Gated Frontier, Open Weights, Poisoned Extension: Who Supplies Your AI Stack

Five stories about who supplies the pieces

This week's AI news is mostly about suppliers: who you can buy from, on what terms, and what they can push onto your machines. Five stories from the last seven days, from five different companies:

Several of these are only days old, so we give dates and sources, and we flag where a claim rests on a single report or on the vendor's own numbers.

Google gates Gemini 4 Carbon, and publishes its own scores

Google announced Gemini 4 Carbon on October 28 as its strongest model for cybersecurity and long-horizon work. Access starts with an unnamed subset of cyber defenders, extends to trusted partners through a program called Fairwind, and reaches developers, businesses and consumers "as soon as possible", a phrase the announcement never turns into a date.

The published numbers come with conditions:

• Artificial Analysis Intelligence Index v5.0: 59, first place according to Google.
• SEC-bench Pro: 88.2%, self-computed as pass@1 on a 183-task JavaScript engine split, averaged over three attempts.
• ExploitGym: 54.8%, self-computed, one attempt per task, no internet access.

Treat these as vendor claims until independent runs exist. Google's statement that Carbon worked for days on engineering tasks is, by the source's own account, an internal observation rather than a published test.

The price is the part you can plan around. The introductory API rate is $2 per million input tokens and $10 per million output, the same as Gemini 4 Argon, with cached input 95% cheaper. A footnote sets $4 and $20 after the introductory period, with no end date. A team budgeting for 2027 should model the doubled rate.

Our reading: a model you cannot call is a roadmap item. If a cyber or code-repair pipeline would benefit, apply through the trusted-access route now and keep your current model as the default until a general API exists.

GPT models land on Google Cloud, and OpenAI may buy Google's chips

On October 21, Ars Technica reported that OpenAI's GPT 6 and 6.1 models (Astra, Sol and Luna) are rolling out on Google Cloud in private preview for select enterprise customers. Inference runs on Google's infrastructure and billing goes through the Google Cloud Marketplace. Microsoft remains OpenAI's primary cloud partner. Google says it is now the only large cloud offering all three leading closed model families.

On November 1, a report citing The Information said OpenAI plans to buy Google TPUs; terms, quantities and delivery schedules are undisclosed. The same report notes OpenAI began renting Google's chips in 2025 and plans to deploy its own custom chip, designed with Broadcom, before 2027. This is one outlet relaying another on a proposed deal, so we treat it as likely until confirmed.

The practical consequence sits in procurement. If your company already has committed spend on Google Cloud, GPT models may soon be billable against it, and running two model vendors no longer implies a second contract. Before rewriting a vendor strategy around that, we would test latency and quotas on the Google-hosted endpoints, which no announcement covers.

DeepSeek ships a coding agent that speaks first

On October 31, DeepSeek's Harness team announced on WeChat a prototype open-source coding agent called Super-agent, according to Bloomberg's report in The Straits Times. It can monitor developer group chats and propose fixes without being asked. Its GitHub manual states the aim: "take as little human attention as possible, and give as much value as possible". The same report says DeepSeek raised about 100 billion yuan ahead of an IPO.

Two consequences for builders. First, DeepSeek created a team in 2026 dedicated to the harness, the scaffolding around a model that decides tool use, memory and when to act. That is where coding agents now compete. Second, an agent that reads team chat and volunteers actions has a different permission profile from one you invoke. Everything posted in the channel becomes input: pasted logs with tokens in them, and anything a malicious participant writes.

We have not run Super-agent. Our first step is to read the manual's permission model, then run it in a container with no credentials against a throwaway channel.

Pika opens a six-step video model built on MiniMax H3

On October 29, Pika released H3 Flex, an open-weight video model post-trained from MiniMax H3. It cuts generation from 50 steps to six, produces synchronized audio, and accepts up to 12 reference inputs across images, video and audio. Native output is 480p and 768p; 1080p, 2K and 4K stay on Pika's hosted service, as do audio-stem separation and some other features.

What ships openly is narrower than "open weights" suggests. The adapters are on Hugging Face under the MiniMax H3 Community License Agreement, and only the inference and loader code is Apache 2.0. Commercial use therefore depends on MiniMax's license terms as much as on Pika's release.

One independent tester reported about 100 seconds for a 5-second clip on an RTX 5090, roughly 3.6 times faster than a previous model. The author notes this rests on two tests on one machine, so we would not quote it as a benchmark.

For product teams, reference-conditioned video with audio is now something you can host. That matters where data cannot leave your infrastructure or where per-clip API pricing breaks the margin. Read the community license before any client work.

A trojanized Claude Code extension reaches Cursor users

On October 30, The Hacker News reported that version 2.1.313 of the extension published under the ID anthropic.claude-code on the Cursor Marketplace contained a malicious loader. Cursor said at most 5,000 users were affected, that the version was not developed by Anthropic, and temporarily shut its marketplace to remove the package. How the attackers published it is still unclear. Microsoft's guidance covers hosts that installed either 2.1.312 or 2.1.313 from Cursor's marketplace.

Per the analysis, the loader:

• adds an attacker-controlled key labelled "svc-telemetry" to ~/.ssh/authorized_keys;
• installs persistence through a scheduled task, crontab or LaunchAgent;
• sends host details to an external server, including the names of up to 40 environment variables matching KEY, TOKEN, SECRET, PASS, AWS or GCP (names only, values are not in the initial beacon).

Enabling the SSH service needs admin rights the extension usually lacks on macOS and Windows, so the tunnel step likely fails there. The key, persistence and beacon run regardless. No bad version was reported on Open VSX or Microsoft's marketplace, where Anthropic's latest release is 2.1.314.

An extension with a legitimate publisher ID can change under you, and an AI coding extension runs with the developer's full access. Uninstalling or updating it does not remove artifacts written outside its install directory, as Microsoft points out. On any host that updated through Cursor around October 30: remove unknown keys from authorized_keys, delete the persistence entries, and rotate credentials and sessions. Going forward, pin extension versions in managed editors.

What we're checking next week

• Which editor extensions on our machines auto-update, and where the editor allows pinning.
• Super-agent's permission model, read before any run, then an isolated container only.
• Independent evaluations of Gemini 4 Carbon, since Google's self-computed cyber scores are the only numbers today.
• Latency and quota on GPT models served from Google Cloud, once the preview widens.

If you want a review of the extensions, agent tools and model providers your team depends on, get in touch.