The Real Face of AI Bubble: Labor Crisis and Security Threats Behind $2.5T Investment Frenzy

Today's AI industry revealed a stark contradiction: money is flooding in, but there aren't enough people to do what that money is supposed to accomplish.

Who Will Actually Build AI's Future?

Gartner's projection of $2.5 trillion in AI spending for 2026 represents a 44% year-over-year increase. Meanwhile, startups raised a record-breaking $189 billion in February alone, with 90% concentrated in AI companies. The fact that just three companies—OpenAI, Anthropic, and Waymo—captured 83% of total investment shows how concentrated this market movement has become.

But Bloomberg's pointed question, "Who Will Build the Future of Artificial Intelligence?" exposes the raw reality behind this investment frenzy. The AI data center construction boom has hit a serious bottleneck: skilled construction worker shortage. There's money, but no one to do the building.

CoreWeave's $5 billion revenue in 2025 despite continued losses tells the same story. While demand for AI infrastructure is explosive, achieving actual profitability requires physical infrastructure buildout. But there aren't enough workers to handle that construction.

Supply Chain Warfare's New Battleground

While investment mania dominates headlines, the security front reveals far more concrete threats. North Korean hackers distributed 26 malicious npm packages, attributed to the Famous Chollima group. This campaign, tracked as StegaBin, employs sophisticated techniques—hiding C2 infrastructure on Pastebin and distributing cross-platform RATs.

More insidious are two Chrome extensions that turned malicious after ownership transfers. This isn't simple hacking—it's weaponizing trust relationships themselves. The moment a developer abandons a project and transfers ownership, every user of that extension becomes a potential victim.

Interestingly, GitHub Security Lab open-sourced an AI-powered security code audit automation framework in apparent response to these growing security threats. Released March 6th, this Taskflow Agent uses LLMs for a three-stage pipeline from threat modeling to verification, reportedly discovering 80+ vulnerabilities across 40 open-source repositories.

Agent Ecosystem Geopolitics

The AI agent ecosystem reveals fascinating political dynamics. Anthropic's launch of an AI code review tool for Claude Code with the declaration to "check the flood of AI-generated code" is significant. At $15-25 per review, averaging 20 minutes, this service creates a meta situation where AI reviews AI-generated code.

Meanwhile, China's Shenzhen Longgang District proposed up to 2 million yuan subsidies for OpenClaw tool development. This news drove cloud stocks like UCloud and QingCloud up 9%, while Hong Kong-listed Minimax surged 20%. Tencent also entered with OpenClaw-based WorkBuddy, supporting local installation for workplace AI agents.

Nvidia's preparation of an enterprise open-source AI agent platform called 'NemoClaw' suggests agent platform competition is becoming a new axis in US-China tech rivalry. The contrast between China's government-led support and Western private-sector development is striking.

The Money-Reality Gap

Like OpenClaw v2026.3.8's addition of ACP provenance features, actual products focus on fundamentals—identity verification, security patches. Over 12 security patches and Telegram duplicate message fixes represent the details that truly impact user experience.

Today's AI news ultimately reveals clear duality. On one side, $2.5 trillion investments and government policies unfold spectacularly; on the other, real problems lurk—construction labor shortages, npm malicious packages, Chrome extension hijacking.

The UN's announcement of a new scientific AI advisory panel reads in the same context. Recognition is spreading that AI governance and safety require scientific backing.

Tomorrow's Focus

How this gap gets bridged will be key. Money will keep flowing, but whether the infrastructure, workforce, and security systems needed to properly deploy that capital can keep pace remains the critical question.

---

🔗 Sources

Confidence Criteria:

• 🟢 Observed: Directly verifiable facts (official announcements, product pages)
• 🔵 Supported: Backed by reliable sources (news reports, research papers)
• 🟡 Speculative: Inference or predictions (analyst opinions, trend interpretations)
• ⚪ Unknown: Uncertain sources

---

HypeProof Daily Research | 2026-03-09