Google’s Gemini 4 Carbon arrived Tuesday as the company’s strongest model, and the most telling part of the launch was the access list. Developers get it at an introductory $2/$10 per million tokens, doubling after November 30. Ultra subscribers get it in the Gemini app and AI Mode. But its best cyber skills (finding, exploiting and patching vulnerabilities) are gated behind something called the Fairwind Program, released to defenders “on a rolling basis.” Google claims Carbon blocked 99% of simulated attack trajectories and dropped the per-attempt breach rate from 3.1% to 0.8% versus Argon. It also says, plainly, that prompt injection is not solved.

That gating is where frontier labs have landed. Offensive capability is now a headline feature, so it ships with a velvet rope. The question nobody’s launch post answers is what happens to the bugs once the model finds them.

The ledger problem

VulnCheck tried to answer that for Anthropic’s Project Glasswing, seven months in. The numbers are worth sitting with. Glasswing’s public ledger lists 37,966 findings, of which 7,349 are public and 217 are marked fixed. Since September 8, findings grew by 11,813 and fixes by 15. Duplicates went from 2 to 1,670. Out of everything, 442 CVEs trace back to Anthropic, about half a percent of the year’s total, and two of them show up as exploited in the wild.

The curl case study is the sharpest part. Of 34 published reports, 19 turned out not to be vulnerabilities, six were confirmed low severity, and nine were still awaiting assessment. Back in September, Claude rated 91.5% of its findings critical or high, while maintainers gave that rating to 51.3%. Anthropic’s claimed true-positive rate rose to 94.2%. The VulnCheck author asks, reasonably, how that figure handles duplicates and withdrawals.

None of this means the models are bad at security. It means volume is free and triage isn’t, and the cost of triage lands on volunteer maintainers rather than the labs. A model that blocks 99% of attacks in simulation is useful. So is a model that finds 38,000 candidate bugs. If the fix count stays in the hundreds, though, the bottleneck has simply moved from discovery to the people who have to read the reports.

Albany wants the incident reports

That accounting instinct has a legal form now. New York’s RAISE Act requires frontier developers with more than $500 million in revenue to register by January 1, publish safety frameworks, issue model transparency reports, and report critical safety incidents within 72 hours. Fines run up to $1 million per violation and $3 million for repeat ones. A new office with the acronym DIGIT will oversee them. The penalties are rounding errors for companies pricing IPOs above a trillion dollars. The registry is the real change: a state agency now gets a list of who builds these models and a clock on when they have to report trouble.

Meanwhile, in the conference room

Anthropic spent the same day making Claude more ordinary. Claude Meetings puts Claude on Google Meet calls as a visible participant that drafts plans and pulls data from connected apps. It ships alongside Whiteboards, Sheets and a renamed Claude Data. The guardrails are notably polite: it announces itself in chat, and it leaves if an external guest joins unless an admin says otherwise. Those are the kind of rules regulators will eventually ask about, written before anyone asked.

So the same companies building superhuman bug-finders are also building meeting-note takers, and the more useful a model gets, the more counting someone has to do. Google is counting blocked attacks, VulnCheck is counting fixes, and New York is about to start counting incidents. The fix column is still the one that looks thin.