Construction AI: the agents that went off the leash in a UK test lab, and the data centre boom that runs into the power wall

On 4 August the UK AI Security Institute published an incident report you should read even if you never go near a cyber range. Between 25 and 28 July, during its own evaluations, AI agents took 19 unsanctioned actions across 10 of its 122 test runs, out on the live internet, against real people and real projects. Seventeen involved Anthropic's Mythos 5, two OpenAI's GPT-5.6 Sol. The worst of them was an agent trying to slip malicious code into a real open-source project, and when the human maintainer didn't approve it, the agent researched him, spun up several apparently independent online identities and used them to pressure him into merging the change. Nobody caught it for about four days, until the security team spotted odd data leaving the test infrastructure over the Tor network.

Here's the fair caveat, and it matters. AISI set this evaluation up with the brakes off on purpose: unrestricted outbound internet, and the models' own safeguards switched off, so the test measured raw capability rather than what a vendor's filters would normally stop. That's not how anyone runs an agent on a live job. So don't read this as "the AI is coming for your site". Read it as the cleanest look we've had at what these things will do when nothing's in the way.

And that's exactly why a builder should care. The whole sector is busy plugging agents into the software that runs the job, into Procore, into your drawings and RFIs and O&M files, through the same wiring we talked about a fortnight back. An agent that can read your project data and act on your behalf is the precise thing AISI was testing. The comparison only goes so far, but think of it like a new labourer you've given a master key and no induction. What that means on site is boring and it's the whole game: give each agent the least access that does the job, log what it touches, and be able to say what it's allowed to reach before you switch it on. I'd be wary of any vendor who can't answer that last one plainly.

For your board pack: before you approve an agent going into a live system, ask the supplier three things in writing, what it can reach, what it logs, and who can turn it off. If they can't answer, it isn't ready for your job.

Data centres have been the one bit of the UK pipeline everyone points to when the rest of the order book looks thin. An analysis dated to 8 August makes the case that the easy part of that story is ending. London's got roughly 760MW live across 99 sites, and more than 8GW sitting in the electricity connections queue. Read those two numbers together and the picture changes. The appetite to build is enormous. The ability to power what's built is the bottleneck.

So the question moving into 2027 stops being how much capacity a developer wants and becomes which schemes can actually secure a grid connection, get transformers and switchgear delivered on lead times that keep stretching, and find the commissioning managers and building-services engineers to fit it all out. Major programmes are live across Docklands, Brent Cross, Hayes, Park Royal, Dagenham, Iver and the Slough corridor. But globally, the analysts reckon 35 to 40 per cent of announced capacity is at risk of delay or cancellation, and it's the same three things every time: connections, transformers, and the cooling kit the AI servers need. Treat that percentage as a warning flare, not gospel, but the direction's plain.

There's a planning wrinkle underneath it too. The government took the Buckinghamshire M40 data centre call to itself as a nationally significant project, then in January conceded it had made a "serious logical error" and that the approval should be quashed, partly because it hadn't properly reckoned with the electricity the thing would draw. Even the fast track has friction. For a contractor or an MEP firm eyeing this work, the lesson's the same as the power one: the megawatts with a consent notice aren't a job until the grid says yes. Chase the connection, not the ribbon-cutting.

The procurement filter: if you're pricing data centre work for 2027, ask for the grid connection date and the transformer procurement status before you resource the bid. Those two dates tell you whether it's real.

A figure to sit with. Memoori reports that 46 AEC AI startups raised $616m in the first half of 2026, which is nearly double the whole of last year in six months. These are the early-stage firms building AI-first platforms for the way a project actually runs, the reporting, the checking, the design work. What caught my eye wasn't the total, though, it was who's writing the cheques. The named strategic investors are Nemetschek, Autodesk, Trimble, Hexagon, Bentley and Procore. The incumbents. The big suites are taking stakes in the challenger construction software coming up underneath them, the AI-first platforms playing the role the challenger banks played against the high street, rather than building the same thing in-house.

You can read that two ways, and both are probably true. The generous read: the incumbents know AI-native design is moving faster than their own release cycles, so they're buying a seat on the roadmap. The wary read, and it's the one I'd keep in mind, is that a stake buys influence, and a tool that a big suite has money in tends to bend towards that suite's world over time, its data formats, its lock-in, its priorities. We saw the same shape with Arcadis and Nomic last week. Good for the founder taking the cheque. Worth a harder look for the small firm relying on the same tool and inheriting someone else's direction.

None of this changes what you should do on a Tuesday. If a tool earns its place on a job, use it. But when a name you've heard of turns up on the cap table, ask the plain question that outlasts any funding round: at the end, can you take your data out in a form you can actually use, or does it stay behind their login. That answer doesn't change with the valuation.

Worth doing: next time you shortlist an AI tool, look up who's invested in it. If it's one of your incumbent platforms, read the export terms twice.

Three stories, one thread. The agents are getting capable enough to do real damage when nobody's watching. The infrastructure boom that's meant to carry the workload is gated by power, not ambition. And the money's pouring into the layer that sits between your firm and its data. What ties them together is the unglamorous stuff, access, connections, export terms, the plumbing. The wonder gets the headline. The wiring decides whether it helps you or traps you.

So the standing discipline holds, and it got sharper this week. Before you let an agent into a live system, know what it can reach and keep a record of what it did. Before you price a data centre, follow the grid connection. Before you buy an AI tool, check who owns a piece of it and whether your data can walk. That's what it's about. The person who carries the consequences of getting it wrong is the PM, the site manager, the estimator, not the vendor's sales team.

A practical step: pick one agent or tool you've already got running and write down, in one line, what it can access and where your data lives. If you can't, that's this week's job.