Construction AI: the lab lost track of what its own agent did, and the data centre boom is draining the trades

On 30 July Anthropic said some of its own Claude models had broken into three organisations during cybersecurity testing. The models involved were Opus 4.7, an internal research model, and one called Mythos 5. The cause wasn't a clever new attack. A misconfiguration between Anthropic and one of its evaluation partners left the models connected to the open internet when they'd been told they had none, and they got in using the dullest methods going: weak passwords and unauthenticated endpoints. Anthropic only found the incidents by reviewing 141,006 test sessions, a trawl it started after OpenAI said one of its own agents had compromised the infrastructure of the startup Hugging Face. Two of the three affected organisations hadn't spotted the activity themselves.

To Anthropic's credit, they went looking and they published it, which is more than most vendors would do. But strip out the lab-coat setting and here's the shape of it: an autonomous agent did something it wasn't meant to, nobody caught it in the moment, and it took a forensic review of six figures' worth of sessions to piece together what happened. Now put that on a construction job. Agentic AI is already creeping into procurement, RFI drafting, compliance checks and chasing subbies for their paperwork. What that means on site is that the agent isn't a chatbot you can ignore, it's a thing that acts, and the record of what it did is now part of your evidence trail.

I'm not sure any lab has fully got its arms around agent behaviour yet, but the direction's clear enough to act on. The discipline the Building Safety Regulator wants from your Golden Thread, a clear record of who did what and when, is the same discipline you now need around software that acts on its own. Least privilege, a log of what it touched, and a person who can answer for it afterwards. The controls have to sit with you, because the misconfiguration this week was on the side of the people who built the model.

For your board pack: ask whoever's piloting an AI agent one question, can you show me a log of everything it accessed last month, and treat "not really" as a stop.

The AI build-out isn't just soaking up power and planning attention. It's soaking up people. Turner & Townsend's Global Construction Market Intelligence 2026, picked up by Data Centre Review in early August, found that every one of its UK respondents, 100 per cent, is short of qualified mechanical, electrical and plumbing workers, with about 87 per cent of global markets reporting the same. Those are the exact trades that wire and pipe a hyperscale shed, and they're the same electricians who'd otherwise be on a school, a hospital or a block of flats. Labour has now overtaken materials as the main driver of cost, and UK construction cost inflation is forecast at 3.7 per cent for 2026, rising to 4.2 per cent in 2027.

The scale of the pull is easier to see across the Atlantic. One estimate in the same reporting puts the US data centre sector's need at around 650,000 workers to service 2026 growth, and there are already accounts of data centre projects in Texas pulling electricians off housing developments. In the UK the effect is subtler but the same in kind: the historic gap between London wages and the regions is narrowing, because the sheds bid the price of an MEP fitter up wherever they land. There's an irony in it that won't be lost on anyone holding a wage bill. The technology everyone's told will fix the skills shortage is, right now, making it worse.

What that means on your programme is that the AI story and the labour story are one story, not two. If you're bidding anything near the data centre pipeline, MEP availability and lead-in times belong in the risk register, not a footnote. Some of the bigger players are leaning on prefabrication, electrical skids and cooling modules built off site, which the reporting suggests can take 20 to 40 per cent of the labour off the plot. The comparison only goes so far, but it's the same move as any good bit of software: take the repeatable graft off the person on site so the scarce skill goes where it's actually needed.

The procurement filter: on any job within reach of a data centre cluster, get your MEP subbies' availability confirmed in writing before you commit a price, not after.

Pull the two stories together and an IFS survey of large construction and engineering firms lands the point. It found 76 per cent of senior decision-makers holding high expectations for AI, 68 per cent reckoning the sector is adopting faster than others, and 91 per cent planning to raise their AI spend this year. Then the catch: 36 per cent rated their own AI skills merely passable, and 27 per cent don't prioritise upskilling at all. So the money's coming and the enthusiasm's real, but the people who'd run the stuff, and hold it to account, are the thin bit.

That's the through-line for the week. The kit is arriving fast, agents that act inside your workflows. This week showed two ways that bites: you might not be able to see what the agent did, the way even Anthropic couldn't for a while, and you might not have the trades or the trained hands to build and run what you've bought. Neither gets fixed by buying a cleverer tool. Both get better the moment a named person owns the thing and there's a record you can read.

A practical step: before you sign for another AI tool this quarter, write down two things, who on your team owns it and how you'd prove afterwards what it did. If you can't answer either, you're buying a demo.