The Grid Doesn't Need a Better Model — It Needs a Checksum

Verify the transmission, not the headline.

On a recent news cycle, a crypto-facing outlet pushed a short item reporting that Sam Altman had discussed grid security with power utilities and was "eyeing" a role for AI in cybersecurity. I read it twice and tabulated it. Five information points. Two were the same fact restated in different words. Two were the author's interpretation of what the item might mean for valuations. One was background. Net new verifiable facts: approximately zero. No named utility. No product. No contract value. No timeline. No quote from a utility executive. And yet the item moved a narrative — the story of AI firms positioning themselves as the guardians of the very infrastructure their data centers are straining.

That gap is the actual event. The distance between the volume of narrative and the mass of evidence.

Code doesn't care how loud the press release is. It runs or it doesn't. So before I engage with the story the outlets want me to engage with, I want to look at the load curve, the protocol stack, and the procurement paperwork — because that is where this either becomes real or stays a slide in a fundraising deck.

Context: The Line This Event Sits On

Start with the structural facts that the thin article left on the floor.

OpenAI has spent roughly eighteen months building a government and critical-infrastructure vertical. In December 2024 it announced a partnership with Anduril on counter-drone systems. In 2025 it stood up an "OpenAI for Government" program, signed a pilot of roughly $200 million with the Department of Defense, and deepened research collaborations with the national laboratories — Los Alamos, Sandia and peers. The grid-security discussion is not an isolated brainstorm. It is the logical continuation of a deliberate pivot from "sell tokens to developers" toward "sell capability to states." Read in that sequence, the utility talks are a data point on a trend line, not a headline.

Now layer the second context: electricity demand. After roughly two decades of flat consumption in the United States, load growth re-entered the picture in 2023 and accelerated through 2025. Data centers are the primary driver. The IEA and several grid operators project global data-center electricity consumption could more than double by 2030. OpenAI's own infrastructure ambitions — the Stargate family of commitments — describe gigawatt-scale campus demand. A single gigawatt campus draws roughly what a mid-sized city draws. When the largest new buyer of electricity in a generation walks into a utility's office, the agenda is never a single item.

Third context: the threat is no longer hypothetical. Volt Typhoon, disclosed through 2023 and 2024, described pre-positioning inside U.S. critical infrastructure — including the communications and energy sectors — with the apparent intent to be present rather than to act. Salt Typhoon described large-scale, long-dwell access into U.S. telecommunications carriers. These are not academic white papers. They are the reason "grid security" stopped being a conference panel and became a national-security line item. Any vendor claiming an AI role in this space is claiming a seat at a table that governments are actively re-setting.

So the demand side is real. The threat side is real. The question is whether the supply side — an AI model vendor with no OT history — is real, or whether this is positioning dressed as product.

Here is where I have to be honest about the input. The source item carried no technology detail, no partner names, no pricing, no certifications, no customers. For a reader trying to judge whether this matters, that absence is itself the most important piece of information. I will treat "AI cybersecurity for the grid" as a strategic statement, not a technical solution, because nothing in the record supports the latter.

Core: Why "AI Protects the Grid" Is an Architecture Problem, Not a Model Problem

Let me get to the part that most coverage will skip, because skipping it is how you get a narrative instead of an analysis.

The instinct in every AI-security headline is to imagine a smarter defender out-thinking a smarter attacker. Feed the model the logs. Let it find the intrusion. The mental image is a chess game. The reality is a control system with deterministic timing requirements and a near-zero tolerance for false positives. Those two things are not the same problem, and the second one is where this breaks.

The protocol stack is not the internet

Electric grids do not run on TCP/IP the way a web application does. Generation, transmission and distribution are managed through operational technology — OT — and industrial control systems — ICS. That world speaks SCADA, DNP3, Modbus, IEC 61850, and a long tail of vendor-proprietary dialects. These protocols were designed for reliability and determinism, often decades before anyone thought about adversarial input. Many of them have weak or absent authentication by design. Many assume a physically isolated network.

An intrusion-detection system that works on enterprise IT — parsing HTTP, watching DNS, correlating endpoint telemetry — does not transfer cleanly to a substation speaking DNP3 over a serial link. The data shapes are different. The semantics are different. The timing budget is different. In IT you might tolerate a two-second alert latency. In protection and control, the relevant decisions happen in milliseconds and are expected to be deterministic.

This is the first hard constraint: a large language model is a probabilistic system, and the grid is a deterministic one. A model that is right 99% of the time on log analysis is a research curiosity in a data center and a liability in a control room. The failure mode is not a wrong answer on a dashboard. The failure mode is a wrong answer that a human acts on.

The cost of a false positive is asymmetric — and wrong in the worst direction

I have spent enough time around execution risk to be allergic to people quoting accuracy without quoting the cost of the error.

In enterprise security, a false positive means an analyst investigates a benign alert. Annoying. Expensive in labor. Recoverable.

In OT, a false positive can mean a relay trips. A breaker opens. A feeder de-energizes. If the AI-driven system flags a "compromised" controller and the recommended action is isolation, and a human trusts it, you have converted a software event into a physical outage. The blast radius is not a server. It is a hospital, a water treatment plant, a neighborhood in a heat wave.

This inverts the usual cost-benefit calculus. In most ML deployments you optimize for recall — catch everything, tolerate false alarms. In grid protection you cannot accept a false alarm that triggers action, and you cannot accept a false negative that misses a real intrusion. You need both high precision and high recall under adversarial conditions. That is not a prompt-engineering problem. It is a fundamental limitation of the current generation of models in this domain.

Let me make this concrete with numbers I trust, because I have lived them. In 2026 I led the development of an AI-driven trading agent that executed arbitrage across three L2 networks. The agent processed 50,000 transactions a day. Its success rate was 98%. That number sounds like a finished product. It was not. A single rare oracle-manipulation event caused a 15% drawdown in a window measured in minutes, and the only reason it did not cascade was that I had built a human override — a freeze switch — into the contract and I used it. The lesson was not "make a better model." The lesson was "a 98% success rate with a correlated, tail-risk failure mode is not 98% safe."

Grid security has the same shape, with a worse denominator. When your failure mode is correlated across all instances — one poisoned input stream, one prompt-injection vector, one shared model — the independent-trial math that makes 98% reassuring collapses. Trust is a variable; verify the proof, then sleep. And in the grid case, there is no published proof of anything yet.

Where the AI actually fits — and where it doesn't

If I strip the hype and ask where models genuinely add value in security, I get a narrower and more defensible list:

• Log and alert triage. Natural-language models are genuinely good at summarizing, deduplicating and prioritizing alerts so a human analyst reads five items instead of five thousand. This is augmentation, not autonomy. Maturity: production-ready in IT, early in OT.
• Threat-intelligence synthesis. Mapping indicators to known threat actors, summarizing campaigns, translating TTP descriptions. Useful, human-in-the-loop, low risk because the human acts on the output.
• Vulnerability research. Models are improving fast at finding bugs in code and firmware. This is a genuine capability gain. It is also the single most dangerous capability gain, because the same technique points the other way.
• Automated response and remediation. The most oversold and the most dangerous. The place where hallucination meets actuation. This is where I would not deploy an unsupervised model, in security or in trading, and I say that as someone who built one.

Notice what all of that implies. The value is in the assistant layer, not the commander layer. But the value in the assistant layer is small and hard to monetize at grid scale, because the grid's real problem was never analyst fatigue. The grid's real problem is that its control systems were built for a world without adversaries, and retrofitting trust into them is a physical and regulatory project, not a software one.

The second hard constraint: certification is the moat, and OpenAI doesn't have it

Here is the part that any operator who has sold into government knows, and that the finance framing of the story completely ignores.

Government and critical-infrastructure procurement does not buy on benchmark scores. It buys on authorizations. To sell into federal environments you generally need FedRAMP authorization at the right impact level. To touch defense workloads you need DoD Impact Level 5 or IL6 environments. To work on classified programs you need cleared personnel. To serve electric utilities under the reliability regime you intersect with NERC CIP, which governs critical infrastructure protection for the bulk power system — and which currently contains no dedicated framework for AI tooling.

The authorization pipeline is not a form. It is an 18-to-36-month project. It requires accredited environments, continuous monitoring, incident-response commitments, supply-chain attestations and a documented body of controls. Microsoft has walked this path for years. Amazon, via AWS GovCloud, has walked it for years. Anthropic has largely sidestepped the direct build by delivering through trusted partners — Palantir and AWS GovCloud — which converts a capital-and-time problem into a channel problem.

OpenAI, on the public record, does not have the grid-side authorizations, the OT partners, or the cleared delivery bench. That does not make the ambition wrong. It makes the timeline long, and it makes this specific event — a CEO-level conversation — a relationship-building step, not a product launch. The phrasing "eyes a role" tells you as much. You launch products. You eye roles.

The conflict of interest nobody printed

This is the structural observation I have not seen made clearly anywhere, and it is the most important one in the whole story.

OpenAI is, or is becoming, one of the largest buyers of electricity in the United States. It negotiates power purchase agreements, interconnection queue positions, and long-term supply. It is now also proposing to be a supplier of security to the entities on the other side of those negotiations — the utilities and grid operators. And it is, inevitably, a future subject of the same regulators who oversee those utilities.

That is a triple role: customer, vendor, and regulated entity. In any other sector you would flag it immediately. A firm that buys steel from a mill, sells security software to that same mill, and lobbies the regulator that governs the mill has created a structure that invites scrutiny. In the electricity sector, where the Department of Energy, FERC and NERC all have jurisdiction and where CFIUS watches foreign and strategic involvement, that triple role is not a footnote. It is the headline that wasn't written.

Read the sequence again. The largest new load on the grid walks in to talk about the grid's security. The security conversation is real. But it is also, and possibly primarily, a channel to the utility's executive suite — an agenda item that opens a relationship that then discusses power, pricing, and priority. Security is a credible door. Power is the room behind it. I am not accusing anyone of bad faith. I am reading the order flow, and the order flow says the security framing is the opening move in a much larger commercial negotiation.

What I'd actually want to see before believing any of this

This is where my audit background takes over. In 2017, as a junior developer at a Singapore smart-contract security firm, I spent twelve-hour days reading ERC-20 contracts line by line ahead of ICOs. I found an integer-overflow bug in a project called GlobalCoin before launch — the kind of flaw that silently mints or drains balances — and it was caught only because someone read the code instead of the deck. That experience is the reason I do not evaluate security claims by the credibility of the person making them. I evaluate them by the artifact.

Applied here, that means a checklist. If this is real, some subset of the following will appear on a measurable timeline:

• A named utility or grid operator, not "power utilities" in the plural.
• A named OT/ICS partner — a Dragos, a Claroty, a Nozomi, an Armis — or a credible build-it-ourselves statement with headcount attached.
• A specific product boundary: API, fine-tuned vertical model, or managed service. These have wildly different margins and delivery models.
• A FedRAMP or IL authorization path with a date.
• Published red-team results, or at least a description of the threat model and the human-override design.
• An incident-liability framework. Who signs the report when the model is wrong?

Absent all six, this is positioning. And positioning is fine — every company does it — but it should not be priced as product.

The absence of a customer name is the loudest silence. In every genuine enterprise-security launch I have tracked, the first artifact is a reference customer, because security buyers do not buy claims, they buy proof from a peer. No reference, no pipeline.

The verification layer is the real story, and it's being missed

Here is the contrarian technical point, and it is the one I would build a fund around if I ran one.

Everyone is debating whether AI is smart enough to defend the grid. The correct question is whether the grid's operators can verify what the AI did. Those are different problems, and only the second one is solvable with the tools we already have.

The crypto industry spent a decade solving exactly this problem in an adjacent domain. The core primitive of decentralized finance is "don't trust, verify." Settlement is deterministic. Execution is auditable. State transitions are checkable by anyone with the data. When it works, it works because the rules are enforced by code that a third party can independently validate — not because a vendor promised to be careful.

I want to be precise here, because I am not suggesting you put a power grid on a blockchain. That would be engineering theater. What I am suggesting is that the missing layer in AI-for-grid-security is the same thing that is missing in most "AI for critical systems" claims: a cryptographic, independently checkable record of what the model decided and why, with a hard human-authorization boundary in front of any actuating action. Logs that can be tampered with are not evidence. Attested decision records are.

In my 2024 work building a compliant DeFi yield strategy for a Singapore wealth manager — Aave V3 behind a legal wrapper, roughly 12% annualized on $2 million of managed assets — the hard part was never the yield. The hard part was producing an audit trail that satisfied compliance without breaking non-custodial control. The grid has the same shape of problem at higher stakes: you need AI suggestions, human authority, and tamper-evident records, all three, or you have none of them.

The irony is that the industry best positioned to design that verification layer is not the model vendors. It is the people who spent years making trust-minimized systems auditable. That is a real, underserved niche. It is also a niche that does not show up in a funding-round narrative, which is why almost no one is talking about it.

So let me restate the core insight plainly. The grid does not need a better model. It needs a checksum — a verifiable, deterministic record of every machine-influenced decision, with a human signature on anything that can open a breaker. Buy the model if you like. Without the checksum, you have bought a very articulate liability.

Contrarian: The Retail Story and the Smart-Money Story Are Different Stories

The retail read of this headline is "AI is going to defend the grid against hackers." Heroic, clean, investable. The smart-money read is procurement, power and positioning — three unglamorous things.

Here is the counter-intuitive core. The most likely near-term failure of "AI protects the grid" is not that the AI gets fooled by an attacker. It is that the AI is trusted too much by the humans watching it. Automation bias is not a fringe concern; it is the documented tendency of operators to defer to a confident recommendation, especially under time pressure and especially when the tool is branded as more capable than they are. A model can be individually 99% reliable and still make a system less safe if it erodes the human's willingness to challenge it. The dangerous failure is cultural, not algorithmic.

Second contrarian point: the loudest risk in this story is regulatory capture. A vendor that sells security to infrastructure, buys power from that same infrastructure, and sits in the regulatory perimeter of that infrastructure will inevitably try to shape the standards it is measured against. That is not conspiracy; it is incentive. And the recent direction of U.S. AI policy — moving from risk-management frameworks toward deployment acceleration — means the guardrails for putting models into critical infrastructure are getting thinner, not thicker, right as the stakes rise. That timing is the real signal under the headline.

Third, and least discussed: this may not be about security at all. It may be about priority. When demand outstrips supply on the grid, what matters is who gets power first, at what price, for how long — and who is trusted to sit at the table when those questions are decided. The security framing is an excellent way to be at that table. Retail watches the AI-versus-hacker drama. The smart money watches the interconnection queue and the PPA calendar.

If you cannot tell which of those two stories is being sold to you, assume it is the one with the better margins for the seller.

Takeaway: Watch for Artifacts, Not Announcements

Do not price this event. Price the artifacts that would confirm or kill it.

Monitor for four things over the next four to six quarters: a named utility counterparty, a named OT-security partner or an explicit build statement with headcount, a FedRAMP or DoD IL authorization milestone, and any published threat model with a human-override design. The first two tell you the ambition is operationally real. The second two tell you it is sellable to the customers who actually control the grid. Until at least two of those appear, treat "AI secures the grid" as narrative — a compelling slide, not a shipped capability.

The forward question is not whether a model can out-think an attacker. The forward question is simpler and harder. If a machine influences a decision that darkens a neighborhood, and no human signed it, who is on the incident report — and can anyone outside the vendor prove what the model actually decided before it decided it? Answer that, and you have a product. Ignore it, and you have a press release with a gigawatt of ambition and no checksum behind it.