Google’s Gemini 4 Carbon scores 88.2% on SEC-bench Pro, but only vetted cyber defenders get to use it

😁 Hello, super humans! Google just shipped a model that is better at finding software vulnerabilities than most of us are at reading them, and then handed the keys to a very short guest list. We also have GitHub routing coding steps between models, smartphones having their worst third quarter since 2013, and a robot that plays Othello.

📰 Quick Signals

• 🧠 AI: NVIDIA releases Nemotron 3.5 Transcribe, a free open-weight speech-to-text model for recordings in up to 40 languages that separates up to eight speakers and translates 31 languages to or from English; it does not handle live audio.
• 🤖 Robotics: AGIBOT proposes Worken, a metric for productive robot work, and launches the G2 Max industrial robot with 21 degrees of freedom and dual-arm handling up to 40 kg.
• 💻 Programming: GitHub launches Copilot Fusion at Universe, a router that sends each step of a coding task to the model or models best suited to it, and opens every Copilot feature to Enterprise customers on a pay-per-AI-credit basis.
• ⚡ Electronics: Kioxia brings its LD4 Series SSDs to hyperscale data centres, pairing the E1.L form factor with eighth-generation BiCS FLASH QLC NAND.
• 📡 Telecom: Omdia says global smartphone shipments fell 20% year on year to 254.7 million units in 3Q26, the lowest third quarter since 2013, as higher prices and memory costs bit.

🔍 The Big Story: Google’s Gemini 4 Carbon scores 88.2% on SEC-bench Pro, but only vetted cyber defenders get to use it

A frontier lab has built a model it considers strong enough at offense and defense that it will not simply ship it, and that tells you where cybersecurity is heading faster than any benchmark chart.

What happened: On October 28, Google announced Gemini 4 Carbon, which it calls its strongest model, with state-of-the-art cybersecurity and long-horizon capabilities, two weeks after Gemini 4 Argon. Access starts with a subset of cyber defenders and widens gradually to trusted partners through the Fairwind Program; developers, businesses, and consumers get it “as soon as possible,” with no date. Google is also taking part in the U.S. government’s voluntary pre-release testing. Details are in the Google announcement.

The details: Google reports 88.2% on SEC-bench Pro (finding real vulnerabilities), 54.8% on ExploitGym (exploitation, billed as a new state of the art), 71.0% on CWE-bench (producing working patches, run via Collinear), and a score of 59 on the Artificial Analysis Intelligence Index v5.0, ranked first. It says the cyber results were measured without guardrails, and that internal teams have watched it run for days through dead ends to root-cause subtle bugs in large codebases and low-level systems. On safety, Google claims 0.0% attack success on the Gray Swan indirect prompt injection benchmark (0.7% for Argon), successful cheating on Terminal-Bench 4.0 down to 0.0%, and almost 80% fewer high-severity misalignment alerts in internal live coding. Introductory pricing is $2 per million input tokens and $10 per million output, with cached input 95% cheaper, rising to $4 and $20 afterwards. The post does not state the context window, modalities, or model size, and most numbers are Google-reported or internal.

flowchart LR
    A[Gemini 4 Argon] -->|two weeks later| B[Gemini 4 Carbon]
    B --> C[Cyber defenders]
    C --> D[Trusted partners via Fairwind]
    D --> E[Developers, businesses, consumers]
    B -.-> F[US voluntary pre-release testing]
    F -.-> E

🗞️ More News

🧠 AI

• Claude adds legal review artifacts for contract review, legal citation checking, and regulatory tracking; teams can start from a sample, connect their own documents, and share the workspace.
• Google expands ads in AI Search to more international markets, with multi-turn ad formats planned for the U.S.; Alphabet reported $127.6 billion in quarterly revenue, up 25%, while search ad growth slowed from 19% in Q1 to 12% in Q3.
• OpenAI sets up an election monitoring center, with hundreds of employees watching for misuse of ChatGPT during the November 3 U.S. midterms and the vote count.
• Malaysian customs seize advanced AI chips worth over $12 million hidden in 30 servers at Kuala Lumpur airport; officials suspect transshipment to evade export restrictions.
• Meta partners with Caltech, Ohio State, LSU, Indiana University, and UTHealth Houston on clinical records, cancer, and scientific discovery; Meta says patient data stays inside institutional environments.
• ChatGPT adds iCloud Mail and Calendar plugins, letting users search messages and manage events after connecting Apple accounts with app-specific passwords.
• OpenAI and ServiceNow expand their partnership: a plugin connecting authorized workflow actions to ChatGPT is available now, with more functions expected by year-end.
• XREAL opens orders for its AURA Android XR glasses: 70-degree field of view, built-in Gemini, a tethered processing unit that keeps the glasses under 95 grams, from $1,099, with U.S. shipments expected in mid-November.

🤖 Robotics

• AGIBOT proposes Worken, “Effective Intelligent Work Hours” (active robots x autonomous working hours x output efficiency ratio), and shows its AHA3 humanoid platform, G2 Max industrial robot, and Link-U OS 1.0, which it plans to fully open source by the end of 2026.
• A3 reports North American robot orders up 24.8% in Q3 2026 compared with Q3 2025.
• Bedrock Robotics announces a $600 million Series C to scale autonomous construction equipment across U.S. sites.
• ANYbotics launches ANYmal X, a legged inspection robot built for explosive atmospheres in oil, gas, and chemical sites.

💻 Programming

• GitHub’s Octoverse report counts 17.9 billion code pushes and 1.3 billion merged pull requests in the 12 months to September 30, with agents opening over 40% of pull requests by September (up from 17% in March); TypeScript is the most-used language and Rust grew fastest among the top languages.
• LlamaIndex proposes a Document Parsing Protocol: draft 0.1 has 140 shared rules for interpreting tables, forms, and diagrams so agents get consistent meaning from the same document, and it is open for public review.
• Cloudflare and VoidZero introduce tsrs, an experimental AI-generated Rust port of the TypeScript compiler that claims faster checking and lower memory use, but has no watch mode or language server yet.
• Atlassian’s 2026 Developer Experience survey finds developers reporting double-digit weekly time savings from AI fell from 68% to 26%.

⚡ Electronics

• Raltron launches a series of monolithic crystal filters for ground equipment in low Earth orbit satellite broadband networks.
• PsiQuantum shows an eight-by-eight optical signal switch prototype, derived from its quantum computing work, for routing light between AI processors; samples are going to prospective customers.
• Hackaday asks whether one instrument could replace the logic analyzer and oscilloscope on your bench.
• Hackaday looks at an attempt at a useful desktop-style operating system for microcontrollers that are now capable enough to rival older PCs.

📡 Telecom

• T-Mobile says it intends to be first with 6G and rules out an MVNO arrangement with SpaceX.
• SpaceX’s spectrum quest could lead to the 600MHz band.
• Federated’s AI planning tool is credited with cutting a fixed wireless provider’s failed installs in half.
• Nvidia says it has no plans to attack custom silicon in fiber access equipment with GPUs.

👨‍💻 Code Corner

Budgeting for a long-horizon agent run is easier with a ten-line helper that knows Carbon’s published rates and the 95% cached-input discount.

RATES = {"intro": (2.00, 10.00), "standard": (4.00, 20.00)}  # USD per 1M tokens (input, output)

def carbon_cost(input_tokens: int, output_tokens: int, cached_tokens: int = 0, tier: str = "intro") -> float:
    p_in, p_out = RATES[tier]
    fresh = input_tokens - cached_tokens
    cached_cost = cached_tokens * p_in * 0.05  # cached input is 95% off
    return (fresh * p_in + cached_cost + output_tokens * p_out) / 1_000_000

# A 5M-token agent session: 4M input (3M of it cached) and 1M output
print(f"intro:    ${carbon_cost(4_000_000, 1_000_000, 3_000_000, 'intro'):.2f}")
print(f"standard: ${carbon_cost(4_000_000, 1_000_000, 3_000_000, 'standard'):.2f}")

🧰 Toolbox

• Document Parsing Protocol: LlamaIndex’s draft spec of 140 shared rules for reading tables, forms, and diagrams consistently across agents.
• Dedica: runs 125 checks to find tasks AI browsing agents cannot complete on your site, then suggests fixes.
• Nemotron 3.5 Transcribe: free open-weight transcription for recorded audio, with speaker separation and translation.
• Luxonis OAK 4 FFC: a modular board-level vision computer for machines too compact for standard cameras.
• Desktop OS for microcontrollers: an experiment in a desktop-style operating system for MCUs that now rival older PCs.

🛠️ Build of the Week (rotating)

Robot Picks Up Othello: A robot that physically plays Othello, built from an idea a high school student first tried to code years earlier.

• Difficulty: Intermediate
• Parts: see the Hackaday write-up for the full parts list
• Why we like it: it turns a classic game-AI exercise into a pick-and-place problem, which is where software meets the real world.

📚 From the Blog

• Turning Pixels Into Something the AI Can Eat: episode 3 of the camera series, where clean pixels that crossed the network become model-ready input.
• Building Your First Neuron From Scratch: part 2 of the neural network series, turning a stack of simple, learnable transformations into working code.
• The Network Behind the Cameras: the unglamorous plumbing of moving pixels without choking the network.

😀 The Bot Says…

Google’s most capable security model can find the bug, exploit the bug, and patch the bug. It cannot yet get past the velvet rope at its own launch party.

---

That’s all for today! Reply and tell us: would you rather have the strongest model gated, or a slightly weaker one for everyone?