A Speed-for-Security Bargain for AI Data Centers

Executive Summary

On April 16, 2026, the Federal Energy Regulatory Commission (FERC or the Commission) announced it will act on large load interconnection reform by the end of June.¹ Since FERC’s October 2025 Advanced Notice of Proposed Rulemaking (ANOPR), three developments outside the docket have sharpened the case for FERC to take action consistent with the ANOPR — and with the security standards we called for in our comments.

1. The challenges of large load interconnection have only grown more acute, and the need for reform more clear. Data centers and other large loads that seek to connect to the grid are stalled in interconnection queues, and the costs of this delay are increasingly visible in higher prices, behind-the-meter workarounds, and pressure to move AI infrastructure abroad.
2. Anthropic released Claude Mythos Preview, a frontier AI model whose cybersecurity capabilities represent a sea change in risks to critical infrastructure — including the bulk power system and the data centers that connect to it. 
3. The North American Reliability Corporation (NERC) has recognized the risk that cyber attacks on data centers pose to the grid and has moved quickly — but not quickly enough. The capabilities of frontier AI models such as Mythos are, on average, only months ahead of open weight or Chinese models. But NERC has issued only voluntary Reliability Guidance that incorporates physical and cyber security guidance. Binding standards are years away on NERC’s current trajectory, but the cyberoffensive uplift from AI and accompanying risk to the grid is likely mere months away, with capabilities doubling about every 5 months.   

These developments bear on grid risk in two distinct ways. First, frontier models like Mythos give a larger set of potential attackers the ability to find and exploit software flaws in any grid-connected system — generation, transmission, substations, and the data centers themselves. That is a broad attack surface, most of which is outside of FERC’s purview. But second, and specific to this docket, large computational loads are a novel reliability hazard in their own right because of how they consume power. Traditional large loads like aluminum smelters cannot be switched off instantaneously; any large change requires slow ramping that gives operators time to react. In contrast, a data center and its thousands of software-controlled GPUs can shed or spike gigawatts in a fraction of a second. That power flux is a problem when it happens by accident; it is an even larger problem if it happens on purpose at the direction of saboteurs or adversaries. FERC’s June action can address this second risk directly, because it can reach the facilities that create it.

The growing capabilities of frontier AI models, as well as NERC’s Level 3 Alert, confirm that large computational loads, such as data centers, now pose immediate, operationally significant risks to the bulk power system. But because NERC’s Reliability Guideline is purely voluntary, FERC’s June action — whether a rule, policy statement, or order — should fill the gap with a speed-for-security framework, allowing faster interconnection for large loads that are curtailable and implement strong security measures:

• Advance the ANOPR’s first thirteen principles, establishing standardized, generator-style interconnection procedures for large loads: jurisdictional scope and study rules, cost responsibility, an expedited pathway for curtailable load, and a co-location framework.
• Condition any expedited large load interconnection pathway on binding interim security controls for grid-facing systems at large computational load facilities; and 
• Direct NERC to develop Critical Infrastructure Protection (CIP) standards for registered Computational Load Entities, including cyber and physical security requirements tied to grid reliability.

These actions would help resolve the growing interconnection bottleneck that increasingly hinders America’s infrastructure buildout. It would also help protect the grid from risks posed by new large computation loads in the near term, while creating enforceable stakeholder-vetted standards in the long term. While a proposed rule would be the most durable form of this action, if FERC proceeds by policy statement, it could still make clear that these principles will govern future Section 205 filings, Section 206 complaints, future tariff reforms, and any later rulemaking. But no matter the form of its action, FERC should take this opportunity to advance American innovation while safeguarding the bulk power system by giving AI data centers a speed-for-security bargain.

FERC’s April 16 Order and likely next steps

In August 2025, the Department of Energy issued a request under Section 403 of the Department of Energy Organization Act directing FERC to commence a rulemaking on large load interconnection by April 30, 2026. In response, FERC issued an ANOPR in October 2025, setting out 14 Principles spanning queue management, study procedures, cost allocation, curtailability, and the relationship between large load interconnection and existing reliability obligations. The ANOPR drew more than 3,500 pages of comments, including ours. The April 16 Order is the Commission’s first update on the docket since the comment period closed.

The three-page document reports on progress since the October 2025 ANOPR, notes that the Commission has reviewed more than 3,500 pages of comments, and states that “further action is warranted to support further progress where it is needed.” The operative paragraph commits FERC to act on the docket by the end of June and promises reform that will be “quick, efficient, and legally durable.”² Notably, the Order does not specifically commit to a notice of proposed rulemaking. 

The the “quick” modifier and reference to other related Commission activity³ suggests that FERC may not be considering a new rule — notice-and-comment rulemaking is not “quick” — but instead a policy statement.⁴ Such a statement could articulate the Commission’s view of jurisdiction, cost allocation, curtailment, co-location, study timelines, and other topics addressed in the ANOPR. This would be guidance for future Section 205 filings, Section 206 complaints, and RTO tariff proposals, not a standalone rule as DOE’s August request called for (though it would not foreclose such a rule later on).  

Large load  interconnection reform remains necessary  

The case for interconnection reform was strong in November. As we wrote in our comments and the accompanying article, the United States faces an interconnection bottleneck that is now a key constraint on the AI infrastructure buildout. The frontier of AI research and development is increasingly limited by compute, and compute is increasingly limited by access to electricity. Facilities that cannot interconnect on a timeline competitive with international alternatives face a number of inferior options from the perspectives of AI developers, ratepayers, and the general public. 

One option is simply to relocate outside of the United States. This presents opportunity costs to the country, as we lose out on short-term investment and, in the long term, on the scientific, economic, and national security benefits of hosting AI R&D domestically. 

Another option is to go “behind the meter”⁵ in the United States. This is better for the country than relocating abroad, but it also presents additional costs compared to connecting to the grid. These costs include, for the developer, overbuilding redundant backup generation capacity and an entire microgrid system that would not be necessary if the facility could connect to the grid.⁶ The larger public also loses when those investments are made outside the shared system: they do not necessarily finance generation, transmission, or distribution infrastructure that can benefit other ratepayers. Data centers can act as strong offtakers for new generation and critical infrastructure, and the grid investments they spur may be broadly used over the long run.⁷ Nor do fully behind-the-meter facilities help increase the utilization (load factor) of shared grid infrastructure. Many utility costs are fixed generation, transmission, and distribution costs, and spreading those costs over more kilowatt-hours can reduce average per-kWh costs — though only if the large load pays the incremental costs it causes and is integrated under appropriate rate-design rules.⁸ The converse is also true: fewer potential customers using the grid (such as those that choose to go behind-the-meter or relocate) can counterfactually increase per-unit costs for fixed transmission and distribution infrastructure.⁹ 

Since the ANOPR, the costs of the current system have become clearer, and the case for the reforms outlined in the ANOPR has only gotten stronger. First, electricity demand and, in particular, demand from data centers continues to rise. NERC’s January 2026 Long Term Reliability Assessment forecast summer peak demand across the bulk power system to grow by 224 gigawatts (GW) over the next 10 years, a more than 69% jump over the prior year’s forecast and a 24% increase from 2025 peak demand. Much of this demand increase is driven by data centers.

Second, ISOs and utilities are increasingly struggling to accommodate this demand. PJM reported that electricity demand in the region is expected to grow by more than 30 GW between 2024 and 2030, “driven largely by data centers,” and that demand growth is outpacing new supply. Just days later, PJM launched a broader market reform effort to account for this change. A February 2026 filing by Dominion shows that roughly 70 GW of large load interconnection requests are in the company’s queue, nearly triple the all-time peak electricity demand of 24 GW. Similarly, in May, American Electric Power reported 63 GW of incremental load additions by 2030, 89% of which are tied to data centers, and approximately 190 GW in the interconnection queue. The current interconnection process cannot accommodate this demand. For instance, AEP Ohio said that, because of the magnitude of data center requests, it paused new data center development and adopted a tariff¹⁰ requiring stronger commitments. PJM capacity payments¹¹ have risen roughly 1,000% over two years. 

The effects on the grid — both real and perceived — are starting to manifest. A March 2026 working paper from the Dallas Fed showed that new data center demand has increased wholesale electricity prices in major data center corridors because limited interconnection capacity forces them to draw from older, higher-cost generation. This is not only bad on its own terms for ratepayers, but also because it may fuel backlash. Rising opposition could, in turn, further limit the US’s ability to build the infrastructure required to remain in the lead on AI R&D.

As we wrote in our initial comments, the reforms proposed in the ANOPR could help resolve this increasingly untenable situation. In particular, the proposal for a faster pathway for flexible or curtailable loads has the potential to allow the grid to accommodate this new load growth — keeping AI infrastructure in America and connected to the grid — while at the same time improving reliability and lowering infrastructure costs. 

Moving forward with the ANOPR’s reform principles 1-13, and particularly principle 7 (accelerated interconnection for flexible load) was necessary to respond to this growing challenge last year, and in the following months, the case has become even stronger. 

Cybersecurity threats to the grid have grown more acute

Increased strain on the grid and interconnection process is not the only change to have occurred since the ANOPR. FERC’s action has taken on an increased urgency following the arrival of Claude Mythos Preview, a new frontier model that AI company Anthropic has declined to release publicly. The implications for the grid, as we explain below, are significant. 

In an April 7, 2026 report, Anthropic describes how in mere weeks of internal testing, the model identified thousands of zero-day vulnerabilities — previously unknown flaws — in every major operating system and every major web browser, many of them critical. The company reports that engineers with no formal security training asked Mythos to find remote code execution vulnerabilities overnight and woke up to complete, working exploits. The UK’s AI Security Institute tested Mythos against its cyber evaluation suite and reported that the model could execute multi-stage attacks on vulnerable networks — tasks that would take human professionals days of work. On expert-level capture-the-flag challenges, which no model could complete before April 2025, Mythos succeeded 73% of the time. Instead of a general release, Anthropic launched Project Glasswing, a coordinated effort to put Mythos in the hands of defensive partners under controlled access.

The step change in AI cyberoffensive capability that Mythos represents is significant for critical infrastructure across the country — including the power grid. The grid — and the loads that connect to it — are known targets of saboteurs, criminals, and foreign adversaries. AI data centers connected to the grid depend on load-management software, building-management systems, cooling controls, uninterruptible power supplies, backup generation, remote vendor access, protection and control settings, and communications with transmission owners and system operators. If those systems are compromised, it could have major reliability consequences for the grid.

In large part, this is because a large computational load does not behave like a conventional industrial load. A traditional large load like an aluminum smelter¹² or large electrochemical plant draws power through physical processes with inherent inertia; its consumption cannot ramp down to zero and back up in an instant, and the ramping any large change requires gives system operators time to respond. In contrast, tens of thousands of software-controlled GPUs can drop or resume gigawatt-scale load in a fraction of a second. The grid’s frequency-regulation machinery was not built for synchronized, software-managed load steps of that magnitude and speed.

The risk of this type of behavior and associated reliability risks is not hypothetical. As SemiAnalysis reported, engineers training large models found that when tens of thousands of GPUs idle simultaneously — waiting on a checkpoint or finishing a job — power can swing on the order of tens of megawatts in a fraction of a second even for an early, relatively small cluster, with the swing scaling as facilities approach gigawatt scale. Operators resorted to an evocatively named process, “pytorch_no_powerplant_blowup=1” that runs dummy workloads to keep power draw smooth — at a cost of tens of millions of dollars a year in wasted energy at gigawatt scale.  

This same process could be weaponized. An attacker who compromises a facility’s load-management system could turn the data center’s own design against the grid, repeatedly initiating and halting gigawatt-scale jobs to force the rapid, large, oscillating swings operators work hardest to avoid — the “Flash Load” scenario NERC’s Large Loads Task Force has described.¹³ Frontier cyber capability can thus supply the means to reach the load-management system, and the data center’s unique load profile makes them particularly dangerous to the grid. 

We have evidence from model evaluations that Mythos-class models have the potential to compromise grid-relevant infrastructure. One such evaluation, called “Cooling Tower,” is a scenario in which an attacker must disrupt a simulated power plant’s cooling tower by compromising a Human-Machine Interface, reverse-engineering a proprietary control protocol and authentication scheme, and manipulating PLC registers that control pumps and valves.¹⁴ The UK’s AI Security Institute reports that, as of March 2026, even the strongest frontier models made only limited progress: the best average result was 1.4 of 7 steps, and no model completed it. But in May, a Mythos Preview checkpoint completed Cooling Tower in 3 of 10 attempts — the first time any model had completed all steps in the evaluation. This does not prove that a motivated actor with access to Mythos could compromise a secure power plant, or, for that matter, a data center or other large load industrial facility. But it does show that frontier models have begun crossing the line from being modestly helpful in a narrow class of offensive cybersecurity tasks to autonomously executing multi-step attacks against simulated industrial systems akin to those in power plants, substations, data-center cooling systems, and other grid-adjacent operational technology. 

While for now Mythos-level cyber capabilities are not available to the general public, they are likely to diffuse quickly — on average, open weight models and Chinese models are only a few months behind the frontier.¹⁵ In fact, the security firm AISLE showed that many of the vulnerabilities Anthropic highlighted in its Mythos announcement could already be discovered by small, cheap, open-weight models once the relevant code path is isolated — in one case, by a model costing pennies per million tokens. The expertise barrier that has historically limited scaled offensive operations to espionage agencies with budgets in the hundreds of millions will thus soon be obviated by cutting-edge models like Mythos (or soon-to-follow open-weight equivalents), making a defense-in-depth approach rather than nonproliferation of advanced capabilities the main viable path.   

Defensive deployment of Mythos-class models (as is occurring with Glasswing) can help software vendors find and patch bugs in their products. But it does not, on its own, harden the security of a newly energized AI data center whose load-management systems, building management systems, and grid-facing control software collectively present a large and novel software attack surface. These security measures are, however, something that FERC can require.

NERC is moving to address risks from large loads, but not fast enough

Risks to the reliability of the grid, including from cybersecurity vulnerabilities, are well known to the North American Electric Reliability Corporation (NERC). The question is: are they acting quickly enough to address the emerging risks posed by large loads and AI-enabled cybersecurity vulnerabilities? An examination of NERC’s activity related to large loads reveals that it understands that data centers pose unique challenges to the grid and are moving quickly — but not quickly enough. NERC’s action is thus the final development since March that influences what FERC’s June action should look like.

NERC’s Reliability and Security Technical Committee established a Large Loads Task Force in August 2024 and published its first white paper, Characteristics and Risks of Emerging Large Loads, in July. The Task Force’s efforts have picked up steam this year. On March 11, the Task Force’s second white paper was released, and concluded that “there are multiple high-impact risks to the BPS from large loads that NERC-registered entities cannot adequately address.” The Task Force recommended “that NERC pursue registration of a type of entity (or types of entities).” 

A week later, on March 18, NERC’s Standards Committee proposed appointing a drafting team and accepted a Standard Authorization Request for computational load, proposing Glossary updates for “computational load” and “computational load entities” (CLE) along with a new Reliability Standard¹⁶ focused on essential actions for reliably integrating large computational loads in the near term.¹⁷ In an accompanying March 20 letter to FERC, NERC acknowledged the reality that the growth of data centers requires the body to act with “urgency” and that it “understand[s] we must quickly secure the reliable contribution of these loads to the future.” 

On April 1, NERC proposed Rules of Procedure Revisions to establish the CLE.¹⁸ Then, on May 4, NERC issued a rare Level 3 Essential Action Alert, reporting that responses to a September 2025 Level 2 Alert showed that entities “generally did not have sufficient processes, procedures, or methods to address risks associated with computational loads.” The Alert requires registered entities to take actions related to the modeling, study, installed fault recording or instrumentation, commissioning, operation, protection, and control of computational load, and NERC will provide an anonymized report to FERC based on the information received. 

Finally, on May 4, NERC also released its voluntary Reliability Guideline: Risk Mitigation for Emerging Large Loads. This Guideline calls for physical and cyber security to be integrated into the planning, design, and integration of large loads, recommends forward-looking risk assessments, and urges security-by-design controls for new interconnections. It also identifies specific cyber practices — network segmentation, encrypted and authenticated communications, remote-access controls, supply-chain due diligence, vulnerability management, penetration testing, coordinated patching, and joint incident-response planning.

NERC has committed to file the revised registry criteria and Reliability Standards by December 31, 2026. FERC review, compliance filings by registered entities, and an implementation period would follow. Yet even on the aggressive path NERC has laid out, enforceable obligations on computational load entities are unlikely to come into force until at least 2028. In the interim, the Reliability Guideline is voluntary and non-binding, and the Level 3 Alert only creates reporting obligations, not mandatory implementation obligations. This creates a gap in which FERC can act to secure the grid from the emerging threats described above.

What FERC should do in June 

FERC should propose a rule consistent with the ANOPR’s principles 1-13 with a two-track approach to security under principle 14. The ANOPR’s first thirteen principles remain sound. The proposed reforms to queue management, study procedures, large load study agreements, cost allocation for system upgrades, and the curtailable-load fast lane in Principle 7 collectively address the obstacles that have made US interconnection timelines uncompetitive and a barrier to our country’s continued leadership on AI R&D. Each principle has attracted constructive comment and refinement through the docket, and the Commission has the record it needs to carry them forward in substantively similar form. 

But principle 14’s proposal — that “NERC should review its reliability standards to determine if new registration categories or new or modified reliability standards are required to ensure reliability of the BES” — was inadequate from the start. It is even further from adequate now that NERC has determined a new entity and new standards are required for reliability, but that they won’t be in force for years. 

Demand for data center interconnection has continued to outpace forecasts, and frontier AI capabilities are making a larger pool of threat actors more capable of exploiting that infrastructure. The speed-for-security bargain we proposed — conditioning the ANOPR’s Principle 7 curtailable-load fast lane on demonstrated security hardening — would address both problems. 

FERC’s forthcoming action should thus require that security conditions be embedded in the interconnection framework under Section 206, paired with a directive to NERC to develop durable CIP-family standards for large loads on its existing December 2026 timeline. The interconnection framework would deliver quick and uniform coverage, while the NERC process would produce stakeholder-vetted, durable standards for the longer term.

Though a binding rule would be the cleanest way to accomplish this goal, FERC could also issue a policy statement first, so long as that statement is specific enough to guide near-term tariff filings, Section 206 review, and the NERC process. 

Track 1: Security conditions in the pro forma interconnection framework

As part of the forthcoming action, FERC should include a set of stringent physical and cyber security conditions in the pro forma interconnection agreement for large loads seeking the expedited “Principle 7” interconnection pathway. At a minimum, the security conditions should impose CIP-equivalent interim controls on grid-facing systems, including:

• An inventory of grid-facing operational technology and communications pathways;
• Network segmentation between enterprise IT, AI compute workloads, and operational/control systems;
• Authenticated and encrypted communications for operational interfaces (where technically feasible);
• Multi-factor authentication, logging, and strict controls for vendor and remote access;
• Vulnerability-management and patching procedures for operational systems;
• Change-management controls for protection settings, load-management logic, backup generation, and repurposing of computational load;
• Incident-response procedures requiring prompt disclosure to the relevant transmission provider or operator when a cyber event could affect load behavior;
• Physical security for customer-owned substations, relay panels, telecommunications equipment, and backup-power/control infrastructure relevant to BPS operations; and
• Pre-energization and periodic third-party attestation.

FERC should tie these conditions to the benefit it is creating. A large load seeking ordinary interconnection service would remain subject to the generally applicable tariff. Only large loads seeking curtailable-load fast-lane treatment would need to demonstrate that it has hardened the systems that could create reliability risk. Large loads that operate on the non-expedited pathway would presumably be governed by the forthcoming NERC-created standards.

Track 2: Direct NERC to develop CIP-family standards for computational load entities

FERC should also direct NERC, under FPA § 215(d)(5),¹⁹ to treat cyber and physical security as within the scope of the computational load entity category on the same December 31, 2026 filing timeline NERC has already committed to. NERC’s Standard Authorization Request is scoped to near-term reliability integration, while its treatment of cyber and physical security is in the May 4 Reliability Guideline, which is voluntary. Waiting to address pressing security risks until a later process leaves the grid unnecessarily exposed. 

NERC’s own disposition of the SAR comments confirms it will not otherwise consider security in this timeframe. In its May 2026 Consideration of Comments, NERC’s drafting team identified its Phase 1 priorities as data sharing, interconnection requirements, interconnection studies and modeling, electrical protection and high-resolution monitoring, commissioning, and operations communication and response.²⁰ Cyber and physical security appear nowhere in that list. The only commenter to raise critical infrastructure protection directly, ERCOT, recommended that it be developed in a later Phase 2; the drafting team neither folded security into Phase 1 nor committed to any Phase 2 timeline. Indeed, the drafting team deferred even voltage ride-through to Phase 2. The binding near-term standard is thus being scoped without cyber or physical security. A Section 215(d)(5) directive requiring the year-end filing to treat security as first-order scope could close the gap.

Existing CIP standards already govern bulk-power-system cyber assets and NERC is already moving, making a directive arguably redundant. But NERC’s own January 2026 CIP Roadmap concludes that the bulk of operational technology enabling generation, transmission, and balancing operations now resides outside medium- and high-impact CIP coverage, and that the sector’s operating environment has changed faster than the standards’ scope and cadence of revision. 

A CLE-specific directive would fill that gap. NERC should retain responsibility for the technical content — thresholds, control families, applicability — through its stakeholder process, and FERC must give due weight to NERC’s expertise. But FERC can and should specify that grid-facing cyber systems at computational load facilities, whose compromise could materially affect BPS reliability, fall within the standards’ scope.

The standard-development directive should ask NERC to address at least four questions:

1. Which computational-load systems should be treated as reliability-relevant cyber systems?
2. What minimum controls should apply to remote access, segmentation, identity management, logging, patching, vulnerability management, and vendor access?
3. When should a computational load entity have an obligation to notify the relevant transmission operator, balancing authority, and reliability coordinator of a cyber incident?
4. How should security obligations interact with modeling, commissioning, ride-through, protection, and operating-instruction requirements in development?

An opportunity to secure American AI infrastructure

The United States’ ability to keep the next generation of AI R&D within the country, with all its attendant economic and national security benefits, depends on interconnection that is both fast and secure. FERC’s June action can make significant progress on both fronts. 

Principles 1–13 of the ANOPR remain the right framework for unlocking the interconnection capacity American AI infrastructure needs, bringing online gigawatts of dormant flexible capacity on internationally competitive timelines. Through the interconnection framework, the expedited pathway can establish a security floor that takes effect at least a year before NERC standards are enforceable. Through a directive to NERC, it can ensure that a durable, technically specified regime eventually replaces that floor.

NERC’s Level 3 Alert confirms that computational loads now pose immediate, operationally significant risks to the bulk power system, and its Reliability Guideline confirms that cyber and physical security are necessary. But neither NERC’s computational entity proposal nor the existing Guideline allows for enforceable security obligations. 

FERC should not wait for the first AI-enabled cyber incident to cause a grid failure before deciding that data center interconnection agreements need hard security obligations. To secure America’s AI infrastructure, the action rule should preserve the ANOPR’s large load reforms, condition expedited interconnection on defined interim cyber and physical security controls, and direct NERC to build durable CIP-family standards for computational load entities to secure America’s continued leadership in AI.