In a long triathlon, you can't tell from someone's pace at kilometre 20 whether they'll finish. Plenty of people are fast at kilometre 20. You find out from their heart rate. One athlete is moving at a pace their body can hold. Another is spending money they don't have. AI investment looks the same from the outside right now. Everyone is moving fast, and the headlines only give you the pace.
So I went through the AI investment news from September 23 to October 21, 2026, and asked the heart-rate question instead. What did the money buy, how long is it committed for, and who loses if demand comes in under plan?
What did four weeks of AI money actually buy?
Less AI than you might expect. The largest deals in the window were power plants, cooling systems and security, the layers under and around the models.
- Power. Amazon signed a 20-year contract for 690 MW from Constellation's Calvert Cliffs plant (September 30). Google signed for 890 MW of new nuclear capacity from Constellation uprates plus 2,700 MW from existing plants (October 6), and for a 702 MW fuel cell plant that AEP will build in Wyoming (October 14). Venture Global signed frame agreements with GE Vernova and Baker Hughes for up to 16 gas-fired power islands of 720 MW each (October 15). Together that is more than 16 GW, and most of it delivers between 2028 and 2034.
- Security. Proofpoint agreed to buy Varonis for $6.3 billion in cash and justified it with AI agents (October 15). Kevin Mandia's Armadin raised $255.5 million to run agentic attacks against its customers' own systems (October 1). Reco, Pluto and Opsin raised money to find and govern agents inside companies, and Nvidia launched an agent safety platform with more than 100 partners.
- Cooling and fraud defense. The cooling consolidation happened earlier in the year, with Ecolab closing its $4.75 billion CoolIT deal in July. The fraud side got its case study when Reuters reported that Intesa Sanpaolo's private bank Fideuram lost €95 million to a cloned-voice scam.
The vendor detail is on wetheflywheel.com: data center power companies, cooling companies, AI agent security vendors and deepfake detection tools. This page is about how I read it.
How do I tell a bubble from a buildout?
I've spent a lot of my career on technology due diligence, and the question there is never whether a market is exciting. It's what happens to the asset if the plan is wrong. I apply three tests.
- Contract length against asset life. A 20-year power contract on a nuclear plant that will run for 40 years is conservative. A three-year GPU lease financed with five-year debt, on hardware that a new generation makes less competitive in two, is the opposite.
- Who carries the risk. When Google signs a PPA, Google's balance sheet absorbs the downside. When a chipmaker invests in a customer that then buys its chips, the risk goes round in a circle and stays in the system. Bloomberg has mapped those circular deals between Microsoft, OpenAI and Nvidia, and they're the part of this market I'd worry about.
- What is left if demand disappoints. A nuclear uprate leaves a grid with more clean capacity. A gas turbine can sell power to anyone. A data center full of two-generation-old GPUs is worth much less.
So is it a bubble?
By those tests, most of what was signed in these four weeks is buildout. The power deals are long, backed by the strongest balance sheets in the world, and they leave useful assets behind whatever happens to AI demand. The security deals answer a problem that already exists. Companies have handed real credentials to software that, in the words of Microsoft's security chief on October 19, "cannot be trusted." That spending doesn't depend on AI growing. It depends on AI already being in use, and it is.
The bubble risk sits in the middle of the stack: GPU fleets financed with debt, valuations set by investors who are also suppliers, and capacity built ahead of demand by companies that have no other business to fall back on. Debt has become central to data center financing because GPUs and contracted cash flows make easy collateral. That works until the collateral loses value faster than the loan is repaid.
Pacing explains the gap. The hyperscalers are signing for power on a 2030s horizon because they can't get it any sooner. If AI demand runs hot, they'll have the electricity. If it cools, they'll have contracts for an asset that keeps its value. In endurance terms, that's racing at a pace you can hold. The GPU-heavy middle is running at a pace it can only hold if nothing goes wrong.
What does that mean for an operator?
I'm not a hyperscaler. I rent model capacity by the call through one gateway and own a little hardware, which I've written about in what I rent vs what I run. My rule from this reading is simple: let the companies with 20-year balance sheets carry the 20-year risk, and keep my own commitments short enough to walk away from. Concretely:
- Pay per use for anything still experimental. If the market cools, per-call pricing falls with it. A long reservation doesn't.
- Only own hardware for work I already run every day. That way the asset is in use whatever the market does.
- Spend on security now. It's the one category in this window where the risk is already here, not a forecast. My own coding agents are the reason, and I've written that up separately in managing AI agents as non-human identities.
The pace looks the same from the roadside. Check where the risk sits before you decide who's going to finish.
Sources
- Constellation Energy, Constellation and Amazon announce 20-year PPA at Calvert Cliffs (Sep 30, 2026).
- SiliconANGLE, Google commits to 890 MW from Constellation (Oct 6, 2026).
- DatacenterDynamics, Google signs 20-year PPA with AEP for 702 MW fuel cell project (Oct 2026).
- Venture Global, frame agreement press release (Form 8-K) (Oct 15, 2026).
- SecurityWeek, Proofpoint to acquire Varonis; Armadin raises $255 million (Oct 2026).
- TechCrunch, Microsoft says AI agents are like insider threats (Oct 19, 2026).
- Bloomberg, AI circular deals (2026).
Frequently Asked Questions
Is AI in a bubble in 2026?
Parts of it look like one and parts don't. Circular deals, where chipmakers, clouds and model labs invest in each other and then buy from each other, have the shape of a bubble. Twenty-year power contracts backed by the balance sheets of Amazon, Google and Meta don't. My test is to ask who carries the risk if AI demand comes in below plan, and what is left standing if it does.
Where did AI investment go in October 2026?
Mostly into physical infrastructure and security. Between September 30 and October 15, Amazon, Google and Venture Global announced more than 16 GW of nuclear, fuel cell and gas capacity for data centers. Proofpoint agreed to buy Varonis for $6.3 billion, and agent security startups such as Armadin, Pluto, Opsin and Reco raised rounds. The largest model-lab rounds were in early September.
What happens to AI infrastructure if the bubble bursts?
Power plants and grid upgrades keep their value, because electricity has other buyers. Nuclear uprates add capacity to grids that need it anyway. GPUs lose value fastest, because each new generation makes the previous one less competitive. That is why I read a long power contract as a buildout signal and a short GPU lease financed with debt as a bubble signal.
How should a company plan around AI capex uncertainty?
Buy capacity in a form you can exit. Use model APIs and short commitments for anything experimental, keep the option to switch providers, and only sign long commitments for workloads you already run every day. Let the hyperscalers carry the 20-year risk. That's the business they chose.
Need Expert Technology Guidance?
20+ years leading technology transformations. Get a technology executive's perspective on your biggest challenges.
