders across Uber and Uber Eats during that Halloween week, but only 500 Uber Eats orders were placed by an AI agent. CEO Dara Khosrowshahi described the traction as very, very early and very limited so far. Uber is not an outlier. TechCrunch noted that DoorDash said on its own earnings call that it had received only a few hundred orders from AI agents to date.
Khosrowshahi offered a revealing explanation for why agents have struggled to gain ground. According to TechCrunch, he noted that the average time to book a ride in the Uber app is only 50 seconds, and reordering a favorite meal takes 90 seconds. When the existing interface is already that fast, an agent has very little friction to remove. The core value proposition of agentic commerce, saving the user time and effort, is weakest precisely in the apps that have spent a decade optimizing for speed.
That does not mean Uber is dismissing the channel. Khosrowshahi said every AI system company is talking to Uber, and that he expects agents to be a net positive for demand on the platform. He also noted there are around eight major AI assistants on the market and that he expects the number to grow to more than 10. In Uber's prepared remarks, he said direct consumer relationships are central to the company's approach to AI, and he cited 215 million monthly active platform consumers. That framing matters. Uber is positioning agents as an additional distribution channel layered on top of its own app, not as a replacement for it.
The strategic tension here is about who owns the customer. An AI assistant that books your ride sits between the brand and the consumer, and every platform that has built a direct relationship has reason to be cautious about handing that position to a third party. Uber's numbers suggest that, for now, consumers are making the same choice on their own. They are going straight to the app.
None of this undermines the case for agents inside the enterprise, where workflows are slow, repetitive and expensive, and where agents can remove hours rather than seconds. But it should recalibrate expectations for consumer facing agent strategies, and for any business plan that assumes customers will soon arrive mainly through someone else's assistant. The gap between the volume of agent announcements and the volume of agent transactions is now measurable, and it is very wide.
The useful discipline for executives is to separate two questions that are often blurred together. One is whether agents will matter. The other is whether they matter to your customers this year. Uber's data answers the second question with unusual clarity, while leaving the first open.
Strategic Takeaway
Chief Digital Officers, Product Leaders, and Heads of Ecommerce
Instrument agent traffic before you invest heavily in it. Measure how many transactions actually arrive through AI assistants, and compare the time an agent saves against the speed of your existing app or checkout. Where your own experience is already fast, prioritize protecting the direct customer relationship and treat agent integrations as an inexpensive option, not a core channel. Where your processes are slow and complex, the case for agents is far stronger, and that is where to focus first.
03
Democrats Prepare to Take Congress Promising AI Hearings and Guardrails, as Several AI Industry PAC Bets Fall Short
The midterm elections have changed the outlook for federal AI policy. Democrats are set to take control of Congress in January 2027, and their leadership is already signaling that artificial intelligence will be on the agenda. California Rep. Ted Lieu, a member of the House Democratic leadership team, said at a post midterm news conference that the new majority would hold AI hearings and pursue reasonable guardrails on AI, according to The National News Desk. Lieu accused President Donald Trump and congressional Republicans of making a conscious decision to let the AI industry run wild.
Advocates are pointing to the electorate as their mandate. An NBC News exit poll found that over half of voters said AI and data centers were a crucial or major factor in their vote for Congress, a finding cited by Common Sense Media founder and CEO Jim Steyer. That finding captures a political reality executives should not ignore: AI and the data center build out have become kitchen table issues tied to jobs, children and electricity bills.
The near term legislative agenda is likely to start narrow. Common Sense Media Chief Advocacy Officer Danny Weiss said the new Congress should revisit two bipartisan bills. The first is the GUARD Act, introduced by Senator Josh Hawley in October 2025 with Senators Richard Blumenthal, Katie Britt, Mark Warner and Chris Murphy, which would ban AI companions for minors, require AI chatbots to disclose their non human status, and create new crimes for companies that knowingly make available to minors AI companions that solicit or produce sexual content.
The second is the AI LEAD Act, introduced by Senate Democratic Whip Dick Durbin together with Senator Hawley in September 2025. It would classify AI systems as products and create a federal cause of action for products liability claims when an AI system causes harm. For enterprise deployers, that is the bill to watch. A products liability standard would change how AI vendors write contracts, how they allocate indemnity, and how much testing evidence buyers will demand before deployment.
The election results also tested the political spending power of the AI industry itself, and several of its bets did not pay off. TechCrunch reported that two AI focused PACs, American Mission and Building the Future, collectively spent $4.8 million backing South Carolina Senate candidate Darline Graham, who lost. According to TechCrunch, American Mission, the Republican spending arm of the Leading the Future network backed by OpenAI president Greg Brockman and Andreessen Horowitz, spent more than $500,000 apiece supporting House candidates Aaron Flint and Laurie Buckhout, both of whom lost. The same report said Leading the Future spent $27.38 million in the primaries, including $8 million opposing New York Assembly member Alex Bores, and told TechCrunch it plans to keep spending in the 2028 elections. On the safety side, TechCrunch reported, the Guardrails Alliance opposed Rep. Jimmy Gomez and Aaron Flint, both of whom lost, and spent $300,000 supporting Angela Gonzales-Torres, who defeated Gomez.
Not everyone expects partisan gridlock to define the outcome. Anton Dahbura, codirector of the Johns Hopkins Institute for Assured Autonomy, said he expects the federal government to change its approach to regulating AI and that new AI centric laws are inevitable. He called concerns that a national safety framework would stop the United States from competing with China overblown, arguing that well thought out regulations could help accelerate the technology by avoiding problems.
For business leaders, the takeaway is that the regulatory pendulum has started to swing, and that liability and child safety are the first places it will land.
Strategic Takeaway
General Counsel, Chief Compliance Officers, and Government Affairs Leaders
Plan for a federal AI agenda that begins with liability and child safety and widens from there. Inventory every customer facing AI system for exposure to minors, review vendor contracts for how they would allocate risk under a products liability standard, and start assembling the testing documentation that any stricter federal rules would demand. Companies that build that evidence now will shape the hearings rather than react to them.
04
OpenAI's Unreleased Cyber Model Built Root Exploits for 948 Linux Kernel Flaws in a Single $1.2 Million Run
The economics of finding software vulnerabilities just changed. OpenAI reported that an autonomous pipeline powered by an unreleased cyber model built working root exploits for 948 distinct Linux kernel vulnerabilities in a single run, as detailed by SecurityWeek. In the mid October scan, AI agents flagged 2,308 potential bugs and confirmed 1,724 of them. In total, the agents produced 1,169 working local privilege escalation exploits, along with 291 proofs of concept for information leaks.
The cost is the headline for every security leader. According to SecurityWeek's account of OpenAI's research, the run cost $1,213,430 in API credits, roughly $1,279 per exploited vulnerability. The pace of improvement is just as striking. An earlier scan in late July, powered by GPT-5.6 Sol, yielded 166 unique local privilege escalation vulnerabilities at a cost of $513,690. Between the two scans, the yield rose more than fivefold while the cost per exploit fell by more than half.
SecurityWeek also put the findings into market terms. Based on typical bounties of $20,000 to $70,000, the 948 bugs would be worth $18.9 million to $66.3 million, or 16 to 55 times what the scan cost. Whatever one thinks of bounty prices as a valuation method, the ratio makes the strategic point: automated vulnerability research is now dramatically cheaper than the human labor market it is competing with.
The testing conditions were realistic. The exploits were tested on virtual machines running an unmodified desktop Linux setup with common protections such as KASLR, SMEP and SMAP turned on, and the scan targeted the latest code in the kernel's master branch. The Neuron noted that the attacks were developed in a controlled research environment and required an existing foothold on the target computer, and that the agents also generated candidate patches for human review. OpenAI said its agents discovered and used at least 10 novel Linux exploitation techniques, and that full technical details are being kept private for safety reasons.
OpenAI described a deliberate disclosure process. Its security researchers checked the exploits, fixes and proposed severities before anything went to kernel maintainers, and the company says it has submitted hundreds of reports and patches, with remaining fixes to be sent in stages through its Patch the Planet initiative. OpenAI also said that within 10 days while the scan was running, over 100 of the vulnerabilities had been patched or had staging patches from other contributors, with about 300 more being publicly discussed. That detail should not be overlooked. Many of these bugs were findable, and some were being found by others at the same time.
The most consequential sentence in the research is its defensive guidance. OpenAI advised that, for the near and medium term, a low privileged account on an operating system that is not fully patched should be considered functionally equivalent to root access for a well resourced attacker, and it pointed to sandboxing and isolation technologies such as Firecracker and gVisor. In other words, the old assumption that limited user access contains the damage of a breach no longer holds against capable adversaries.
The asymmetry cuts both ways. The same capability that lets a defender sweep a kernel for a little over a million dollars will eventually be available to attackers, whether through leaked models, open weight alternatives or simple persistence. The window in which defenders hold the advantage depends on how quickly patches move from discovery to deployment.
Strategic Takeaway
CISOs, Security Architects, and Infrastructure Leaders
Rewrite your threat model so that any foothold on an unpatched system is treated as full compromise. Shorten kernel and operating system patch cycles, prioritize isolation layers such as microVMs and sandboxed runtimes for untrusted workloads, and budget for the coming surge in disclosed vulnerabilities. Automated exploit discovery at roughly $1,279 per flaw means the volume of patches your teams must absorb is about to rise sharply.
The Analysis
The Bottom Line
Taken together, this edition's stories describe an AI industry being asked, from several directions at once, to show its work. Google is not simply announcing a data center; it is publishing a power plan, a cost pledge and a community council because permission to build now depends on them. Uber is not simply praising agents; it is reporting how few transactions they actually generate. And Congress is preparing to ask what happens when AI systems cause harm.
The OpenAI research adds the sharpest edge. Capability is compounding quickly, and the cost of doing serious work with AI, whether finding vulnerabilities or anything else, is falling faster than most organizations can adapt. That is the real executive challenge of this moment: the technology's power is growing on one curve, while the evidence of value in everyday customer behavior and the rules of accountability are developing on much slower ones.
The leaders who navigate this well will hold both truths at once. They will move fast where AI delivers measurable results, in security, infrastructure and internal workflows, while staying skeptical of adoption stories that the data does not yet support, and preparing now for a regulatory environment that is about to become far more demanding.