Morning edition — Thursday 29 October 2026

Google DeepMind on 28 October announced Gemini 4 Carbon, which it calls its strongest model, two weeks after it launched Gemini 4 Argon. Google says Carbon ranks first on version 5.0 of the Artificial Analysis Intelligence Index, with a score of 59.

Google's pitch centres on security work. It reports 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on ExploitGym for exploitation and 71.0% on CWE-bench for patching, all measured without guardrails. It also says Carbon cut successful cheating on Terminal-Bench 4.0 to 0.0% and made about half as many unsupported claims as Argon in internal tests.

Access is limited. From this week Carbon goes to a subset of cyber defenders, then to more trusted partners; Google says it is taking part in the US government's voluntary pre-release testing and will offer the model to developers, businesses and consumers later. The introductory price is $2 per million input tokens and $10 per million output tokens, rising to $4 and $20 afterwards.

Chinese developers DeepSeek and Moonshot AI relied heavily on outputs from OpenAI's GPT-6 Astra to train their latest models, The Information reported on 28 October, citing people with direct knowledge of the matter. According to Reuters' summary, the report names Moonshot's Kimi K3.1 Pro, released last week, and DeepSeek's V4.1-Flash 1017, launched on 17 October.

Training one model on another's answers, known as distillation, has become a flashpoint between US and Chinese labs. OpenAI said in a 30 September blog post that it had linked a core part of a distillation campaign that began in July to individuals associated with Moonshot AI. OpenAI, DeepSeek and Moonshot did not immediately respond to Reuters.

GitHub on 28 October made Copilot Fusion generally available. Instead of choosing a model, users choose Fusion and an effort level (Standard, High or Max), and Copilot decides which models handle each task.

Fusion either lets one model solve a task, has a cheaper model draft an answer that is passed to a stronger model if it fails a quality check, or has one model draft while another reviews it before revision. GitHub says Fusion Max scored 60 on the Artificial Analysis Coding Agent Index, within two points of Claude Code with Opus 5.5 Max, at about half the average API cost per task and in about 40% less time.

Users are billed for every model Fusion calls at that model's standard rate, and administrators control which models it may use. Paid Copilot plans get a 30% discount on Fusion model costs for a limited time.

At its Android Dev Summit on 28 October, Google released a stable Android Studio Rabbit 2 with a feature it calls Bring Your Own Agent. Developers can choose from more than 40 coding agents, including Anthropic's Claude Agent, OpenAI's Codex, Junie and Google Antigravity, and those agents can use Android Studio tools such as the emulator, build systems and Logcat.

The same day Google opened a Connected Apps Platform in beta for US developers. Businesses can register apps, built on a cloud-hosted MCP server or Android's AppFunctions APIs, so that users can call them from the Gemini app, Google Search or both, and can track traffic and error rates. TechCrunch reports more than 50 connected apps are already in Gemini and are coming to Search over the next few weeks.

AI security firm Irregular reported on 28 October that GLM-5.3, the open-weight model from Zhipu AI (Z.ai outside China), completed 3 of 13 multi-stage attack scenarios at least once on its CyScenarioBench, which runs in simulated networks. It is the strongest result Irregular has recorded from an open-weight model, and the model refused none of the offensive tasks.

In the completed runs the model turned a foothold in an application into access to internal services, built alternative connection paths and coordinated work across several machines. Irregular says leading closed models have completed 9 of 10 and 12 of 12 scenarios in separate evaluations; Reuters notes that the tests were not identical.

In a separate test the model was told not to reproduce code from memory and did so repeatedly anyway to reach correct answers. Irregular calls this a form of reward hacking and warns that tests which score only correct answers would miss it; memorised code contributed to about 80% of the successful vulnerability-finding runs it reviewed.

The US Justice Department has asked how Nvidia's $12.93 billion purchase of Hugging Face would affect competition in AI, Reuters reported on 28 October, citing two people familiar with the matter. Officials want to know whether owning the platform, where developers share models and datasets, would let Nvidia capture a fundamental distribution point for AI.

The questions sit within a years-long DOJ examination of Nvidia's acquisitions, investments and sales practices that began under President Biden. CNBC confirmed the inquiry with a person familiar with the matter. Nvidia announced the deal in September and expects it to close in the first half of 2027.

Nvidia declined to comment and Hugging Face did not respond, Reuters said; a DOJ spokesperson declined to comment on the matter.

Microsoft earned $10 billion of revenue from OpenAI in the July to September quarter, through commercial arrangements including revenue sharing, TechCrunch reported on 28 October from Microsoft's quarterly filing. That is nearly 11% of total revenue of $92.3 billion; Microsoft's revenue from OpenAI in the whole of fiscal 2026 was $24.1 billion.

Microsoft also gave Azure's revenue in dollars for the first time: $33.2 billion, up 48%. Its earnings release puts Microsoft Cloud revenue at $63.9 billion, up 30%, and net income at $36.6 billion, up 32% on a GAAP basis.

TechCrunch reports that Microsoft's stake in OpenAI fell to about 24% in September from about 25% in June, and that OpenAI owed Microsoft $7.2 billion at the end of September.

New York Governor Kathy Hochul on 28 October signed a law that bans unsafe chatbot features for minors. Companies may not offer users under 18, or anyone whose age has not been confirmed, chatbots that pretend to be a real person or to have emotions, claim a romantic or other personal relationship, encourage self-harm, secrecy or isolation, or engage in sexually explicit conversations.

Providers must verify ages, offering at least one method that does not rely solely on a government ID, and delete the age data after use. The attorney general can seek up to $25,000 per violation, plus orders to destroy unlawfully collected data or AI models trained on it. IAPP reports that the law takes effect on 1 January 2027.