Google ships Gemini 4 Carbon as AI security risks escalate

2 Sep 2026. Google released Gemini 4 Carbon just two weeks after Argon, claiming SOTA on cybersecurity and long-horizon tasks and the top spot on the Artificial Analysis V5 leaderboard. The launch headlines a crowded model day: Mistral Large 4 (1T parameters, open weights) scored 19.7% on FrontierCode 2.0, edging DeepSeek V4.1Flash's 19.3%, while Epoch AI found open-weight GLM 5.3 autonomously turned public Firefox patches into working exploits across 6 versions in 48 hours with no human intervention, at roughly $1,000 per run. Security was the day's second theme. Anthropic reported that an internal Claude research model uncovered 62 critical or high-severity CVEs in Chrome, including 13 sandbox escapes, plus a Pixel 9 lockscreen photo-extraction attack. Separately, Wired revealed a contractor ran a banned Claude agent on the Pentagon's NIPRNet for two months, and a malicious Claude Code extension in Cursor's marketplace hit up to 5,000 users. Third, infrastructure and capital questions mounted: the four US giants' combined $750 billion AI capex faced slowing core ad growth, with Alphabet suffering its largest-ever one-day share drop and nearly $500 billion in market value erased. Meanwhile Google ran a Gemma 4 model on TPUs in orbit under Project Suncatcher, and a unified training paper merged pretraining, midtraining, SFT and RL into one likelihood-based algorithm.