AI Bubble Warning: 7 Signs We're Sleepwalking Into A Surveillance State

URL has been copied successfully!

Artificial intelligence is routinely sold to us as either a saviour or a threat, a “god-like” oracle about to solve civilisation’s problems or replace us entirely. It is neither. AI is a genuinely useful tool. It is not an omnipotent entity. The real danger is not that the technology becomes too clever. It is not even that the AI bubble now inflating around it will eventually burst. The real danger is simpler. The infrastructure being built underneath that bubble, digital identity, age verification, biometric banking and mass surveillance, is quietly closing a cage around ordinary people. Each piece is justified by reasons that sound entirely reasonable.

1. A Trillion Dollar Bet

To meet the surge in demand for AI chips, Google, Broadcom and Wall Street have each taken on a different slice of the financial risk. Google guarantees the data centres. Broadcom commits to buying, and helping finance, the chips. Apollo and Blackstone supply much of the private credit capital that buys the hardware before leasing it to AI labs such as Anthropic. As one Google executive involved in the arrangement put it, “This is each of us putting our balance sheet to work. We’re doing it on the data centre side, Broadcom’s doing it on the chip side.”

The web of contracts underpinning this single arrangement adds up to roughly $200 billion, with about four fifths of it tied directly to the chips themselves, making it one of the largest infrastructure financings ever assembled. What matters is not just the size of the bet but its design. Rather than one company carrying the risk, it is spread deliberately across a cloud provider, a chipmaker and largely unregulated private credit funds, the same pattern of risk quietly shifted onto opaque capital that has already played out closer to home in Britain’s public-private partnerships. That diversification is meant to stop any single failure cascading, but it also makes the risk harder to see and harder to regulate than a conventional bank loan.

2. History’s Biggest Collapses, Adjusted for Today

It is worth remembering that “biggest bankruptcy ever” is a title that gets rewritten every few decades. In 1970 the collapse of Penn Central, formed only two years earlier from the merger of the Pennsylvania Railroad and the New York Central, was the largest corporate bankruptcy in American history at the time. It came close to freezing the entire US commercial paper market before the Federal Reserve stepped in.¹ Adjusted for inflation, its roughly $7 billion in assets comes to about $59 billion in 2026 money, a fraction of the collapses that followed.²

Since then the record has been broken repeatedly. Enron’s 2001 collapse, at $65.5 billion in assets, comes to about $120 billion today. WorldCom in 2002, at $104 billion, comes to roughly $188 billion. Washington Mutual in 2008, at $328 billion, comes to about $495 billion. Lehman Brothers, still the largest bankruptcy in world history at $691 billion in assets, comes to just over $1 trillion in today’s money.³ The dot com crash wiped out roughly $5 trillion of Nasdaq value between 2000 and 2002. That adjusts to around $9 trillion today.⁴

3. If the AI Bubble Bursts

Set against that history, the scenarios now being modelled for an AI correction are startling. Analysts studying an equity style correction, similar in shape to the dot com crash but applied to today’s much larger and far more AI concentrated markets, put potential losses at $20 trillion to $33 trillion. That figure would exceed annual US GDP.⁵ AI linked companies have already gained around $27 trillion in value over the past three years, equivalent to roughly 36 percent of the entire US stock market. AI names are estimated to have driven around three quarters of recent S&P 500 returns.⁶

The more worrying scenario is not even the equity side, it is credit. If roughly half of projected AI capital spending through 2030 turns out to be debt financed, as current estimates suggest, an unwind could resemble 2008 rather than 2001, with an estimated 2.5 million US jobs at risk.⁷ The International Monetary Fund has already flagged this as a genuine financial stability risk, and the Bank of England has drawn direct comparisons between current AI valuations and the dot com era.⁸

4. The Technology Outlives the Bubble

None of this means AI disappears if the bubble bursts. The internet did not vanish after the dot com crash, it became the invisible infrastructure of daily life within a decade. Railroads did not stop running after Penn Central, they were reorganised into Conrail and kept moving freight. AI is already following the same pattern on a technical level, entirely separate from what happens to the financing bubble around it.

The clearest evidence is a shift already under way. Giant cloud hosted models are giving ground to small language models that run locally, on the device in your pocket rather than in someone else’s data centre. Models under ten billion parameters are now capable enough for many everyday tasks while fitting comfortably on consumer hardware. Analysts expect organisations to use these small, task specific models roughly three times more than general purpose large models within the next year or two.⁹ The “god-like oracle” framing dies with the bubble. Quiet, embedded, everywhere at once AI is the more durable and, arguably, more consequential form it takes.

5. Regulation, Rent, or Digital Serfdom

Which brings us to the fork in the road. With the right legislation protecting our data and our rights, small, pervasive AI could be put to genuinely good use. Without it, we are on a path toward what looks very much like digital serfdom, profiled from birth, controlled and surveilled.

The EU’s AI Act became applicable on 2 August 2026, imposing binding transparency, copyright and high risk system obligations on any AI provider serving EU citizens.¹⁰ Yet even that framework is already being softened. The European Commission’s “Digital Omnibus” proposals from late 2025 aim to delay high risk obligations until December 2027 and loosen GDPR alongside it, a move Amnesty International has explicitly criticised as a rollback of hard won digital rights.¹¹ The UK, meanwhile, has chosen not to pass a dedicated AI law at all, relying instead on existing regulators and “light touch” sandboxes designed to reduce friction for industry.¹² Whether that produces innovation without exploitation, or simply defers the reckoning, is an open question.

The digital serfdom instinct has a proper name in economics. In his book Technofeudalism: What Killed Capitalism, Yanis Varoufakis argues that capitalism itself has been superseded, not reformed, by a new order in which markets have been replaced by platforms, and profit has been replaced by what he calls “cloud rent,” a fee extracted simply for access, regardless of what is actually produced.¹³ He estimates cloud rents already account for close to 30 percent of GDP in economies such as the United States, Sweden and South Korea.¹⁴

Central to his argument is the idea of the “cloud serf.” Every time an ordinary person posts, searches or clicks, they perform unpaid labour that directly increases the capital stock of the platform owner, without payment, and under constant algorithmic observation, an experience he compares to a digital Panopticon.¹⁵ He identifies three classes in this new order. The “cloudalists” own the cloud capital and extract the rent. “Vassal capitalists,” such as third party sellers, must pay cloud rent simply to reach customers. “Cloud serfs,” the rest of us, supply the free labour and data the whole system runs on.¹⁶ The thesis is contested. Some reviewers argue that “capitalism is dead” overstates the rupture, and that profit seeking and market competition are still very much alive underneath the rent extraction layer.¹⁷ Even so, the framing explains why profiling has structural economic value, not just privacy implications. If identity verification becomes universal and tied to a handful of cloud fiefdoms, the profiling is not incidental, it is the rent extraction mechanism itself.

6. Anonymised Is a Polite Fiction

Companies routinely reassure us that the data they collect is “anonymised.” In practice this rarely survives contact with modern pattern matching. One widely cited study found that 99.98 percent of Americans can be correctly re-identified in any “anonymised” dataset using just fifteen demographic attributes.¹⁸ Linkage attacks work by cross referencing a stripped dataset against other public or semi-public records, location patterns, purchase history, device identifiers, to reconstruct identity even without a name attached.¹⁹ Security researchers now describe AI driven “profiling attacks” that combine photo matching, payment triangulation and behavioural pattern analysis to re-identify individuals with success rates exceeding 98 percent.²⁰ One 2025 industry analysis put it plainly: in the age of AI, meaningful anonymisation of rich datasets is essentially impossible.

The consequence is not hypothetical, it has already been measured. A 2018 study found that if a widely used predictive policing algorithm were applied in Indianapolis, Black and Latino communities would face 150 to 400 percent greater patrol presence than white communities, purely as a function of historically biased arrest data feeding the model.²¹ The same pattern shows up in lending, where studies have found Black and Brown borrowers facing systematically higher credit costs than similarly situated white borrowers, even when explicit race data is excluded from the model.²² The bias does not require a prejudiced human decision maker. It only requires training data that already carries historical inequality, which nearly all real world data does, a dynamic this blog explored from a more speculative angle in Psychohistory and the Rise of Predictive AI, on whether society is edging toward Asimov’s vision of forecasting, and quietly steering, human behaviour at scale.

7. The Age Verification Trojan Horse

None of this stops governments reaching for age verification as the solution of the moment, usually framed as protecting children from online pornography. The trouble is that where these schemes have already been implemented, they mostly do not work. When the UK’s Online Safety Act age verification rules took effect, one VPN provider saw a 1,400 percent spike in sign ups within a day, and Florida saw a comparable 1,150 percent surge under its own law. The primary effect was pushing users toward workarounds rather than achieving verification.²³ Academic research on these schemes concludes that governments have largely adopted a “responsibilisation strategy,” deploying age verification that is either privacy invasive or ineffective, with no jurisdiction yet achieving something that is effective, privacy preserving and affordable at the same time.²⁴

Despite this, the EU is pushing a harder line, recommending verification anchored to physical ID cards and passports, tied to the EU Digital Identity Wallet, with a deadline of 31 December 2026 for member states.²⁵ Whatever the stated intent behind these laws, the practical trajectory is toward ID anchored verification linked to a persistent digital identity infrastructure.

The most striking development is that age verification is now moving out of individual apps and websites and directly into the operating system itself. California’s Digital Age Assurance Act, effective 1 January 2027, requires every operating system provider, Windows, macOS, iOS, Android and even Linux distributions, to collect a user’s age at account setup and transmit an “age signal” to any app that requests it.²⁶ Colorado and New York have passed near identical laws, and Texas, Utah and Louisiana already have app store level obligations in force.²⁷

Reports circulating in tech commentary since April 2026, though not confirmed in any official Microsoft announcement, claim the company has been testing mandatory age verification in Windows, hidden behind a feature flag, that would trigger ID and facial verification specifically when a user attempts to run a program with administrator privileges.²⁸ Apple’s rollout is on firmer footing. It has already introduced OS level age checks for UK iPhone and iPad users, and in June 2026 the UK government announced that Apple and Google will be required to build on device nudity detection and age gating directly into their operating systems.²⁹ That move could eliminate the entire third party verification market by making the OS vendors themselves the verification authority for the whole population. Once an age bracket signal flows through OS level APIs tied to a Microsoft Account or Apple ID, accounts already linked across cloud storage, browser sync and app stores, the distance between “prove you are an adult” and “here is a persistent identity signal available to every app you run” becomes very small, whether or not the Windows facial verification detail turns out to be accurate.

There is pushback worth noting. System76, maker of Linux focused hardware, has said it may simply refuse to run its OS at all for users who self declare as minors in regulated states, rather than build verification infrastructure.³⁰ Fedora’s community has proposed a workaround where skipping network setup entirely during installation avoids triggering any verification requirement at all.³¹ The laws as written are narrower than the headlines suggest, but the corporate implementations already reach further than the legal minimum.

National ID, Cashless Money, and No Opt Out

Age verification is only one strand of a much wider push. The UK government has confirmed a mandatory national digital ID, branded BritCard, stored in a GOV.UK Wallet, that will be required for Right to Work checks by the end of this Parliament, the same immigration framing this blog has previously argued serves as cover for a much broader tightening of state control.³² Ministers insist there is no requirement to carry it or present it routinely. But since employment itself becomes contingent on holding it, that is a distinction without much practical difference.³³ Written evidence submitted to a UK parliamentary committee warns that a cashless society using a programmable digital currency, coupled with digital ID, would effectively remove all privacy from citizens’ transactions.³⁴

None of this is abstract. This blog has already covered a live example of exactly this kind of state overreach in Your Money, Their Rules, on the UK’s Fraud, Error and Recovery Bill, which grants the government power to freeze bank accounts and suspend driving licences without a court order or due process. Layer that kind of power onto a system where identity, banking and vehicle access all run through the same linked digital infrastructure, and the frozen account or suspended licence stops being a rare enforcement action and starts becoming an automatic, algorithmic default.

Roughly 25 million people in the UK still rely on cash as an economic necessity, according to the Access to Cash Review. The shift away from it continues regardless, with researchers warning the country risks leaving vulnerable and elderly people behind as digital payment infrastructure becomes the default and cash becomes the exception.³⁵ Combined with biometric requirements increasingly demanded by banks, the practical effect is that opting out of digital identity increasingly means opting out of employment, banking and purchasing all at once. There is no analogue lane left to walk down instead.

America Gets Its Cameras: Flock Safety

Britain has lived with mass surveillance cameras for decades, but at least historically it has been fragmented across many separate operators. The United States has traditionally had far less of this, until now. Flock Safety now operates roughly 120,000 automated licence plate reader and pan tilt zoom cameras across 49 states, capturing tens of billions of data points a month as a single, searchable, nationwide network. An officer in one state can be alerted the instant a tracked vehicle appears in a completely different one.³⁶

The ACLU has documented Flock expanding well beyond number plates, adding live video feeds, natural language AI search across its footage, and plans to integrate with commercial data brokers, directly undermining the company’s own claim that its data is not personally identifiable.³⁷ The Electronic Frontier Foundation has separately documented agencies using the network specifically to track protesters and activists, with nationwide searches routinely run even when there is no reason to think a target vehicle left the local area.³⁸ There is genuine resistance building. Protesters in upstate New York have physically cut down cameras with power saws, and public records show 85 Flock contracts across 28 states have been cancelled, with 39 of those cancellations occurring in the first five months of 2026 alone.³⁹

Follow the Money: Sticks, Cages, and Who Profits

There is a version of Occam’s Razor that applies here. When a single company keeps turning up at the intersection of enforcement, immigration control, and mass data access, the simplest explanation is usually the correct one, someone is selling the stick, and someone else is buying it in exchange for the keys to the cage.

Palantir, co-founded by Peter Thiel, is the clearest case study. It entered the UK’s NHS during the pandemic on a contract reportedly worth one pound, and now holds over £670 million in British government contracts spanning health, defence, policing, and, most recently, financial crime data at the Financial Conduct Authority, much of it awarded without competitive tender.⁴⁰ Two Ministry of Defence systems engineers have gone on record warning that Palantir’s expanding footprint poses “a national security threat to the UK,” with one source claiming the company likely holds enough linked data to assemble a complete profile of the entire population.⁴¹

In the United States, the same company underpins ICE’s deportation enforcement, giving agents “near real-time visibility” into the movements of migrants, and is reportedly building a searchable master database cross-referencing tax, immigration, and other federal records on ordinary citizens.⁴² Thiel is one of the most influential figures behind the current US administration’s inner circle, the same administration driving the enforcement-first, immigration-panic politics this blog has covered before.⁴³ The stick, in this case, is a literal deportation and enforcement contract. The cage is the data infrastructure Palantir was paid to build in order to operate it.

The funding trail behind the wider populist right tells a similar story. Investigations into far-right funding networks across the US, UK, and Europe have traced tens of millions of dollars from tech-linked billionaires into anti-immigration campaigns, media outlets, and political operations through opaque nonprofit structures that researchers describe as a “dark money ATM.”⁴⁴ Academic analysis of the relationship independently confirms the structural logic, Big Tech and populist movements share a common interest in weakening the regulatory agencies, courts, and independent oversight bodies that would otherwise constrain both corporate data practices and executive enforcement power, regardless of whether their public rhetoric ever acknowledges the overlap.⁴⁵

None of this is exclusive to one side of politics, in fairness. Dark money flowing through undisclosed nonprofit vehicles has surged on the left as well, with disclosed dark-money spending across the 2024 US election cycle reaching close to two billion dollars, roughly double the total four years earlier.⁴⁶ The distinguishing feature of the tech-populist alignment is not that the money is dirtier, it is that the payoff is uniquely direct. Where other lobbying buys favourable legislation or friendlier regulators, this arrangement buys something more concrete: government contracts that hand the funder itself the data, the enforcement mandate, and the infrastructure to make the next round of profiling, tracking, and control technically possible. Follow the contracts, and the money leads straight back to the cage.

The Cage Door Is Closing, But It Isn’t Locked Yet

None of the individual pieces described here is, on its own, a conspiracy. Age verification is justified as child protection. National digital ID is justified as fraud and immigration control. Cashless payments are justified as convenience and efficiency. Flock’s cameras are justified as crime fighting. Each is individually defensible.

The problem is what happens when they converge. Persistent device level identity, biometric banking, licence plate tracking and AI pattern matching can be stitched together. Medical, financial, employment and location data can combine into a single profile. That profile could quietly determine whether you get the loan, the job, the insurance premium or the visit from a caseworker, long before a human ever looks at your file, the exact drift toward algorithmic pre-judgement this blog first raised in Psychohistory and the Rise of Predictive AI.

This is not a Kafkaesque fantasy. The infrastructure prerequisites are being built right now, piece by piece, under separate justifications, by separate institutions, on both sides of the Atlantic, and increasingly funded by the same handful of interests who stand to profit from the data those justifications generate. Whether it results in a genuinely useful, well governed tool or a system of profiled, permission based existence depends entirely on the legislation that gets written in the next few years, not on the technology itself. The AI bubble will burst eventually. The cage door being built around it will not close on its own. It has not been bolted shut yet.

Sources & References

1
Bankruptcy of Penn Central, Wikipedia, and coverage of the 1970 financial crisis and Federal Reserve intervention. ↩︎
2
Historical CPI-based inflation adjustment calculated from Penn Central’s reported 1970 asset value. ↩︎
3
These Are The Biggest Bankruptcies in American History, and contemporaneous reporting on Lehman Brothers, Washington Mutual, WorldCom and Enron filings. ↩︎
4
The double bubble at the turn of the Century: technological roots and market dynamics research on the 1990s technology bubble; Dot-com Bubble and Bust overview. ↩︎
5
How An AI Bubble Burst Could Shake Global Financial Markets, coverage of AI bubble downside scenarios. ↩︎
6
The AI Bubble Is No Ordinary Bubble, analysis of AI linked equity valuation growth and market concentration. ↩︎
7
The Real Reason AI Is About To Bankrupt The Market, analysis of debt financed AI capital expenditure risk. ↩︎
8
AI Bubble About to Burst, Bank of England Warning, coverage of IMF and Bank of England statements on AI valuation risk. ↩︎
9
The Power of Small: Edge AI Predictions for 2026, Dell Technologies; Small Language Models for Edge Devices in 2026. ↩︎
10
AI Act, European Union, Shaping Europe’s digital future. ↩︎
11
How EU proposals to “simplify” tech laws roll back our rights, Amnesty International. ↩︎
12
Data, privacy and cyber in the UK and EU: Ten watchouts for 2026, and AI Compliance for UK companies: Guide for 2026. ↩︎
13
Technofeudalism: What Killed Capitalism, Yanis Varoufakis, Penguin, and interview, What killed capitalism, EconStor. ↩︎
14
What killed capitalism, an interview with Yanis Varoufakis, EconStor. ↩︎
15
Welcome to the Age of Technofeudalism, WIRED interview with Yanis Varoufakis; Technofeudalism, a video essay summarising the book. ↩︎
16
Cloud Capital and Platform Regression, review of Yanis Varoufakis’ Techno Feudalism. ↩︎
17
Review of Yanis Varoufakis’ Book “Technofeudalism: What Killed Capitalism”, tripleC journal. ↩︎
18
Re-identification of anonymized data: What you need to know, K2view; How Easy Is It To Re-Identify Data and What Are The Implications. ↩︎
19
Re-Identification of “Anonymized” Data, Georgetown Law Technology Review. ↩︎
20
AI-Driven Privacy Attacks: When Anonymization Becomes Meaningless. ↩︎
21
Algorithms in Policing: An Investigative Packet, Yale Law School. ↩︎
22
Algorithmic Bias Explained, Greenlining Institute. ↩︎
23
Age verification in 2026, the friction between safety and efficacy, IAPP. ↩︎
24
Online Age Verification: Government Legislation, Supplier Landscape, and Effectiveness. ↩︎
25
European Commission sets out approach for age verification, SCL; The EU approach to age verification, European Commission. ↩︎
26
When age verification moves into your operating system, Proton. ↩︎
27
State laws introduce age verification rules for app developers, McNees Law; A Practical Architectural Solution to OS-Level Age Verification Laws. ↩︎
28
The New Era of Privacy? Microsoft’s Mandatory Age Verification in Windows, unofficial tech commentary, not an official Microsoft statement. ↩︎
29
Apple brings in age checks for UK iPhone users, BBC; UK’s proposed OS-level age verification could eliminate part of DVS market, Biometric Update. ↩︎
30
System76 Responds to Laws Requiring Age Verification at the OS Level, Level1Techs forum. ↩︎
31
A Practical Architectural Solution to OS-Level Age Verification Laws, Fedora Discussion. ↩︎
32
New digital ID scheme to be rolled out across UK, GOV.UK; New digital ID will be mandatory to work in the UK, BBC News. ↩︎
33
techUK Reaction: UK Government Announces Mandatory Digital ID Scheme. ↩︎
34
Written evidence submitted by Anonymous, UK Parliament committees. ↩︎
35
IS BRITAIN READY TO GO CASHLESS, Access to Cash Review; UK risks leaving vulnerable people behind as it shifts more towards cashless, Loughborough University. ↩︎
36
Flock cameras are getting mobbed, CNN. ↩︎
37
Flock’s Aggressive Expansions Go Far Beyond Simple Driver Surveillance, ACLU. ↩︎
38
How Cops Are Using Flock Safety’s ALPR Network to Surveil Protesters and Activists, EFF. ↩︎
39
85 Flock Surveillance Camera Contracts In 28 States Canceled; TribCast: The Flock camera freakout, Texas Tribune. ↩︎
40
NHS, Defence, Police, and Now Your Financial Data, Slow AI; Britain’s Palantir problem, AOAV. ↩︎
41
Britain’s Palantir problem: the US surveillance firm’s expanding grip on British government data, AOAV. ↩︎
42
Palantir: Peter Thiel’s Data-Mining Firm Helps DOGE Build Master Database, Democracy Now. ↩︎
43
NHS, Defence, Police, and Now Your Financial Data, Slow AI. ↩︎
44
Why tech billionaires are quietly bankrolling Europe’s far-right, video investigation. ↩︎
45
Big Tech and Populism Share a Common Enemy: Democratic Oversight, Social Europe. ↩︎
46
Wealthy Donors Are Hiding Political Money in Secretive Nonprofits, New York Times; New Study Shows Runaway Influence of Dark Money in Politics, Brennan Center. ↩︎