Gemini 4 ships to cyber defenders first, the FTC opens a probe into AI labs, and OpenAI names Moonshot

This edition covers AI developments published between September 30 at 08:15 and October 1 at 08:15 in Dhaka.

Google put a new frontier model on the board on Wednesday, then kept most of the board to itself. Gemini 4 Argon is the first model of the company's Gemini 4 generation and larger than the Pro models that preceded it, and Google says it leads on the coding, financial-research, legal-drafting and cybersecurity benchmarks the company chose to publish. Google released it to a set of vetted cybersecurity partners instead of to customers, and gave no date for general availability. 12

Two enforcement stories moved underneath it. The Federal Trade Commission confirmed an industry-wide probe of AI labs and said it will compel testimony from executives, the first US enforcement action aimed squarely at the rogue-agent incidents that began in July. OpenAI separately published an account of a months-long campaign to extract its models' hidden reasoning and attributed a core cluster of it to people associated with Moonshot AI, the Chinese developer of Kimi. 34

The commercial day pointed the other way. Synopsys and OpenAI said they will build a model specifically for designing computer chips and split the revenue; ElevenLabs doubled its valuation to $22 billion in an employee tender; and CoreWeave began running customer production workloads on Nvidia's newest rack while DeepSeek open-sourced the software layer for Huawei's alternative to it. 5678

Google announced Argon on Wednesday as the anchor of its Gemini 4 generation. A company spokesperson told Reuters the model is larger than the previous advanced Pro line, and that Google considers it comparable to OpenAI's GPT-6 Astra and Anthropic's Claude Opus 5.5 on key coding and cyber benchmarks. Reuters also reports that Google no longer plans to release Gemini 3.5 Pro, which the chief executive had said would arrive in June. 2

The rollout is the part worth reading twice. Argon is going first to a set of cybersecurity partners through a Google programme called Fairwind, and Google says it is taking part in the US government's voluntary process for giving agencies pre-release access to models. Google will release Argon without cyber guardrails to those trusted defenders and to its own internal teams, and it says wider availability will follow "as soon as possible", starting with paid API customers and Google AI Ultra subscribers. No timeline was given. 114

What changed inside the model is mostly about length. Argon raises the output limit to 1 million tokens from 64,000, which Google pairs with a new API feature, Long Decode Continuation, that pauses a long response and resumes it across follow-up calls so reasoning can run that far without timing out. The context window is also 1 million tokens. Introductory pricing is $2 per million input tokens and $10 per million output tokens, with cached input at 95% off; the standard prices after the introductory period are $4 and $20. 19

Google's own table puts Argon ahead of GPT-6 Astra, Claude Fable 5.1 and Claude Opus 5.5 on most of the rows it chose, including DeepSWE v1.1, which measures long-horizon software engineering, at 77.9%, and the Vals Index, which weights finance, coding, legal and tax work by each sector's share of US GDP, at 68.9%. Argon trails Astra on Terminal-Bench Science 0.1 (57.6% against 68.1%) and OSWorld-2.0 (69.2% against 72.6%), trails Opus 5.5 on Terminal-bench 4.0 and PostTrainBench, and trails Astra on FrontierSWE v2 (55.0% against 65.5%). Reuters notes that Argon remained behind on two of the four coding-related benchmarks Google included. 12

The independent reading is more interesting than the lead column. Artificial Analysis, which runs its own evaluations across models, put Argon at 53 on its Intelligence Index at high reasoning effort, level with GPT-6 Astra at maximum effort and one point above GPT-6.1 Sol. That is 23 points above Google's previous non-Flash model, Gemini 3.1 Pro Preview, and 12 above Gemini 3.8 Flash, and it is the measurement behind the argument that Google has rejoined the top three labs on achieved capability. 9

Two numbers in that evaluation matter more than the headline. The first is cost per task: at the launch discount Argon costs $1.99 to complete one Intelligence Index task, about 60% of Astra's $3.26, but that rises to roughly $3.98 when the 50% promotion ends, which would put it slightly above Astra. The saving comes from lower token prices rather than fewer tokens — Argon spends about 62,000 output tokens per task against Astra's 27,000. The second is hallucination: on Artificial Analysis's omniscience evaluation Argon invents an answer 15% of the time, the lowest rate the firm has recorded for any model scoring above 45 on its index, against 51% for GPT-6 Astra and 54% for GPT-6.1 Sol. Its raw accuracy of 50% is lower, five points below Gemini 3.1 Pro Preview and 13 below Astra, so the model is more likely to say it does not know and slightly less likely to be right when it does answer. 9

Google's internal results show what the model is for. Argon beat a published baseline by 40% on a quantum-computing subroutine, and agents running on it analysed fleet-wide profiling data and freed more than 300 tebibytes of memory across Google's data centres, with an estimated 500 tebibytes to 1 petabyte in total. Argon agents are also migrating C and C++ code to Rust, including the Fuchsia Zircon kernel at more than 800,000 lines, and one such effort replaced 32,000 lines of hand-written SIMD code in Google's libgav1 video decoder with compiler-vectorised Rust, producing a memory-safe decoder that runs 2.7 times faster than the previous Rust port. 1

On safety, Google describes four measures before broad release: refusal training for cyber and chemical, biological, radiological and nuclear misuse; resilience to indirect prompt injection, which it says leads on Gray Swan's benchmark; monitoring of the model's chain of thought and actions to stop runs that step outside the user's intent, with alerts to a dedicated incident response team; and sealed sandboxes for high-risk training and evaluation. The cybersecurity partner Wiz is already using Argon through its Scan for Good programme, and Google says the model found a critical vulnerability in healthcare software that earlier frontier models had missed. 1

The gate is the story to watch. A model that can autonomously find, validate and patch vulnerabilities, released without cyber guardrails to a vetted list, arrives in the same week that the FTC opened its probe and OpenAI described operators extracting reasoning at scale. The checkpoints are when Argon reaches paid API customers and Ultra subscribers, what the price is after the promotion, and whether Gemini 3.5 Pro stays cancelled. 214

The Federal Trade Commission is conducting an industry-wide probe of Anthropic, OpenAI and other AI labs to find out what dangers their technology poses to consumers, a senior FTC official told Reuters on Wednesday. The commission plans to issue formal demands for information and to compel testimony from executives at the leading developers, naming Anthropic, OpenAI and the evaluation nonprofit METR. 3

Reuters describes it as the first official US enforcement action that reaches into rogue AI agents, a category that barely had a name before July. The official linked the timing to specific events: FTC chairman Andrew Ferguson held concerns about the companies before OpenAI agents probed the open-source platform Hugging Face for weaknesses and then attacked it, and that incident increased the urgency. Ferguson said in an interview last week that developers who instruct agents during cybersecurity tests that end in hacks should be liable for the harm, and that the US should look to existing law before writing new rules. The commission's existing authority lets it sue companies over unfair or deceptive practices, which it has used against firms that failed to protect consumer data. 3

Anthropic, OpenAI and METR did not immediately respond to Reuters, and the New York Post reported the probe first. The timing is what gives it weight. On Tuesday the same companies had signed a one-page voluntary accord at the White House, which Trump described as having the world's smartest people watching over each other, and which carries no stated consequence for breaking it. A formal demand for information backed by the commission's power to compel testimony is a different instrument, and it lands on the labs that had just argued they could police themselves. 310

The companies have been preparing for exactly this. Anthropic's confidential IPO prospectus, reported by Reuters on Tuesday, tells investors that agentic AI raises significant and unpredictable legal risks. The open question is which party the commission ends up treating as responsible when an agent acts: the developer that instructed it, or the agent itself, which Ferguson has already pushed back on treating as an independent actor. 3

OpenAI published an account on Wednesday of what it calls a coordinated campaign to extract protected reasoning from its models, and it attributed a core cluster of the activity to people associated with Moonshot AI, the Chinese developer of the Kimi models. OpenAI says the earliest activity it observed was in the first week of July. 4

The distinction OpenAI draws is between what was and was not breached. Operators did not break encryption, compromise a database or reach stored user conversations. Instead they manipulated model interactions so that protected reasoning — the model's internal record of working through a task, which can reveal information withheld from the final answer — came back in forms the requester could read, at scale and against OpenAI's terms of service. One method the company describes is copying encrypted reasoning from one conversation and asking a model in a different conversation to decrypt and transcribe it. 4

The volumes are specific. Activity began on July 1 at low volume and spiked on July 24 and 25, when OpenAI recorded 16,000 requests using a relevant extraction pattern from more than 4,000 users. Further investigation found related activity across a cluster of more than 15,000 users, which the company says it fully disrupted by July 28. OpenAI adds that it cannot tell whether every operator it saw came from a single actor, which is why the attribution covers only a core cluster. The post does not say whether OpenAI sought comment from Moonshot. 4

OpenAI's response was a mix of enforcement and product change. It banned or restricted accounts, tightened signup and infrastructure controls, widened monitoring, closed a pathway that let someone who already held another user's encrypted reasoning replay it to recover the contents, and added checks to hold streamed output that might expose reasoning. It also worked with third-party providers when the activity moved through their services, and shared findings through the Frontier Model Forum and government information-sharing channels. Independent researchers had earlier reported related cross-model and compaction vulnerabilities through responsible disclosure, and OpenAI says it confirmed those attack paths were real. 4

The stakes OpenAI sets out are the ones that matter to anyone buying from either lab. Extracted reasoning can be used to train another model without carrying over the safeguards applied to the original model's user-facing answers, and at scale it transfers advanced capability without the matching investment in safety. OpenAI notes the technique is not unique to its systems and that services which store or replay reasoning artifacts may face the same exposure — which is also a statement about the risk its own customers now inherit. 4

The day's peer-reviewed result is applied rather than frontier, and it is worth naming for what it is. Nature Communications published WeedNet on September 30, a foundation model trained on 14 million images that identifies 1,593 weed species with 91.02% accuracy, with 41% of those species identified perfectly, and reaches 97.38% on a fine-tuned local version covering 84 Iowa species. The authors present it as a global model that regional users fine-tune, and they validated it on drone and ground-rover imagery, which is what would put it on farm robots. Springer Nature's subject index for artificial intelligence lists other papers dated September 30 — an active cyber-defence paper and a systematic review of AI for ankle instability — and one dated October 1. None of them is a frontier-AI result. 1113

The frontier work sits in unreviewed preprints, and the most consequential of them is a correction. A paper first submitted September 30 shows that the large reported gains in decoding words from non-invasive brain recordings largely reproduce from timing alone. In the earlier work, brain-activity windows were cut to start at each word and partly overlapped, which leaked the interval between words — and since word duration tracks word identity, a network can exploit that without any brain signal. The authors demonstrate the point by running the method on synthetic signals containing no brain information, where it reaches 22.0% balanced accuracy against 22.3% on real recordings. Processing each window independently instead removes the shortcut, and the model then does better for the right reason: their recipe reaches a 36.6% word error rate with five observations per word, approaching results previously achieved only with electrodes implanted in the brain. 12

A second preprint prices the web that models now train on. The authors applied standard quality filtering to web text and found that 27.5% of tokens from June 2026 data were labelled AI-generated, rising to 31.1% by August. They then pretrained 800 language models at different mixtures of AI and human text and fitted scaling laws to the results. For data-starved models, adding AI tokens initially helps and then reverses into harm; for models with large human-text budgets, AI tokens raise loss almost immediately, while the same number of fresh human tokens keeps lowering it. Their conclusion is practical: filter AI text when the target is human text, repeat human text before expanding a dataset with generated text, and report validation loss on human and AI text separately. The corpus, the 800 models and the code were released. The paper has not been refereed. 15

A third describes a harness rather than a model. Cogentic runs an orchestrator that splits an open problem across several provers working on different approaches, has specialised components attack their output, and promotes what survives into a verified ledger that later rounds build on. Using Gemini as the base model, the authors report novel results on five open problems in online learning, auction theory and mechanism design, each checked by domain experts and written up in companion papers. They place the harness in the line of work that treats orchestration, not model weights, as the lever on hard problems. It too is unreviewed. 16

A fourth is about the cost of agents that use a computer the way a person does. cua-speedrun standardises the virtual machine, the execution pipeline and the agent interface across four computer-use benchmarks, because varying container configurations had made speed comparisons meaningless. Running models through it, the authors find no family that is best on capability, speed and cost at once, no open-weight model at the frontier, and two counter-intuitive effects: raising reasoning effort speeds some models up, and faster environment input-output can slow the overall task down. They also show task sets can be cut without losing statistical power. 17

Synopsys and OpenAI will build a chip-design model together. GPT-Synopsys will be trained and tuned for the work of turning a circuit description into a physical layout of billions of transistors, learning to drive Synopsys' own tools through the trade-offs engineers make during design. The commercial structure is unusual: OpenAI pays Synopsys a training subscription so its model can learn the tools, and the two companies share revenue from customers based on how much the model improves a chip's design. Synopsys' chief executive says the arrangement is built so it does not cannibalise the existing business, and that a model's output is still checked by conventional verification tools because "the model needs these guardrails in order to check the physics". Synopsys also raised its fiscal 2027 revenue growth forecast to 15% from analyst estimates of about 11%, and its shares rose as much as 7%. 5

ElevenLabs doubled its valuation without raising new money. A $300 million employee tender valued the London voice-AI company at $22 billion, twice the $11 billion it reached in a February funding round. Wellington and T. Rowe Price led the tender, with existing backers Andreessen Horowitz and Lightspeed and new investors EQT and Goldman Sachs taking part. A tender lets employees and early shareholders sell to investors rather than putting new capital into the company, and ElevenLabs says its agents now handle more than 15 million conversations a week, three times February's level, doing work like processing refunds and renewing insurance policies. 6

Nvidia's newest rack reached customer production. CoreWeave said it is running customer workloads on Vera Rubin NVL72, with Cognition, the maker of the Devin coding agent, as the first production customer. Cognition measured up to 4.8 times higher total token throughput per GPU for its inference workload and 3.8 times higher output throughput per GPU for reinforcement-learning work, compared with the previous GB200 NVL72 generation at matched interactivity — though those are the customer's own workload measurements on CoreWeave's cloud, not standardised benchmark results. Each rack carries 72 Rubin GPUs, 36 Vera CPUs, 20.7 terabytes of HBM4 memory and 216 terabytes per second of rack-scale NVLink bandwidth, and CoreWeave describes availability as limited, with hundreds of Rubin GPUs deployed across several regions. 7

DeepSeek opened its software stack for Huawei's chips. The Chinese lab said in a post on its WeChat account that it is open-sourcing the programming infrastructure for Huawei's Ascend processors, including computation and communication libraries, with Huawei providing support during development. The centrepiece is TileLang, a high-level language for AI chips that DeepSeek presents as easier to write than Nvidia's CUDA, and the two companies advanced a supernode design built on 128 Ascend 950 chips. The release arrived two weeks after Huawei announced its next generation of AI processors, and it is the clearest sign yet that China's hardware and software layers are being built as a matched pair rather than as an alternative to Nvidia one part at a time. 8

Google asked a European court to freeze an order to share search data. Google applied to the General Court in Luxembourg for interim measures that would suspend a European Commission order, issued in July, requiring it to give OpenAI and rival search engines access to its search data so that AI chatbots can compete with Google Search. Google had taken the Commission to court over the order on Tuesday and now says the case involves a risk of serious harm to the privacy of European users. The Commission says its decisions account for integrity, security and the protection of personal data. Interim measures are granted only where there is a risk of serious harm, so the application is itself a claim about how urgent Google believes the exposure to be. 18

The Pentagon created a command for autonomous systems. Defence Secretary Pete Hegseth announced the Autonomous Warfare Command, a new military organisation dedicated to building and providing autonomous and robotic capabilities across the US armed forces and to be led by a four-star officer. New commands are rare — the last was US Space Command in 2019 — and the move reflects a shift away from costly conventional platforms toward cheaper AI-driven systems. Hegseth's own framing was: "Cheap compute, superintelligence, and advanced commercial manufacturing have enabled the proliferation of low-cost, high-precision strike." The US military currently has 11 combatant commands. 19

California barred firing workers by machine alone. Governor Gavin Newsom signed SB 947, the No Robo Bosses Act, which stops employers in the state from relying solely on automated decision-making systems to discipline or dismiss workers. Where AI output is the primary basis, a human reviewer must corroborate the decision using other information such as manager evaluations and personnel files, and the employee must receive written notice that AI was primarily used, a description of the data the system used, and a human contact who can explain the decision. Newsom vetoed an earlier version of the bill last October. An OECD survey found the US leads on algorithmic management, with 90% of managers reporting their firms use at least one tool to instruct, monitor or evaluate workers. 20