> daily_signal(2026_08_10)

The largest US grid wants AI data centers cut first when power runs short, while ghost students drain college aid, three tricked laptops reach an SEC filing, and DeepMind open-sources a storm AI.

PickBits Daily Signal · Monday, August 10, 2026

By Mark Pickering · 9 min read · August 10, 2026

// tl;dr

PJM, the biggest US grid operator, asked federal regulators to curtail large data centers first when power runs short, and to make new ones bring their own generation. Any load of 50 megawatts or more that does not bring new generation online by June 1, 2027 can be cut during shortages, with notice and compensation. PJM's own market monitor blames data-center demand for wholesale prices nearly doubling in a year; the fix helps grid reliability, not the price you pay.
Fraud rings are enrolling fictitious "ghost students" at community colleges, collecting federal aid in their names, and using AI to file just enough coursework to keep the money moving. At East Los Angeles College, faculty caught it when generic Anglo-Saxon names appeared in a student body that is mostly Latino and Asian. The abuse lives in asynchronous online courses where no one ever shows a face.
Levi Strauss told the SEC that intruders social-engineered their way onto three company laptops and took corporate data, with no malware and no vulnerability involved. The company found no evidence consumer data was affected and did not name the attackers or confirm ransomware. Three employees were talked into granting access, which no patch or endpoint scanner was ever going to stop.
Google DeepMind, working with the National Hurricane Center, open-sourced WeatherNext Cyclones, an AI that forecasts a storm's track and strength at once and buys roughly a full extra day of warning. Its five-day track error averaged 230 kilometers against 370 for the leading European model. The code and weights are on GitHub, including a compact version that runs on a single chip in a free notebook.

The data-center power fight we opened in May finally has teeth this week, and it is bad news for anyone hoping the AI boom would pay for itself. The call gets made at a federal commission, not your statehouse, and there is no vote you could show up to about who eats the cost, the data centers or the household next door. Two other stories today made me wince too. Federal college aid is walking out in the names of students who do not exist, and Levi's told the SEC that three of its people got talked into handing over access, no bug anyone could patch. Back in May, when we first put the power bills on your radar, wholesale prices had jumped more than seventy percent across this footprint; now it is a filing, not a gripe. The one I keep rereading is the fourth. DeepMind pointed AI at getting people out of a storm's path sooner, then gave the model to the agencies whose job that is instead of renting it back. More of that, please.

PJM filed to curtail data centers first in a shortage, fraud rings billed federal aid for students who do not exist, Levi's told the SEC three staff were talked out of their access, and DeepMind put a cyclone model on GitHub.

1. The country's biggest grid wants to cut AI data centers off first when power runs short. No statehouse voted on it.

A federal filing, not a ballot or a bill, decides whether data centers or ratepayers absorb the cost of the AI power boom.

PJM Interconnection, the largest grid operator in the country, keeps the lights on for 67 million people across 13 states and Washington, D.C., from Virginia to Illinois. This week it asked the Federal Energy Regulatory Commission to let it curtail the biggest data centers first when the grid runs short of power, and to push new ones onto their own supply. Under the plan, any "Large Load" of 50 megawatts or more that does not bring its own new generation online by June 1, 2027 can be curtailed during a capacity shortage, with advance notice and compensation, rather than letting the whole grid tip toward a blackout. This is the second, meaner half of what PJM filed; the first half just pays to add capacity for the data centers already coming online through 2027.

None of this passed through a vote a resident could attend. It is a filing at a federal commission and a docket most people will never open, and the outcome lands on every monthly bill in those states. And the data centers are not the villains here. They are real jobs and a real tax base, and PJM's job is to keep the system from failing, which this does. But PJM's own market monitor blames data-center demand for wholesale power prices that have nearly doubled in the region over the past year, and that demand is projected to roughly quadruple by 2035. The plan is built to keep the lights on, not to hold your bill down. It improves reliability and does little for price, and without a state stepping in, that reliability cost still gets shifted onto ordinary customers rather than the data centers driving it.

Screenshot of Utility Dive's report on PJM's two-part FERC filing to curtail data centers first and make new ones bring their own power — utilitydive.com · August 3, 2026

Why this matters: Your electricity bill is picking up the tab for the AI build-out right now, and this filing is where the question of whether it keeps doing that lands in front of regulators. The reliability part is real, and yeah, a grid operator staring at a shortfall has to plan for the worst day. But the price part is the one that touches you, and it is the one the plan mostly hands off to your state. This is not new ground for us; it is the same fight we opened in May, except now there is something to actually push on. Action this week: Find out whether your state utility commission has a rate case or a capacity-cost proceeding open right now tied to data-center demand, and file a comment during the window, because that docket is where your bill actually gets decided and a resident has standing there. Look up your commission by name, not a generic "contact your rep"; the PJM states each run their own. My own read is the reliability piece sails through, and the price fight is the one nobody has settled, so the comment worth making is the one about who gets stuck with the capacity cost.

utilitydive.com: PJM files two-part reliability plan with FERC over data-center demand (August 3, 2026)
networkworld.com: AI data centers in the US may face power cuts under PJM reliability proposal (July 29, 2026)
techcrunch.com: Data centers may face temporary power cuts to prevent blackouts on largest US grid (July 28, 2026)

2. Fraud rings are enrolling students who do not exist, and using AI to keep the financial aid flowing.

Federal aid is being collected in the names of "ghost students" nobody enrolled, through online courses nobody has to show a face to join.

Faculty at East Los Angeles College noticed something wrong on their rosters: a cluster of generic Anglo-Saxon names in a student body that is overwhelmingly Latino and Asian. The names belonged to people who never existed. They are what investigators call ghost students, fictitious enrollees that organized fraud rings register at community colleges to claim federal and state financial aid in their names. The scheme predates chatbots, but AI made it easy to run at scale: the rings now use it to file just enough passing coursework to keep the fake enrollments, and the disbursements, from being flagged. The abuse concentrates in asynchronous online courses, the ones where a student never has to appear in person.

The AI makes it nearly impossible to sort a fraudulent enrollment from a real but disengaged one. One history instructor, David Roach, estimates that more than half of his real students now use AI to write their papers, which means a bot-completed ghost looks exactly like a bored freshman coasting on the same tools. We have watched AI cheating go from a grading headache to something with real money on the line. Now the money is public. Nobody signed off on running federal aid through anonymous online enrollment with no identity check, and every fake enrollment is a seat a real applicant did not get, funded with tax money. The tell that broke it here was not a security system; it was a professor who knew what her actual class looked like.

Screenshot of The Decoder's report on scammers enrolling fake students at US community colleges and using AI to collect financial aid — the-decoder.com · August 9, 2026

Why this matters: A bot could be enrolled in a class you could not get into, collecting financial aid in a name that might be yours. Federal investigators warn that the identity being registered and loaded with loans can belong to a real person who finds out later they owe the Department of Education for a school they never attended. And AI made the harder part worse: once more than half of real students are using the same tools as the fraud, a completed assignment stops being proof a human is there. Action this week: Ask your financial-aid office directly whether a fraud review is open on your account if a registration or a disbursement suddenly stalls, and ask how to prove a legitimate account fast, because an aid-integrity hold can catch a real student in the same net as the ghosts. Whenever I have dealt with an aid office, the specific question moves faster than the general complaint. The real fix is not yours to make, though. It is the registrars', who can put identity and engagement checks on the asynchronous online sections that are the exact door this walks through.

the-decoder.com: Scammers are enrolling fake students at US community colleges and using AI to collect financial aid, drawing on Jay Caspian Kang's New Yorker essay "The Despair of the Professor in the Age of A.I." (August 9, 2026)

3. The breach Levi's just disclosed has nothing to patch. Three of its people were talked into access.

No malware and no vulnerability were involved; the company treated three social-engineered laptops as material enough to tell the SEC.

In a filing disclosed Friday, August 7, 2026, Levi Strauss & Co. said intruders used a social-engineering attack to gain access to three company-issued employee computers and exfiltrated "certain corporate information" before the incident was contained. The company said the breach did not disrupt operations and that it found no evidence consumer data was affected. It did not specify what corporate data was taken, did not name the attackers, and did not say whether ransomware was involved. No group has claimed responsibility, and the investigation is ongoing.

There was no exploited CVE here and no malware, and that absence is exactly what should worry you if you run security. Three employees were manipulated into granting access, which is what patching and endpoint detection cannot touch, because you cannot patch a person who gets talked into it on a call. A working social engineer will tell you how routine that is: spoof a number so a call looks internal, invent a plausible reason someone needs help before a Monday deadline, and the person on the other end just wants to help, so they do. The thing that jumped out at me is how they disclosed it. An apparel company decided that three tricked laptops crossed the threshold of a material event and reported it to the Securities and Exchange Commission. That is the bar I am using now.

Screenshot of The Record's report on the Levi Strauss social-engineering breach disclosed in an SEC filing — therecord.media · August 7, 2026

Why this matters: There was no CVE and no malware in the breach Levi's just disclosed; three of its people were talked into granting access, and no endpoint tool on the market would have stopped it. Every security team I have worked with assumes the problem is software, something with a patch or a scanner behind it. This one had neither, and it still produced data loss and an SEC filing, so I would put the next security dollar into training people rather than buying one more endpoint agent. Action this week: Put one question in writing to whoever owns your endpoint fleet before the next quarter: if three of our people got talked into granting access tomorrow, what actually stops the data from leaving, and which of our controls do we have turned on today versus own on a slide. Get the answer on the record, because "we have EDR" is not a control against a human being manipulated on a phone. In twenty years I have never seen a phishing-resistant-MFA rollout that was as finished as the org chart claimed, so treat "we have it" as the start of the audit, not the end.

therecord.media: Levi Strauss says attackers used social engineering to breach three employee computers, disclosed in SEC filing (August 7, 2026)

4. DeepMind built a hurricane AI that forecasts track and strength at once, then gave it away.

An open-sourced model buys forecasters close to a full extra day of warning, and any national weather service can run it instead of Google.

Think about the person deciding when to call an evacuation. That call runs on how far ahead the forecast can be trusted, and the hard part has always been that a storm's strength is much harder to predict than its path. For years the models could nail where a storm was headed but kept whiffing on how strong it would get. This week Google DeepMind, working with the US National Hurricane Center, the Cooperative Institute for Research in the Atmosphere, and the UK Met Office, released WeatherNext Cyclones, an AI that predicts a tropical cyclone's track and its intensity at the same time. In results published August 6, 2026 in Nature, its five-day track error averaged 230 kilometers against 370 for the leading European ensemble, and its three-day intensity forecasts beat NOAA's operational model by about 3.75 knots, an improvement DeepMind likens to roughly a decade of forecasting progress and a full extra day of lead time.

And then they gave it away. DeepMind open-sourced the code and model weights on GitHub for WeatherNext Cyclones, WeatherNext 2, and a compact WeatherNext 2-mini that runs on a single chip in a free notebook, so a national weather service can run it directly rather than depending on Google. This is the thing we keep hoping for and rarely get: AI you do not have to rent from one company. The code and the weights are right there to download and run. Fair warning, though: an extra day is lead time, not a decision, and it only saves anyone if the warning gets acted on. Forecasters will fold this in beside the models they already trust rather than replacing them, and one good season is not a track record.

Screenshot of The Decoder's report on Google DeepMind's WeatherNext model predicting cyclone track and intensity together — the-decoder.com · August 9, 2026

Why this matters: AI can now flag a hurricane's path and strength a full day sooner, and DeepMind gave the model away for free. The accuracy is the headline. What I care about is that the tool went to the public agencies whose job forecasting is, instead of back onto a rental meter. Action this week: Watch whether the smaller national weather services, the ones that could never afford a supercomputer, actually pick up the free 2-mini this season, because that adoption, not the headline accuracy, is what decides whether this reaches anyone who is not already served. If you know an emergency manager or someone on a coast, the concrete thing they can do with a more confident, earlier warning is treat "a day earlier" as decision time, not spare time, and pre-stage the go-bag and the route now. I have learned to read "open-sourced the weights" as the real news in stories like this one.

the-decoder.com: Google DeepMind's WeatherNext predicts cyclone tracks and intensity at the same time (August 9, 2026)
deepmind.google: WeatherNext AI model achieves breakthrough in forecasting cyclones (August 6, 2026)
nature.com: Operational tropical cyclone forecasting with AI (August 6, 2026)

» What to watch this week

Whether FERC signs off on PJM's plan, and whether the states step in to keep the capacity cost off household bills. The reliability backstop clears easily; the price fight is where your bill is actually won or lost.
At the community colleges, watch for identity and engagement checks landing on anonymous online enrollment. The fraud works because nobody has to show a face, not because anything got hacked, and the tell is whether the reviews catch ghosts without freezing real students.
Levi's has not said what data left, or whether anyone will claim the breach. The bigger question is how many more companies file an SEC disclosure over a pure social-engineering hit, with no CVE and no outage.
On the good story, watch whether a weather service outside the big players actually runs the open-sourced WeatherNext code this season. It is on GitHub already; a lower-resourced agency putting the 2-mini to work is the proof it reaches anyone the market skipped.

Tomorrow's signal lands here.