The $3 Trillion That Isn't On the Balance Sheet: Where the AI Buildout's Hidden Leverage Sits, and How It Would Unravel

There is a figure that has been doing the rounds in finance: roughly $300 billion of AI infrastructure exposure that Big Tech has parked off its balance sheets in under a year, per a Financial Times (FT) investigation this week. It is usually reported as "the hidden debt of the AI boom" and waved at as proof that tech is about to blow up. The truth is more specific, and more interesting, than the panic.

The FT's ~$300bn estimate covers guarantees and financing through special-purpose vehicles (SPVs) over the past year. An SPV is a separate legal entity; its borrowing is real debt of that entity, even when it is not consolidated on the sponsor's core balance sheet. Separately, Morgan Stanley's broader measure exceeds $3.1tn and includes leases, purchase commitments and other credit support across seven firms. These estimates use different scopes and should not be added together or treated as a reconciled total and subtotal. What the figures share is that the risk they describe sits mostly outside the core balance sheets — what the Bank for International Settlements (BIS) calls "shadow borrowing": obligations that are economically akin to debt but largely reside outside the corporate balance sheet.

A few of these commitments are contingent: payment is due only if a specified event occurs, such as a tenant default or an asset-value shortfall. Others, including leases and purchase commitments, call for payments in the normal course, subject to their contract terms. The central risk this article examines is the dependence of several financing structures on the same small group of AI tenants — and the different ways their distress could reach investors.

1. What the figures measure — and where exposure is concentrated

Alphabet leads on the broad measure of total commitments. Its total off-balance-sheet figure across guarantees, leases and purchase commitments is roughly $890bn per Morgan Stanley — the largest of the seven firms. But the guarantee rankings tell a different story, and the two numbers are often conflated under Alphabet's name.

Alphabet's data-center guarantees — the contingent amount it has promised to stand behind if a data-center tenant cannot pay — jumped from $16.9bn to $43.8bn in six months (a 2.6× increase). That is genuinely striking, and the mechanism is worth spelling out: a contingent liability more than doubled in half a year, while Alphabet reported only about $815m of it as a fair-value liability at the reporting date. The recorded valuation and the maximum contractual exposure are different measures; their ratio is not an estimate of how much will ever be paid. Still, that fast a build-up tells you Alphabet's credit is being used to support AI capacity at an accelerating rate.

To keep the scopes straight:

Scope note: Data Studios' reconstruction totals roughly $217bn using different companies' disclosure measures, including guarantee maxima, lease-backstop thresholds and derivative notionals. Adding roughly $24bn of prospective Alphabet backstops produces roughly $241bn; that additional support was not yet finalized. Neither total includes all later additions, including Meta's roughly $13bn El Paso residual-value guarantee. These figures are neither a single accounting liability nor an estimate of expected losses.

Among the AI-infrastructure arrangements discussed here, Nvidia has the largest single disclosed guarantee: the Ohio campus's $105bn residual-value guarantee (RVG) — support tied to an asset's value falling below a contractual threshold. That amount phases in from lease commencement and is included in Nvidia's roughly $108.5bn total disclosed guarantee exposure. Alphabet's roughly $51.4bn combines guarantees and credit-derivative notionals, including the $43.8bn data-center backstop. These are comparisons of disclosed maximum exposures on differing bases — not amounts payable today, and not estimates of net loss.

Several of the largest arrangements depend on the same small group of tenants and chipmakers:

• Anthropic: Its leases have roughly $29bn of Broadcom support and are connected to Alphabet's tensor processing unit (TPU) financing. Roughly $200bn of contracts depend on Anthropic's continued payments; that is a measure of dependent contracts, not necessarily Anthropic's direct bill.
• OpenAI: It is the tenant behind Nvidia's $105bn Ohio RVG. Separately, Nvidia has committed up to $100bn to OpenAI, while OpenAI has roughly $360bn of computing capacity purchase agreements with Oracle, Amazon and CoreWeave. These are different financing and purchase relationships, with potential overlap.
• Meta: Its roughly $41bn of guarantee exposure is largely tied to infrastructure for its own use.

These figures illustrate shared counterparties; they are not additive exposures, and the article does not reconcile overlaps or payment schedules. The point of listing them is the concentration: this is not risk dispersed across the hundreds of participants in AI infrastructure — it is levered onto a few AI labs, a few chipmakers, and a few private-credit funds.

That concentration makes tenant cash generation central. The cited 2025 estimates put AI revenue at roughly $60bn and capital spending at roughly $400bn, though the populations those estimates cover need to be specified for the comparison to be meaningful. The later company figures use a different basis: Anthropic's annualized revenue exceeds $30bn and is reportedly still growing quickly; reported OpenAI annualized revenue is in the tens of billions (OpenAI is privately held and growing fast, so those estimates need an observation date). An annualized run rate extrapolates recent revenue; it is not a completed year's revenue. The ~$200bn of contracts dependent on Anthropic and OpenAI's ~$360bn of commitments extend over contract terms. Comparing those totals with annual revenue illustrates dependence on future growth; it does not establish an annual funding gap. A structure whose stability depends on the continued growth of a handful of startups, refinanced through opaque vehicles, is a structure whose stability is a function of that growth rate holding — not of any asset being worth what it is levered at.

A fair objection is that off-balance-sheet vendor and lease support is a normal ingredient of every capital-intensive infrastructure cycle — telecom networks, liquefied natural gas, power generation, aircraft — and that Big Tech has merely imported standard project-finance technique into its own supply chain. That is true, and it matters: the existence of these structures is not itself the alarm. What is unusual is the rate of change — roughly $300bn of new guarantee/SPV exposure in under a year against a revenue base a fraction of that size — and the concentration that technique arrives with.

2. What each guarantee covers

The coverage that treats all of this as one lump of "hidden debt" collapses distinctions that determine who gets hurt. There is no single guarantee; there are at least three structurally different promises:

• Alphabet backstops payments. It records data-center support through financial guarantees and credit derivatives, whose recorded values differ from their maximum contractual exposure. Depending on the contract, Alphabet may take over the tenant's lease obligations or make a termination payment. Of all these instruments, Alphabet's is the one most clearly a payment backstop — a bet on a counterparty's ability to pay.
• Nvidia and Meta guarantee the residual value of an asset. Nvidia's $105bn Ohio obligation is a residual-value guarantee on campus leases: if OpenAI fails, Nvidia covers the shortfall between a guaranteed minimum lease value and what is recovered by re-letting or sale. Meta's Louisiana guarantee is likewise a residual-value guarantee — it covers a decline in the property's value below a threshold, not Meta's own payment default. These are bets on assets and their recoverable value.
• Broadcom provides a lease backstop with a recovery formula. After an Anthropic default, Broadcom's exposure is calculated as (85% × the outstanding backstopped lease amount) minus the recoverable value of the AI racks. The deduction for asset recoveries is central to the formula.

The single thread running through all of them is that the support is not open-ended: it is a capped, conditional shortfall tied either to a counterparty's failure to pay or to an asset's failure to hold value — and that difference determines what has to go wrong before any of it activates.

Recovery risk depends on the collateral, and the type of collateral differs across the instruments. Broadcom's formula directly deducts rack recoveries; Nvidia's Ohio and Meta's property guarantees concern broader leased assets. For chip-backed financing, the open question is resale value. Ironwood tensor processing units (TPUs) and Blackwell graphics processing units (GPUs) are AI processors deployed within different software ecosystems, so recovering value from a large distressed fleet depends partly on finding buyers able to use it. The secondary market for purpose-built AI chips "does not yet exist at scale" — unlike aircraft, where GE Capital could re-lease a 737 through an airline bankruptcy because a deep resale market existed. Whether that is a genuine fragility or a manageable assumption depends on recoveries that have never been tested; it is a risk the market has priced on the guarantors' credit rather than on a liquidation market, and whether that pricing is right is an open question.

Compounding it is time. Nvidia and AMD have moved to a roughly annual chip release cycle. Rental rates for Nvidia's H100 GPU have fallen roughly 70–90% since 2023, illustrating pressure on earning power — though that percentage is not a measured haircut to resale value. There is no agreed useful life for a GPU: CoreWeave depreciates over six years, engineers and developers generally figure three or four, and some analysts say two to three. A longer depreciation schedule leaves a higher carrying value for the same hardware; if its economic life proves shorter, that carrying value may be harder to support.

3. How stress could spread

This is a conditional scenario, not a prediction of an imminent crisis. Several early-2026 reports describe credit-market stress at Oracle and litigation involving AI-infrastructure companies; those observations motivate the scenario but do not establish that every stage is already underway. The channels below show how a shock could spread. They may overlap, occur in a different order, or stop short of a system-wide event.

Several shocks could expose the concentration: slower demand for AI computing, lower collateral values, the default of a major tenant, or a refinancing freeze. Slower revenue growth would strain structures built around aggressive growth assumptions, but whether a particular vehicle becomes insolvent depends on its cash flows, financing terms and support. Cross-default clauses can spread a default to other agreements that contain the relevant contractual links.

Private credit reprices; leverage becomes liquidity pressure. Private-credit funds managed by firms such as Blackstone, Blue Owl, Apollo, Pimco and BlackRock play an important role in the financing discussed here. In loans with collateral-value tests, falling GPU values can breach limits on the loan's size relative to collateral value. Depending on the agreement, lenders may demand additional collateral or repayment, declare a default, or accelerate repayment. CoreWeave's $7.5bn GPU facility, whose repayment schedule began in January 2026, illustrates the interaction between falling collateral values and scheduled debt service — though the facility size is not the amount due on that date. This is where the story stops being "accounting" and becomes a liquidity question.

Guarantees can be called at the worst moment. Each guarantee has its own trigger and effective date. A common risk is that a payment obligation arises during stress, when asset recovery may also be difficult: Meta's guarantee pays if the property's value drops below a threshold; Nvidia's pays if OpenAI fails and the campus cannot be re-let or sold for the guaranteed minimum; Broadcom's pays the difference after rack recoveries; Alphabet's activates on a tenant payment failure. The shared feature is harsh but not a single trigger — a call lands when remarketing is hardest and recoveries are lowest. Nvidia's Ohio support, for example, only phases in as leases commence from 2028. This is the BIS's point about shadow borrowing: the guarantee is the channel by which a project-level default migrates to the hyperscaler and chipmaker balance sheets.

Circular financing can turn a credit event into a revenue shock. Nvidia helps finance OpenAI, which buys computing capacity from companies that in turn buy Nvidia chips. A demand slowdown could therefore reduce Nvidia's future chip orders while also exposing it to guarantee payments. If AI tenants cannot pay, chipmakers may face guarantee claims while future orders from infrastructure providers also shrink. The analogy with Nortel and Lucent is vendor financing — financing the demand you then lose — not identical contract terms: the AI guarantees discussed here have instrument-specific caps and conditions, and Nvidia's Ohio guarantee phases in with lease commencement. The size and timing of the two exposures require separate analysis.

The SPV boundary gets tested. In distress, creditors may challenge how assets and liabilities were separated. Possible arguments include treating an apparent asset sale as financing, seeking to hold a sponsor responsible for an entity's obligations, or asking a bankruptcy court to combine entities' assets and liabilities. These are distinct legal routes with different requirements. The Oracle bondholder suit (Ohio Carpenters' Pension Plan v. Oracle) and the CoreWeave securities class action show existing litigation; whether they deploy these longer-shot theories is a separate question.

Ratings can repressure. Ratings on under-construction data centers were issued largely off the credit of the Big Tech tenant or guarantor — rating agencies S&P Global Ratings, Fitch and Kroll Bond Rating Agency (KBRA) rated Meta's Hyperion facility investment grade substantially on the strength of its lease and residual-value guarantee, with the project's rating capped at the tenant's. A tenant or guarantor downgrade can put pressure on project debt whose rating depends on that support; the effect on each security depends on its rating basis and protections. Forced selling becomes a separate risk where a downgrade breaches a holder's investment mandate. The cited early-2026 reports identify Oracle as a vulnerable case: near the lower end of investment grade and on negative credit watch, with more than $130bn of debt and $248bn of new lease commitments — different obligation measures, not a single current debt balance — and a five-year credit default swap (CDS) spread, the cost of protection against default, at a 16-year high. Those observations do not establish whether stress had increased or eased by September.

Transmission to the financial system. The Chicago Fed's direct AI-adjacent exposure estimate is 0.8% of bank assets in its analysis. The broader figures use different scopes: private-credit firms receive up to a quarter of bank lending to nonbank financial firms, compared with 1% in 2013, while life insurers hold nearly $1tn in private credit across sectors. Those figures describe possible transmission channels, not AI-specific exposure. Losses could reach banks through lending to affected funds or firms, and insurers and pension funds through their debt, equity or fund holdings. Potentially broader 401(k) access would add another route to household exposure. The scary part of this structure is not the size of any one exposure — it is that losses in the opaque layer may be recognized only after they have spread.

4. Who is exposed, and who can absorb losses

There are four useful lenses: percentage equity loss, combined operating and guarantee exposure, capacity to absorb losses, and visibility into investor holdings.

By percentage equity loss: AI-lab shareholders — Anthropic, OpenAI, xAI — could suffer large percentage losses in a demand shock. That exposure is separate from the equity that absorbs losses within each infrastructure vehicle.

By combined operating and guarantee exposure: Nvidia stands out, because weaker AI spending could reduce chip orders while also triggering its guarantees. Broadcom has a related exposure. This identifies two connected risks, not a measured ranking of dollar losses. Lost chip orders are not equal to lost profit, because some production costs would also fall, and the commercial impact is separate from — and not limited by — the guarantee's contractual cap. The chipmakers may therefore be especially sensitive to a sustained AI slowdown; ranking their revenue declines or net losses against other companies would require company-specific modeling.

By capacity to absorb losses: Alphabet carries the largest total off-balance-sheet commitment of any single firm (~$890bn, mostly purchase commitments) and reports more than $185bn of operating cash flow with $519.5bn of contracted cloud backlog — but backlog is future business, not immediately available cash, and heavy investment is already constraining cash generation: free cash flow was negative $5.9bn in Q2 2026, and the cited analyses forecast a sharp fall in Alphabet's and Meta's free cash flow in 2026. Contractual caps limit guarantee payouts, but a guarantor's ability to absorb them depends on timing, liquidity and other commitments. Meta and Alphabet have diversified earnings streams that may provide a cushion; Nvidia's operating revenue is more exposed to AI demand, creating a risk that weaker sales coincide with calls on its guarantees. Among the hyperscalers discussed here, Oracle appears especially exposed to refinancing stress.

By limited visibility into exposures: private-credit fund investors, including limited partners (LPs) such as insurers and pension funds, may bear losses through their holdings. Some institutions also own project debt directly. Limited disclosure can make those exposures harder to assess before stress emerges. Blue Owl's cited $7bn digital-infrastructure fund illustrates that one fund can participate in multiple SPVs; its size is not an estimate of losses. "The institutions that are most exposed" and "the institutions that discover they were exposed" are not necessarily the same list.

Weighing these lenses, the counterintuitive read holds: the company that looks like the biggest winner of the boom — Nvidia, the chip supplier — carries the sharpest combination of revenue sensitivity and guarantee exposure, while the hyperscalers with the largest total commitments (Alphabet, Meta) are better placed to absorb losses, and Oracle is the fragile one. The AI labs are first to lose their relative worth, but that is equity destruction among the smallest players, not the largest absolute dollar losses. That is the read the structure supports — with the caveat that the chip-layer ranking is a revenue-concentration hypothesis, not a modeled loss figure.

5. How obligations are settled and losses allocated

Resolution involves several sources of repayment and several places where losses can fall. Their timing and priority depend on each deal's contracts; the following is a framework, not a universal payment sequence.

Operating cash flows and refinancing. Vehicles normally service debt from leases or contracts to buy their output. Shorter-term project loans, often called mini-perm loans, may later be refinanced with longer-term debt, including asset-backed securities (ABS) or commercial mortgage-backed securities (CMBS). If financing becomes unavailable when debt matures, the vehicle must find other repayment sources or restructure. This is one potential route to distress.

Within each vehicle, equity absorbs losses before debt. The Meta–Blue Owl venture cited here has a 20%/80% equity split. Losses on an AI tenant's own equity occur in a separate capital structure and need not follow the same timetable.

Contractual credit support pays only what its terms cover. Guarantee payments depend on the instrument. Nvidia's and Broadcom's formulas account for asset recoveries; Meta's support depends on an asset-value threshold; Alphabet's payment support has its own contractual remedies. Each instrument's limits and conditions must be assessed separately.

Collateral recoveries. Purpose-built data centers (stranded-asset risk; expensive to convert to general use) and GPUs (fast-depreciating, no deep secondary market) may be sold, with proceeds feeding senior lenders. The residual-value assumption that made the structure work is exactly what could break in a crisis.

Loss allocation depends on each vehicle's capital structure and guarantee terms, not on a single timeline. A solvent guarantor may keep covered senior debt whole — claims with higher repayment priority — while project equity loses value. Fund investors bear losses through the specific debt or equity their funds hold. Repayment comes from cash flows, refinancing, recoveries and applicable guarantees; losses fall on the relevant equity and debt holders; suppliers may separately lose revenue and profit. Whether driven by refinancing in a functioning market or fire-sale in a frozen one, the difference between an orderly correction and a 2008-style event is whether the losses are distributed in an orderly way.

6. What would make the scenario less likely

A rigorous post should say which observations would strengthen or weaken the case.

The descriptive claim — that these off-balance-sheet commitments exist and are concentrated on a few counterparties — is established by the filings regardless of any outcome. The stress scenario is conditional: it fires only if demand stalls or reverses, collateral values fall, a major tenant defaults, or refinancing freezes. These are indicators to monitor through 2028, not a binary falsification test:

• Tenant cash generation. Continued revenue growth at the largest AI labs — including growth around or above the illustrative 50%-year-over-year benchmark — would reduce the immediate case for distress. But strong growth alone does not establish that each tenant can meet its obligations.
• Asset recoveries. Resilient chip resale values and functional secondary markets would weaken the collateral-fragility argument.
• Refinancing access. Sustained data-center private-credit/ABS issuance and rollover capacity would reduce the refinancing-risk case.

The more direct test of the proposed transmission mechanism would be a material shock to demand, collateral values, refinancing or a major tenant without the predicted spread of losses. If no such shock occurs, the scenario remains untested rather than confirmed or refuted. In that world this essay is a description of a large, currently-healthy shadow-finance layer — not a crisis forecast.

This is not 2008 in the way the lazy comparison implies. Subprime mortgage lending was built on weak documentation and underwriting that AAA credit ratings did not penalize, and on collateral whose value was inflated by the same leverage; the AI buildout's guarantors, by contrast, are some of the most cash-generative enterprises on the planet, and its tenants are growing at triple-digit rates off real (if euphoric) revenue. The risk is narrower than fraud. The structure priced two assumptions — durable recovery values, and continued very-high revenue growth from a small base — that have never been tested at this scale, and the financing let them run further than the underlying economics could validate.

The bottom line

The FT's roughly $300bn estimate of guarantee and vehicle-financing exposure, and Morgan Stanley's more than $3.1tn of broader commitments, describe different parts of the financing picture; neither is a measure of expected losses. The real concentration is not the company with the biggest number — it is the dependence of many structures on a few AI tenants, chipmakers and private-credit funds, with the chip suppliers carrying the sharpest sensitivity as guarantor and supplier at once.

Watch tenant cash generation, asset recoveries and refinancing access. Those will determine whether any stress is absorbed by individual investors or spreads through the financing network. Whether a downturn could be absorbed in an orderly way remains uncertain.

Sources and scope:

• Headline exposure estimate (~$300bn) — Financial Times investigation, Sept 20, 2026.
• Broader commitment estimates (~$2.7tn / $3.1tn; Alphabet ~$890bn) — Morgan Stanley, as reported by Bloomberg Tax and Axios, Aug 2026.
• Company exposure figures — Alphabet & Meta Q2 2026 10-Qs, Nvidia Form 8-K (Aug 17, 2026), Broadcom filings.
• Cross-company reconstruction (~$217bn/~$241bn) — Data Studios and Stanford Tech Review primary-filing analyses.
• Transmission, financing and legal analysis — BIS Quarterly Review (Mar 2026), BIS Bulletin No. 120 (Jan 2026), Moody's (Feb 2026), Federal Reserve Bank of Chicago (Feb 2026), Quinn Emanuel client alert (Mar 2026).