The Exchange Weekly - December 8, 2025
AI copyright fight, Genesis Mission lab AI, sovereign AI in Canada, deepfake defense, React2Shell fixes, and a new LockBit hit on healthcare.
If you’re finding The Exchange Daily useful for keeping up with AI, cyber, and federal IT, this is the time to go a little deeper with us. The Exchange Weekly is our Monday long-form breakdown that takes one big story and turns it into concrete questions, checklists, and next steps for leaders. It’s free through the end of December, while the Daily will stay free as your weekday briefing. Subscribe now so you get both the fast headline scan and the deeper context in your inbox.
Executive Summary
This past week marked a critical inflection point, where the promise of transformative AI collided with the physical, political, and security realities that will determine whether America can deliver on it. Federal and state governments are locked in an escalating fight over who sets AI rules, with dozens of lawmakers and attorneys general pushing back against efforts to preempt state authority through the National Defense Authorization Act. At the same time, agencies are racing toward a December 29 deadline to finalize detailed AI acquisition and use policies, creating a compressed window where procurement expectations will crystallize across the entire federal enterprise.
The infrastructure picture grew even more complex. AI data centers sparked organized local opposition in rural Pennsylvania as residents protested the tradeoff between promised economic benefits and real impacts on farmland, water, and power costs. BlackRock warned that physical constraints on land, permitting, and electricity in the United States and Europe are becoming hard limits on how fast AI capacity can grow. At the same time, Morgan Stanley quietly began exploring ways to reduce its exposure to data center loans. Major announcements from Palantir, AWS, and HPE introduced new infrastructure models designed to navigate these constraints. Still, the underlying message is clear: even with capital and technology, delivery timelines remain uncertain.
Federal IT modernization faced its own reckoning this week. The Technology Modernization Fund will lose its authority to make new investments on December 12 without congressional action, freezing more than $150 million in available funding. The House passed the SBA IT Modernization Reporting Act in response to repeated platform failures that affected thousands of small businesses seeking federal certifications, signaling that high-stakes modernization projects now invite statutory reporting mandates when they fail in production. HHS rolled out Anthropic’s Claude department-wide, moving AI from pilot to enterprise operations, while Medicare prepared a controversial pilot using AI for prior authorization reviews.
The cybersecurity picture deteriorated across multiple fronts. CISA added vulnerabilities in industrial control systems ranging from smart meters to nuclear medicine software to its Known Exploited Vulnerabilities catalog, underscoring that operational technology is now a primary attack surface. Chinese state-linked actors began actively exploiting the maximum-severity React2Shell vulnerability within 48 hours of disclosure, demonstrating how quickly adversaries weaponize new flaws. Microsoft’s Defender portal suffered an outage that blocked access to threat hunting alerts, attackers used fake Calendly invitations to hijack Google and Facebook ad manager accounts, and SpyCloud reported a 400 percent year-over-year surge in successful phishing attacks targeting corporate identities.
Two acquisitions signaled where the market sees future control points. ServiceNow’s reported $1 billion deal to acquire Veza treats identity governance as the essential control plane for AI-native operations. At the same time, CISA, NSA, and Canadian cybersecurity authorities issued a joint advisory on Brickstorm malware targeting VMware vSphere and Windows systems, underscoring that nation-state adversaries are moving up the stack to compromise virtualization and management layers. Congress introduced the SAFE CHIPS Act to lock in export controls on advanced AI chips to China and the No Robot Bosses Act to add worker protections against AI-driven hiring and management systems, framing geopolitical and labor concerns as legislative priorities rather than regulatory afterthoughts.
Taken together, this week revealed an emerging pattern: AI is moving from aspiration to execution, and every layer of that execution (policy, infrastructure, operations, security) is hitting constraints faster than anticipated. The organizations that recognize these limits and build realistic roadmaps around them will fare better than those betting on frictionless scale.
