Judge Allows NAACP Suit Over xAI Turbines; Northflank Warns on Keys

U.S. District Judge Debra M. Brown has denied SpaceX-owned xAI's motion to dismiss a Clean Air Act lawsuit brought by the Southern Environmental Law Center (SELC) on behalf of the NAACP over gas turbines powering xAI's Colossus data center complex outside Memphis, Tennessee, according to reporting by Anthony Ha in TechCrunch — Artificial Intelligence. Separately, cloud application hosting platform Northflank warned customers to immediately rotate all stored environment variables and AI API keys after an Oct. 30 security breach led to unauthorized API key usage, Lawrence Abrams reported in BleepingComputer.

Federal Judge Rejects xAI Bid to Dismiss NAACP Clean Air Act Lawsuit

Filed earlier this year by the Southern Environmental Law Center on behalf of the NAACP, the federal lawsuit alleges that xAI installed and operated at least 35 combustion gas turbines to power its Colossus supercomputer complex outside Memphis — including turbines sited across the state line in Southaven, Mississippi — without first obtaining required preconstruction or operating air permits, emitting smog-forming nitrogen oxides and other pollutants near predominantly Black neighborhoods.

In denying xAI's motion to dismiss, Judge Debra M. Brown rejected three primary legal arguments advanced by the company:

• Statutory Standing Under the Clean Air Act: Judge Brown ruled that the NAACP's complaint plausibly alleges injury to local residents' air quality and falls squarely within the Clean Air Act's statutory protections.
• No "Mobile Source" Exemption: The court rejected xAI's contention that the gas turbines were exempt as temporary or mobile sources under Mississippi's State Implementation Plan, finding the exemption inapplicable to the stationary power setup described in the complaint.
• Constitutionality of Citizen Suits Under Article II: Judge Brown dismissed xAI's claim that the Clean Air Act's citizen-suit provision unconstitutionally infringes upon executive branch enforcement authority under Article II of the U.S. Constitution, noting that citizen enforcement suits have been an established pillar of federal environmental law for more than five decades.

Abre' Connor, director of environmental and climate justice at the NAACP, welcomed the decision, stating that data center operators cannot bypass federal clean-air permitting requirements in frontline communities.

Northflank Discloses Oct. 30 Breach and Abuse of Stored AI API Keys

In cloud security disclosures reported by BleepingComputer, developer platform Northflank notified customers on Oct. 30 to assume that all environment variables stored on its platform had been decrypted and urged users to immediately disable and rotate all API keys, database passwords, and authentication tokens across workloads, secret groups, and global secrets.

According to Northflank's incident timeline, cloud security firm Wiz alerted the company to the breach at 11:43 UTC on Oct. 30. Northflank engineers reviewed the alert 1 minute later, deployed an initial network policy patch, and rolled out two additional patches at 12:50 UTC and 13:05 UTC with assistance from Wiz's incident response team. Northflank subsequently confirmed that multiple customers reported unauthorized use of AI API keys stored on the platform, enabled automated credential rotation for PostgreSQL, MongoDB, MySQL, and Redis, and activated audit logs for all customers, including free-tier accounts.

In a research report titled "Black October for AI Developer Platforms," Wiz identified at least 9 security incidents targeting AI developer platforms during October — including Northflank, Railway, OpenCode, Warp, and Lightning AI — driven by "LLMJacking" campaigns that harvest environment variables to access commercial AI models. In 2 incidents investigated by Wiz, attackers used stolen enterprise credentials to execute approximately 2.5 million Amazon Bedrock API calls, generating roughly $100,000 in unauthorized AI compute charges.