Titan bug, DMDC breach and a New Jersey air penalty: data centre risk moves off the IT floor

The Titan flaw mattered because of what was missing. The Register reported on 30 September that the service validated the contents of a JSON Web Token, including tenant, audience, app ID and user, but never checked the token's signature. Researcher Faav, working with an AI tool he built called Antares, got into the API through an Azure Cloud Services host and could submit SQL with no valid credentials. Microsoft has since locked down the API and paid a $5,000 bug bounty.

Faav's own blog, quoted by The Register, describes the moment the access landed: "It was 2 AM." He also said he rewrote the post at Microsoft's request, cutting sections and numbers. Microsoft's statement, provided to Faav for that blog, said the disclosure "helped us to better protect our customers by hardening our services."

Power and cooling move to the front of the queue

On the same day, two pieces of infrastructure news landed that had nothing to do with software. Data Center Knowledge reported a $1.07 million penalty from the New Jersey Department of Environmental Protection against a Vineland operator called DataOne. The state said DataOne installed and operated 62 natural gas generators without the required permits. A state official announced the action on 22 September, the outlet said. DataOne disputed the finding on the temporary generators but said it would apply for air permits, according to the New Jersey Monitor.

"AI data centers are increasingly becoming power plants as well as computing facilities," Abhijit Sunil, a senior analyst at Forrester, told Data Center Knowledge. He added that AI infrastructure "can now be deployed faster than traditional permitting and inspection processes were designed to oversee." The same report quoted Luis Fernandes of IDC saying a worldwide operator survey put energy efficiency and renewable energy among the leading resilience and sustainability priorities. The two accounts do not conflict, but they frame the problem differently: one treats on-site generation as a compliance exposure, the other as a procurement preference.

Transparency is getting harder to measure, not easier. POLITICO reported on 30 September that Lighthouse Reports filed a complaint under the Aarhus Convention accusing the European Commission of shielding data centre energy and water use from public scrutiny. The Commission's own figures, cited by POLITICO, put Europe's data centres at 20.7 terawatt-hours of electricity in 2025, about as much as Croatia consumes, and more than 8 million cubic meters of water. That is a 26% rise in electricity and a 52% rise in water against 2024. The totals are drawn from incomplete data and published only in aggregate.

NL Times reported the same day that fewer than a quarter of larger Dutch data centres publish electricity and drinking water figures. The Netherlands Enterprise Agency has data on only 104 of the 186 commercial facilities with at least 500 kW of capacity that the Dutch Datacenter Association counted at the end of last year. Public figures exist for the electricity use of 44 of them and the water use of 47.

"Taking pressure off the grid doesn't eliminate an environmental cost." Abhijit Sunil, Forrester, to Data Center Knowledge

Inside the rack, the cooling stack splits and multiplies

The hardware side of the same problem is fragmenting into layers. SUNON used its OCP Global Summit preview to organise a liquid cooling portfolio around three levels: chip, server and rack, according to TechEdge AI. The event runs 12 to 15 October in San Jose. The same article cites Gartner forecasting 565 terawatt-hours of data centre electricity consumption in 2026, up 26% from 2025, with AI-optimised servers taking 31% of that this year and overtaking conventional servers in 2027. The IEA figure in the same piece is different in scope: about 415 TWh in 2024, roughly 1.5% of global electricity.

Upsite Technologies makes a related point about where the heat actually sits. Its analysis notes that cold plate designs are no longer confined to GPUs, because the networking silicon around them now runs hot enough to need liquid. Broadcom's Tomahawk 6 supports up to 102.4 Tb/s of switching capacity on a single chip, and Cisco's Silicon One G300 offers 102.4 Tbps with 200 Gbps SerDes. Nvidia's Vera Rubin platform, per the same piece, is claimed to cut inference cost per token by up to 10 times against Blackwell.

Vendors brought product numbers to Data Center World Asia in Singapore on 29 and 30 September. Midea Building Technologies, per Thermal Control Magazine, is showing a Magnetic CDU that it says cuts equipment footprint by up to 70% and supports system PUE below 1.2 under suitable conditions, alongside an air-cooled magnetic bearing centrifugal chiller with COP up to 5.4 and an industrial-grade CDU rated at 2.6 MW. Its Keppel-linked Gui'an project claims up to 7,654 hours of free cooling a year at a stable PUE below 1.2. LG Electronics, in its own newsroom post, described a "Chip-to-Chiller" portfolio including prefabricated hydronic solutions, air-cooled centrifugal chillers, Coolant Distribution Units qualified by Nvidia, immersion cooling and Fan Wall Units.

Those are marketing numbers from the companies themselves, and they should be read that way. Independent baselines are less flattering. Data Center List, drawing on Uptime Institute's 2024 survey, puts average PUE at 1.56 across reporting facilities, against 1.09 at Google and 1.17 at Microsoft fleet-wide. The same dataset tracks 6,125 facilities in 183 countries, of which 72 disclose capacity: 29.00 GW of IT capacity disclosed plus 7.27 GW estimated across 843 more sites, implying roughly 45.23 GW of total facility draw at the industry-average PUE.

The grid queue, and who ends up paying

Texas offers the sharpest test of who carries the cost. Inside Climate News reported on 30 September that administrative law judges at the Public Utilities Commission of Texas found El Paso Electric failed to adequately consider alternatives to a 366-megawatt natural gas facility, called McCloud, meant to power Meta's $10 billion, 1-gigawatt data centre in northeast El Paso. The judges recommended approval only on condition that the utility does not pass capital and operating costs to ratepayers, and recommended denial otherwise. The five commissioners have not scheduled a vote.

The filing details are specific. El Paso Electric applied in December to build the plant from 813 modular natural gas generators supplied by Enchanted Rock, each rated at 450 kilowatts, at an estimated cost of $499 million. The plant would supply Meta exclusively for five years before connecting to the wider transmission system. The judges wrote that Wurldwide, a Meta subsidiary named in the application, drove the process. "We're disappointed," said Verónica Carbajal of the Sembrando Esperanza Coalition, which submitted comments from more than 1,000 people opposing the application.

Missouri shows the same pattern at utility scale. CleanTechnica reported on 29 September that Ameren Missouri filed a long-range plan with the Missouri Public Service Commission that would add 5,400 MW of gas by 2032, an increase of 1,700 MW, delay coal closures including Sioux to 2035 and two Labadie units by six years to 2042, and cut pre-2030 solar investment by 900 MW to 1,300 MW while eliminating new wind before 2030. The Sierra Club's Jenn DeRose said Ameren and tech companies are "gambling with the future of humanity as they power data centers with coal and gas."

Tax treatment is the other end of the same ledger. The Decoder reported on 30 September, citing the New York Times, that Meta saved $3.9 billion in 2025 through a federal research credit by classifying AI data centres as pilot models and Nvidia chips as experimental materials, up from $2 billion in 2024 and $700 million in 2023. Meta's own SEC filings warn the savings could be challenged, and its reserve for uncertain tax positions rose 45% to $18.74 billion, the report says.

Security risk did not stay inside the perimeter either. TechCrunch reported on 30 September that the Defense Manpower Data Center is notifying millions of current and former service members that personal data, including Social Security numbers, was taken over several months between October 2025 and mid-July 2026 through a file-sharing vulnerability. A Pentagon official put the figure at about 2.8 million living people and close to 300,000 deceased, according to CNN and Federal News Network. The records were not encrypted. The U.S. military had 1.3 million active service members as of March.

Read together, the week's disclosures point at a single operational reality: the constraint on AI capacity is no longer only silicon. It is a permit, a signature check, a token, a substation, a water meter and a tax filing. None of those sit in the rack. All of them now decide whether the rack runs.