AI data centers will out-burn Germany and Japan on gas by 2035
The AI build-out has a fuel problem, and a new forecast finally puts a number on it. Separately, a security firm went shopping for an inference vendor and walked out with admin rights.
US data centers are on track to add 15 billion cubic feet per day of natural gas demand by 2035 — more than Germany and Japan burn today combined, and more than double BloombergNEF's own forecast from December. The research firm's earlier estimate was 6.9 billion cubic feet per day, and the revision lands even after discounting announced projects that will never get built. On those numbers, data-center gas demand alone would exceed the current consumption of every country except China, Russia, Iran and the United States.
The mechanism is boring, which is the point. Natural gas is expected to supply 69 percent of the power for new grid-connected facilities, because US production is cheap and gas plants ramp up and down fast — a property data centers running at constant load don't strictly need, but grid operators do. BloombergNEF has power-sector gas use reaching 54 billion cubic feet per day by 2035, up from 36 billion in 2025, with Gulf Coast LNG export terminals adding another 21 billion. The AI build-out is the second-largest source of that growth; the two together could require producers to find 11 billion cubic feet per day beyond their currently projected increases.
Why it matters: this reframes the bottleneck. Chips, transformers and permits have each been named the constraint on AI capacity this year, and gas now joins the list — with a price consequence for every other customer on the grid. BloombergNEF flags wide margins of uncertainty, because nobody models AI construction schedules well. We covered the emissions half of this in August — Big Tech's data centers could add 101.5M tons of CO2 a year — but demand growth is the half that moves household bills.
A security firm pulled a live, three-year-old GitHub admin token for Baseten — the $13 billion AI inference platform — out of the build history of a public container image. Strix, which scans vendors before it depends on them, found an exposed registry project, pulled an image, and recovered the credential from the image's config and build history after a copy sitting in the filesystem had already gone dead; it granted admin access across Baseten's production repositories. Strix stopped at read-only checks and disclosed the same day; Baseten confirmed the issue as critical, locked down the registry project and rotated the token by the next afternoon.
Two things are worth keeping. Cleaning a credential out of an image's files does nothing if the build history still carries a copy — the underlying mistake was passing a token in as a build argument so the build could fetch private dependencies, a pattern Docker itself warns against. And this is now the standard shape of AI-vendor due diligence: the whole finding took 25 minutes and came from an AI agent doing the scanning.
What to watch: whether BloombergNEF's revision survives contact with 2027 construction data, and whether inference vendors start publishing container build hygiene alongside their compliance reports.
If your AI stack's power bill and your vendor's leaked credentials were both on the table, which would you fix first? Tell us in the comments.
