Google holds Gemini 4 Carbon back for defenders as Alphabet's cash goes negative

Alphabet's AI build-out costs more than operations bring in

Alphabet reported its September quarter on 28 October. Revenue was US$127.6 billion, 25% above the US$102.3 billion of a year before. Google Cloud grew 103% to US$30.71 billion, and the Gemini app passed one billion users. Purchases of property and equipment reached US$51.4 billion, against roughly US$24 billion a year earlier. Operations generated US$42.3 billion, so free cash flow ended at minus US$9.1 billion.

Alphabet kept its 2026 capital spending range at US$195 billion to US$205 billion and told investors to expect another big increase in 2027. Earnings per share came in at US$2.12, below forecasts of about US$3.01. The stock fell around 10% in after-hours trading and then about 12% on 29 October.

What it means for NZ organisations: Google is funding this capacity partly with debt and share sales, and customers will end up paying for it. Where your Google Cloud usage is predictable, lock in committed pricing.

Gemini 4 Carbon reaches cyber defenders before anyone else

Google unveiled Gemini 4 Carbon on 28 October, about a fortnight after Gemini 4 Argon. For now only a limited group of cyber defenders can use it. The Fairwind Program will bring in trusted partners in stages, and Google hasn't set a date for wider release. Carbon scores 59 on version 5.0 of the Artificial Analysis Intelligence Index, the top result.

On security benchmarks, it scored 88.2% for locating vulnerabilities (SEC-bench Pro), 71.0% for patching them (CWE-bench) and 54.8% for exploiting them (ExploitGym). On Google's internal tests, it's more than twice as successful as Argon at writing secure code. Introductory pricing is US$2 per million input tokens and US$10 per million output tokens. Both rates double, to US$4 and US$20, after the introductory period.

What it means for NZ organisations: Few local teams will get in early, so ask your managed security provider whether it's part of Fairwind. Base your budgets on the higher rate.

Microsoft's quarter shows how much OpenAI matters to it

Microsoft also reported on 28 October, for the first quarter of its 2027 financial year. Revenue grew 19% to US$92.3 billion, and Azure rose 48% to US$33.2 billion. Cash spent on property and equipment roughly doubled, to US$39.4 billion from US$19.4 billion. Commercial remaining performance obligation, which counts contracted revenue not yet earned, jumped 73% to US$677 billion.

TechCrunch went through the quarterly filing and found that OpenAI, including revenue sharing, contributed about US$10 billion. That's close to 11% of the total. Across fiscal 2026, OpenAI was worth US$24.1 billion to Microsoft. The amount OpenAI owed Microsoft climbed to US$7.2 billion from US$6 billion in June, while Microsoft's holding slipped to roughly 24%.

What it means for NZ organisations: If you buy OpenAI models through Azure, check your renewal terms carefully. The two firms' finances are now closely tied, so changes between them could reach your contract.

Anthropic model links bugs into full attacks on five platforms

On 27 October, Anthropic described an unreleased model that combined separate bugs into working attacks. In Chrome on macOS, a web page could launch a program outside the sandbox. In Safari, the attack turned off the same-origin policy and exposed cookies and logged-in sessions. A locked Pixel 9 gave up its photos over USB. A few packets could crash Windows servers running native HTTP/3 (CVE-2026-33096). Linux machines with multipath TCP listeners were open to zero-click root access (CVE-2026-98432), and that chain took about 53 minutes to build.

The Chrome work alone produced 62 CVEs rated critical or high, all fixed by Chrome 156. Apple, Google and Microsoft have shipped their fixes, and the Linux fix has been backported to all maintained stable kernels.

What it means for NZ organisations: The time between a fix being published and a working exploit appearing is getting shorter. Patch internet-facing servers on a faster cycle and keep browsers and phones up to date.

GitHub spreads coding tasks across several models

At its Universe event on 28 October, GitHub launched Copilot Fusion. Fusion looks at what each task needs and decides whether to run it on one model or several. GitHub says Fusion Max scored within two points of Opus 5.5 Max on the Artificial Analysis Coding Agent Index, costing half as much and taking 40% less time per task. The Octoverse 2026 report, released the same day, says agents started more than 40% of pull requests in September, about 110 million. In March the figure was around 17%.

What it means for NZ organisations: Give pull requests from agents the same reviews, tests and permission limits you'd apply to any other contributor.

Chinese labs accused of training on GPT-6 Astra

On 29 October, Reuters reported, citing The Information, that two Chinese models had relied heavily on outputs from OpenAI's GPT-6 Astra during training. They're DeepSeek's V4.1-Flash 1017, launched on 17 October, and Moonshot AI's Kimi K3.1 Pro. None of the three companies replied straight away. In a 30 September post, OpenAI had already linked a distillation campaign that started in July to people associated with Moonshot.

What it means for NZ organisations: Before a low-cost model gets near customer data, check where it came from and what its licence allows.

US antitrust officials question Nvidia's Hugging Face purchase

In a Reuters report published on 29 October, Justice Department officials were said to be asking whether Nvidia's US$12.93 billion purchase of Hugging Face would give it a "fundamental distribution point for AI". They've also asked who competes with the platform. The questions sit within a wider review that also covers Run:ai, SchedMD and Nvidia's licensing deal with Groq. Nvidia declined to comment and expects the purchase to close in the first half of 2027.

What it means for NZ organisations: Keep your own copies of the open models your systems depend on.