Charlesworth Capital

← Research themes · Last updated 24 Oct 2026

Glowing data-centre-like monoliths standing as rival pieces on a vast chessboard at dusk

Game theory of competing AGIs

Would rival AGI projects attack each other's data centres? The strategic logic, a toy model, and the real-world indicators to watch.

Thesis being trackedIf several actors race to AGI, and there are enough of them, they will attack each other's data centres (by cyber or physical means) to sabotage or seize them. The fear of a rival getting there first makes pre-emption look rational.

This page tracks a thesis; it does not endorse it. Strategy is described only at a high level, and every real-world claim links to its source. The interactive model is an illustration, not a forecast.

The strategic concepts in plain language

Security dilemma

Steps one side takes to make itself safer (building compute, hardening sites) make rivals feel less safe, so they respond in kind. Both can end up less secure without anyone intending aggression (overview). Jervis argued the danger is greatest when offence has the advantage and offensive and defensive capabilities look alike, as AI capability does.

First strike and pre-emption

If striking first is much better than being struck, and you fear a rival is about to strike or about to gain a decisive edge, waiting looks costly (preemptive war). The thesis rests on this: a near-AGI rival is seen as a lasting, possibly decisive threat.

Bipolar vs multipolar

Waltz argued two-power systems are more stable: each side watches one rival, and miscalculation is rarer. Others argue many powers spread attention and create cross-cutting ties (polarity). The AI race today is mostly US–China, with many labs inside each.

Prisoner's dilemma

Each player does better by defecting whatever the other does, so both defect, even though both would prefer mutual cooperation (SEP). Racing to deploy unsafe systems, or striking a rival, can have this shape.

Stag hunt

Cooperation is the best outcome if you trust others to cooperate, but the safe choice is to go it alone (stag hunt). Many AI-safety agreements are closer to a stag hunt than a prisoner's dilemma: the problem is trust and verification, not irreconcilable incentives.

Deterrence, MAD and MAIM

Nuclear mutual assured destruction made first strikes suicidal (MAD). Hendrycks, Schmidt and Wang propose Mutual Assured AI Malfunction (MAIM): "any state's aggressive bid for unilateral AI dominance is met with preventive sabotage by rivals", and they argue MAIM already describes the strategic picture (Superintelligence Strategy). Note that MAIM predicts sabotage threats; the authors argue the threat itself can keep the peace.

Number of players

With more players, the chance that at least one defects rises quickly, monitoring is harder, and any single player's fear is higher. But a decisive first strike against several rivals at once is also harder. The toy model below shows the first effect.

What to watch

  • New academic work applying deterrence theory to AI.
  • Official doctrine that mentions AI infrastructure as a target or a protected asset.

Reading

Interactive toy model

Move the sliders to see how the number of players, the offence–defence balance and deterrence change the incentive to strike first. Illustrative only. The payoffs are invented to show the logic and are not estimates of anything real.

Toy model: when does striking first look attractive? illustrative, not a forecast

This is a deliberately simple game with made-up payoffs, so the shape of the incentives is visible. It uses no real data and does not estimate any real-world probability. Each period, every one of N rival AGI projects chooses whether to strike a rival's data centres. Striking succeeds with probability equal to the offence advantage. A failed strike invites retaliation scaled by deterrence. Waiting risks being hit by any of the other N−1 players. Players respond noisily to these payoffs (logit best response), and the model reports the equilibrium where everyone's fear and everyone's behaviour are consistent.

—
Chance a given player strikes in a period (equilibrium)
—
Chance at least one strike happens in a period
—
Each player's fear: chance a rival strikes it
—
Payoff of striking minus waiting (positive = strike looks better)
Model equations

Strike payoff = a − (1 − a)·2d − 0.3. Wait payoff = −0.8·F·a, where F = 1 − (1 − p)N−1 is the chance at least one rival strikes. Each player strikes with probability p = 1 / (1 + e−6·(strike − wait)), iterated to a fixed point. a = offence advantage, d = deterrence, 0.3 = fixed cost of striking (escalation, fallout, reputation). Every constant is arbitrary. The model leaves out alliances, verification, communication, repeated-game reputation, uncertainty about rivals' capabilities and non-state actors, all of which matter in reality.

What to watch

  • Whether real-world defence (hardened, dispersed, underground sites) is improving faster than offence (drones, AI-enabled cyber).

Reading

Real indicators

How many players are there, how concentrated is the infrastructure, and are attacks on it already happening?

How many players are at the frontier?

count of organisations / countries · computed by this site

Counts computed by this site from Epoch's model database. Epoch's 'frontier' subset = models in the top 5 by training compute when released. Many recent models have undisclosed compute, so the ≥10^25 FLOP counts are a lower bound. Co-developed models count every listed organisation.
Source: Epoch AI, Data on AI models (frontier and large-scale subsets) [2] [3] · Data as of 3 Sep 2026 · fetched 24 Oct 2026 · last bar is year-to-date
View the data / CSV

Organisations with a ≥10^25 FLOP model (Epoch AI)

15 rows
OrganisationCountryFirst ≥10^25 modelModelModels ≥10^25Latest such modelDate
OpenAIUnited States of America15 Mar 2023GPT-4 (Mar 2023)4GPT-6 Astra3 Sep 2026
Inflection AIUnited States of America22 Nov 2023Inflection-21Inflection-222 Nov 2023
Google DeepMindUnited States of America6 Dec 2023Gemini 1.0 Ultra1Gemini 1.0 Ultra6 Dec 2023
Saudi AramcoSaudi Arabia4 Mar 2024Aramco Metabrain AI1Aramco Metabrain AI4 Mar 2024
NvidiaUnited States of America14 Jun 2024Nemotron-4 340B2Llama Nemotron Ultra 253B18 Mar 2025
AnthropicUnited States of America20 Jun 2024Claude 3.5 Sonnet2Claude 3.7 Sonnet24 Feb 2025
Meta AIUnited States of America23 Jul 2024Llama 3.1-405B2Llama 4 Behemoth (preview)5 Apr 2025
xAIUnited States of America13 Aug 2024Grok-23Grok 49 Jul 2025
ByteDanceChina28 Oct 2024Doubao-pro1Doubao-pro28 Oct 2024
HuaweiChina10 Apr 2025Pangu Ultra1Pangu Ultra10 Apr 2025
AlibabaChina5 Sep 2025Qwen3-Max1Qwen3-Max5 Sep 2025
CursorUnited States of America18 May 2026Composer 2.51Composer 2.518 May 2026
Meituan IncChina29 Jun 2026LongCat-2.01LongCat-2.029 Jun 2026
Thinking MachinesUnited States of America15 Jul 2026Inkling1Inkling15 Jul 2026
MoonshotChina16 Jul 2026Kimi K31Kimi K316 Jul 2026
Source: Epoch AI, Data on AI models (frontier and large-scale subsets) [2] [3] · as of 3 Sep 2026 · fetched 24 Oct 2026 · Download CSV (all columns)

Tracked frontier AI data centres: current compute and power by country

H100-equivalents (millions, bars) · power (GW, line) · computed by this site

Compute is highly concentrated: a few dozen US campuses hold most of the tracked capacity. In game-theory terms, that makes them high-value targets.
Sums computed by this site over the 95 sites in Epoch's hub (a curated sample of the largest AI data centres, mostly from public permits and satellite imagery), not a census. 'Current' values as published by Epoch on the fetch date.
Source: Epoch AI, Frontier Data Centers Hub [2] · Data as of 24 Oct 2026 · fetched 24 Oct 2026
View the data / CSV

Largest tracked AI data centres

95 rows
SiteOwnerUsersCountryH100-equivalentsPower (MW)Capital cost (2025 $bn)
Colossus 2SpaceXAIAnthropic, Cursor, SpaceXAIUnited States1,111,67394635.8
Anthropic-Amazon New CarlisleAmazonAnthropicUnited States818,4281,03739.3
Microsoft Fairwater AtlantaMicrosoftOpenAI, MicrosoftUnited States768,76963624.1
Google Pryor (North)GoogleGoogle DeepMindUnited States636,68536813.9
DayOne Nusajaya——Malaysia583,83747317.9
Meta PrometheusMetaMetaUnited States536,34347117.8
OpenAI Stargate AbileneOracleOpenAIUnited States509,34842115.9
DayOne Kempas——Malaysia480,63942216.0
Microsoft Fairwater WisconsinMicrosoftOpenAI, MicrosoftUnited States445,68036914.0
Google ColumbusGoogleGoogle DeepMindUnited States331,98630311.5
Google New AlbanyGoogleGoogle DeepMindUnited States323,90133312.6
Google MesaGoogle—United States289,5401836.9
Colossus 1SpaceXAIAnthropicUnited States275,79634012.9
Google Council Bluffs (East)GoogleGoogle DeepMindUnited States255,6852379.0
CoreWeave Denton TXCoreWeaveOpenAIUnited States252,6532629.9
QTS Richmond 1——United States242,5472389.0
Bridge Data Centres MY06ByteDanceByteDanceMalaysia221,0522439.2
Meta RosemountMetaMetaUnited States215,6751786.7
Amazon Madison Mega SiteAmazonAnthropicUnited States214,34828410.8
Google BristowGoogleGoogle DeepMindUnited States209,8612389.0
Microsoft GoodyearMicrosoftOpenAI, MicrosoftUnited States205,1542027.7
Meta JeffersonvilleMetaMetaUnited States203,1331786.7
Google Kansas City EastGoogle—United States202,6281054.0
Meta TempleMetaMetaUnited States202,4731786.7
AWS New AlbanyAmazon—United States201,1122138.1
Google OmahaGoogleGoogle DeepMindUnited States198,5852379.0
Google LincolnGoogle—United States197,5751415.3
QTS Richmond 2——United States182,9211806.8
Google The DallesGoogle—United States175,3411545.8
QTS Richmond 3——United States174,8361445.5
Meta MontgomeryMetaMetaUnited States174,5171535.8
Meta KunaMetaMetaUnited States173,2481525.8
Meta CheyenneMetaMetaUnited States172,8151525.8
Amazon RidgelandAmazonAnthropicUnited States171,2992288.6
Meta HuntsvilleMetaMetaUnited States166,7611465.5
Coreweave HeliosCoreWeaveOpenAIUnited States159,5521325.0
Microsoft Project OsmiumMicrosoftOpenAIUnited States155,6341907.2
Meta Eagle MountainMetaMetaUnited States151,3541335.0
Google MidlothianGoogle—United States143,5811033.9
Google Storey CountyGoogleGoogle DeepMindUnited States133,9061616.1
Google LancasterGoogle—United States130,3691375.2
Meta-QTS Hillsboro 2MetaMetaUnited States123,8391806.8
Google Waltham CrossGoogleGoogle DeepMindUnited Kingdom123,800883.3
VNET Bayin UlanqabVNETByteDanceChina122,7892218.4
Google ArcolaGoogle—United States108,135772.9
Google Red OakGoogle—United States108,135772.9
Google PapillionGoogleGoogle DeepMindUnited States100,5562379.0
Meta GallatinMetaMetaUnited States99,545873.3
Meta Los LunasMetaMetaUnited States99,545873.3
CoreWeave Ellendale NDCoreWeaveOpenAIUnited States93,482682.6
Meta SarpyMetaMetaUnited States91,966803.0
Huawei HoringerHuawei—China89,4391847.0
CoreWeave Chester VACoreWeaveOpenAIUnited States88,428823.1
Oracle BatamOracleTencentIndonesia84,386722.7
AWS BerwickAmazonAnthropicUnited States81,3541084.1
CoreWeave Marble NCCoreWeaveOpenAIUnited States78,828652.5
Meta AikenMetaMetaUnited States78,322692.6
Huawei WuhuHuawei—China76,3261575.9
Core42 Lake MarinerCore42G42United States71,753582.2
Microsoft SAT40Microsoft—United States64,679752.8
STACK Infrastructure NVA02——United States61,142853.2
Anthropic Lake MarinerAI XPV PlatformAnthropicUnited States58,565421.6
Microsoft-Nebius New JerseyNebiusMicrosoftUnited States56,847501.9
CoreWeave NorwayCoreWeaveOpenAINorway50,773421.6
Nebius MantsalaNebiusMicrosoftFinland48,528752.8
Southgate MelbourneFirmus—Australia46,488411.6
Stream Phoenix——United States46,134642.4
Microsoft SAT14Microsoft—United States45,174471.8
Vantage TX1——United States38,706321.2
CoreWeave Dalton 1 & 2CoreWeaveOpenAIUnited States32,239281.1
Alibaba ZhangbeiAlibabaAlibabaChina31,8851696.4
Start Campus Sines Data CampusNscaleMicrosoftPortugal31,834331.3
xAI QTS AtlantaSpaceXAISpaceXAIUnited States11,470170.7
Nscale KeflavikNscale—Iceland5,82150.2
Anthropic Barber LakeCipher MiningAnthropicUnited States000.0
CoreWeave Lancaster Greenfield siteCoreWeaveOpenAIUnited States000.0
CoreWeave Muskogee OKCoreWeaveOpenAIUnited States000.0
Crusoe Abilene ExpansionMicrosoftMicrosoftUnited States000.0
EcoDataCenter 2Mistral AIMistral AISweden000.0
Envision Galaxy Ulanqab——China000.0
GoodnightGoogleGoogle DeepMindUnited States000.0
Google Cedar RapidsGoogleGoogle DeepMindUnited States000.0
Google Fort WayneGoogleGoogle DeepMindUnited States000.0
Meta Bowling GreenMetaMetaUnited States000.0
Meta HyperionMetaMetaUnited States000.0
Microsoft Narvik NorwayNscaleMicrosoftNorway000.0
OpenAI Stargate LordstownSoftbankOpenAIUnited States000.0
OpenAI Stargate MichiganOracleOpenAIUnited States000.0
OpenAI Stargate MilamSoftbankOpenAIUnited States000.0
OpenAI Stargate New MexicoOracleOpenAIUnited States000.0
OpenAI Stargate ShackelfordOracleOpenAIUnited States000.0
OpenAI Stargate UAEG42OpenAIUnited Arab Emirates000.0
OpenAI Stargate WisconsinOracleOpenAIUnited States000.0
QTS Cedar Rapids——United States000.0
QTS Eagle MountainMetaMetaUnited States000.0
Source: Epoch AI, Frontier Data Centers Hub [2] · as of 24 Oct 2026 · fetched 24 Oct 2026 · Download CSV (all columns)
Data pending
Dataset of cyber and physical attacks on AI infrastructure
No maintained public dataset of attacks on AI labs or data centres exists yet; individual verified incidents are listed in the timeline on this page instead.
Intended source: No consolidated public dataset

Verified incidents involving AI infrastructure and secrets

  1. 13 Nov 2025
    AI-orchestrated cyber-espionage campaign disclosed

    Anthropic said a group it assesses with high confidence as Chinese state-sponsored used Claude Code against roughly thirty targets, with AI doing 80–90% of the work. It succeeded in a small number of cases (Anthropic). Detected mid-September 2025.

  2. 29 Jan 2026
    Ex-Google engineer convicted of stealing AI supercomputer secrets

    A jury convicted Linwei Ding of theft of trade secrets about Google's TPU/GPU AI supercomputing infrastructure, and of economic espionage (DOJ). On 20 Aug 2026 the judge acquitted him of the espionage counts; the trade-secret convictions stand (court order).

  3. 1 Mar 2026
    Drone strikes hit AWS data centres in the UAE and Bahrain

    Amazon said two of its UAE data centres were directly struck by drones and a Bahrain facility was damaged by a nearby strike. Iran's IRGC claimed responsibility (AP). The strikes were on 1–2 March, early in the Iran war. These were attacks on commercial cloud capacity in a regional war, not one AGI project sabotaging another.

  4. 15 Sep 2026
    AWS says it cannot restore the Bahrain region

    Six months on, AWS said it cannot restore resources hosted only in Bahrain, nor one UAE availability zone (CNBC).

Policy moves: securing compute and weights

  1. 7 Oct 2022
    US export controls on advanced AI chips to China

    BIS rule restricting advanced computing chips and chip-making equipment (Federal Register 2022-21658).

  2. 17 Oct 2023
    Controls tightened

    Updated rule on advanced computing items and supercomputers (Federal Register 2023-23055).

  3. 30 May 2024
    RAND: Securing AI Model Weights

    Identifies 38 distinct attack vectors and defines five security levels, up to defending against top nation-state operations (RAND).

  4. 13 Jan 2025
    Framework for AI Diffusion

    Worldwide tiered licensing for AI chips, plus controls on model weights (Federal Register 2025-00636).

  5. 13 May 2025
    AI Diffusion Rule rescinded

    Commerce announced it would not enforce the rule and would strengthen other chip controls (BIS).

  6. 14 Jan 2026
    Nvidia H200 sales to China allowed with a 25% surcharge

    Case-by-case licences with third-party testing; China shipments capped at 50% of US-bound volume (CNBC; Federal Register).

What to watch

  • Epoch: new countries or organisations crossing 10^25–10^26 FLOP.
  • More physical attacks on data centres, or official moves to harden and disperse them.
  • Indictments for AI chip smuggling or theft of model weights.
  • Export-control changes (loosening suggests less zero-sum framing; tightening suggests more).

Reading

Signals for and against the thesis

Supports the thesis

  • Data centres have now been physically struck in wartime (AWS, Mar 2026), though not as AGI-race sabotage.
  • State-linked cyber operations increasingly use AI against tech firms (Anthropic, 2025).
  • Theft of AI infrastructure secrets is being prosecuted (Ding).
  • Influential strategy papers treat sabotage threats as the default regime (MAIM).
  • The number of frontier-scale players keeps growing (Epoch chart).

Weakens the thesis

  • No public case yet of one AI lab or state sabotaging a rival's training run.
  • Compute stays concentrated in two blocs (US, China), closer to a stabler bipolar structure.
  • Hardening and dispersal (underground sites, multi-region) shift the balance toward defence.
  • Trade is re-opening (H200 licences), which signals interdependence rather than all-out rivalry.
  • Verification and transparency deals (chip tracking, inspections) could turn the race into a stag hunt.

What to watch

  • Any credible attribution of an attack on an AI lab or training cluster.
  • US–China AI talks or verification proposals.

Reading

Prediction markets

Live prices from public prediction markets, snapshotted by scripts/update_markets.py. A price of 30% means traders pay about 30¢ for a contract that pays $1 if the event happens; treat it as a crowd estimate, not a fact. Polymarket and Kalshi are real-money markets (Kalshi is CFTC-regulated); Manifold uses play money and is often thin. Long-dated and low-volume markets are poorly calibrated. Each market's exact resolution rules on the platform decide what counts, so read them before relying on a headline question.

Race dynamics

Kalshi Will a Chinese AI model be #1 this year?
6% bid 6¢ / ask 8¢
142k contracts · 45k open interest · closes 2027-01-01 · as of 2026-10-30 17:06 UTC
Polymarket US x China agree to pace the AI frontier in 2026?
5%
$67k vol · $33k liquidity · closes 2027-01-01 · as of 2026-10-30 17:06 UTC
Kalshi Will China obtains or develops a functional extreme ultraviolet (EUV) lithography machine that is capable of patterning semiconductor wafers in a fabrication facility be confirmed before Jan 1, 2027? · Before Jan 1, 2027
6% bid 3¢ / ask 12¢
889 contracts · 370 open interest · closes 2027-01-01 · as of 2026-10-30 17:06 UTC
Kalshi Will China obtains or develops a functional extreme ultraviolet (EUV) lithography machine that is capable of patterning semiconductor wafers in a fabrication facility be confirmed before Jan 1, 2028? · Before Jan 1, 2028
36% bid 25¢ / ask 35¢
228 contracts · 27 open interest · closes 2028-01-01 · as of 2026-10-30 17:06 UTC
Kalshi Will China obtains or develops a functional extreme ultraviolet (EUV) lithography machine that is capable of patterning semiconductor wafers in a fabrication facility be confirmed before Jan 1, 2029? · Before Jan 1, 2029
58% bid 49¢ / ask 59¢
849 contracts · 120 open interest · closes 2029-01-01 · as of 2026-10-30 17:06 UTC
Manifold America Nationalizes Major AI org before 2029
28%
Ṁ1k play-money · 12 traders · closes 2028-12-31 · as of 2026-10-30 17:06 UTC
Polymarket Will Google have the best AI model at the end of December 2026?
59%
$481k vol · $43k liquidity · closes 2026-12-31 · as of 2026-10-30 17:06 UTC
Polymarket Will Anthropic have the best AI model at the end of December 2026?
33%
$481k vol · $40k liquidity · closes 2026-12-31 · as of 2026-10-30 17:06 UTC
Polymarket Will OpenAI have the best AI model at the end of December 2026?
6%
$269k vol · $41k liquidity · closes 2026-12-31 · as of 2026-10-30 17:06 UTC
Polymarket Will Meta have the best AI model at the end of December 2026?
1%
$254k vol · $75k liquidity · closes 2026-12-31 · as of 2026-10-30 17:06 UTC

Attacks on AI infrastructure

Manifold Will there be a military operation to slow down AI development by the end of 2030?
22%
Ṁ4k play-money · 42 traders · closes 2031-01-01 · as of 2026-10-30 17:06 UTC
Manifold Will there be a military operation to slow down AI development by the end of 2035?
39%
Ṁ2k play-money · 28 traders · closes 2036-01-01 · as of 2026-10-30 17:06 UTC
Manifold Will any data center be attacked to oppose AI development by 2030?
89%
Ṁ3k play-money · 22 traders · closes 2030-01-03 · as of 2026-10-30 17:06 UTC
Manifold Will there be a terrorist attack against OpenAI before 2027?
17%
Ṁ9k play-money · 71 traders · closes 2026-12-31 · as of 2026-10-30 17:06 UTC
Manifold Will a frontier model be found to have exfiltrated its weights and run an outside copy of itself before Q2 2027?
24%
Ṁ8k play-money · 58 traders · closes 2027-03-31 · as of 2026-10-30 17:06 UTC

Flashpoints that would hit compute

Polymarket Will China blockade Taiwan in 2026?
3%
$441k vol · $65k liquidity · closes 2027-01-01 · as of 2026-10-30 17:06 UTC
Polymarket China x Taiwan military clash before 2027?
5%
$3.5M vol · $83k liquidity · closes 2027-01-01 · as of 2026-10-30 17:06 UTC
Polymarket US x China Military clash before 2027?
3%
$219k vol · $44k liquidity · closes 2027-01-01 · as of 2026-10-30 17:06 UTC

Snapshot fetched 2026-10-30 17:06 UTC from public APIs (Polymarket Gamma/CLOB, Kalshi trade API, Manifold v0). Prices are what traders are paying, not my forecasts and not advice; thin or long-dated markets can be far off. Sparklines show daily prices over up to 120 days. Metaculus: API now requires an authenticated account token (HTTP 403 without one) and the website is behind a bot challenge, so Metaculus forecasts are not included. Add a ref type with a personal token later if wanted.

How to add a market

Add a ref to "markets" → "groups" → "refs" in src/themes/<slug>.json: {"platform":"polymarket","event":"<slug after /event/ in the URL>"}, {"platform":"kalshi","event":"<EVENT_TICKER>"} or {"platform":"manifold","id":"<market id or slug>"}. Optional: "markets" (list of specific sub-market slugs or tickers), "max", "sort" (date, prob or api). Then run python3 scripts/update_markets.py <slug> and rebuild.

Notes & journal

Dated observations from src/notes/agi-game-theory.md. Add a new entry with a ## YYYY-MM-DD Title heading.

24 Oct 2026

Baseline

Page created. Epoch counts 15 organisations in 3 countries with a disclosed ≥10^25 FLOP model; that is a lower bound, because many labs don't disclose compute. The physical strikes so far (AWS UAE/Bahrain, Mar 2026) were part of a regional war, not AGI-race sabotage. No public case yet of one lab or state sabotaging a rival's training run.

Data behind this figure