A federal judge has refused to throw out the NAACP's Clean Air Act lawsuit over the gas turbines powering xAI's Colossus data center complex outside Memphis. In a 28-page opinion signed on Friday, October 30, U.S. District Judge Debra M. Brown denied xAI's motion to dismiss, ruling that the plaintiffs have standing, that the turbines are not mobile sources under Mississippi's federally approved clean air plan, and that the Clean Air Act's citizen suit provision does not violate the Constitution. The claims, in her words, will proceed.
The case, brought by the NAACP through the Southern Environmental Law Center, alleges that xAI installed and operated at least 35 combustion turbines and other pollution sources at the Colossus site without ever obtaining the required preconstruction or operating air permits. The plant at issue sits in Southaven, Mississippi, and powers Colossus 2 across the state line in Memphis. xAI argued the turbines were exempt because they were mobile, mounted on trailers and meant to stay less than a year, a position Mississippi regulators had endorsed in a July 2025 letter. Brown found that a turbine that is not self-propelled while it works is a stationary source even on a trailer, and that the state letter was not consistent with Mississippi's plan, so it does not bind the court.
This is a procedural ruling, not a finding that xAI violated the law, and no injunction has been decided. That distinction matters, but so does what the ruling removes. The temporary-and-mobile theory was the legal foundation for building power first and permitting later, a schedule-first approach more than one AI developer has relied on as grid connections lagged behind data center construction. A similar Justice Department attempt to end the case was denied earlier this month. In a statement, the NAACP's director of environmental and climate justice, Abre' Connor, called it another important victory and said xAI cannot operate gas turbines without the required permits. TechCrunch has reached out to SpaceX, which now owns xAI, for comment.
For builders, the lesson is not really about turbines. It is that the physical layer of AI now carries the same compliance weight as the software layer. Power, permits, and community impact are no longer background logistics that someone else handles while the models train. They are schedule risks that can end up in federal court, and a regulator's informal assurance may not protect a project when a judge reads the underlying plan differently.
The week's other cautionary tale sits on developer laptops. On October 29, a tampered copy of Anthropic's Claude Code extension, version 2.1.313, sat in Cursor's marketplace for about 11 hours and reached at most 5,000 users. According to StepSecurity's analysis and Cursor's security notice, the loader planted an attacker SSH key labelled svc-telemetry, installed persistence, tried to open a reverse SSH tunnel, and sent host details to an attacker server. Anthropic clarified on October 30 that its own systems and official channels were not compromised and that it did not build the tampered copy, which is why the clean release skipped to 2.1.314. Cursor removed the version, rebuilt its marketplace, and rotated its keys. Anyone who installed the extension from Cursor in that window should follow Cursor's cleanup scripts, check authorized_keys for svc-telemetry, and rotate credentials reachable from that machine. Two different stories, one point: in AI right now, trust has to be verified at every layer, from the power plant to the editor plugin.