The Monday Recap
Gemini 4 Carbon, OpenAI's $20B target, Anthropic's junk rating, a backdoored extension
Last week in AI and life sciences: Google DeepMind announced Gemini 4 Carbon, OpenAI reportedly lowered its funding target, Anthropic faces a junk rating forecast, a malicious Claude extension reached Cursor users, and a Kyoto trial tested clinician review of LLM drafts.
By Matteo Favilli, 2026-11-02
Google DeepMind announced Gemini 4 Carbon, which it calls its strongest model, with state-of-the-art cybersecurity and long-horizon capabilities. It ranks first on version 5.0 of the Artificial Analysis Intelligence Index, at 59. Google reports 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on ExploitGym for exploitation and 71.0% on CWE-bench for patching. Access starts this week for a subset of cyber defenders, with additional trusted partners phased in through the Fairwind Program, and Google says it is taking part in the US government's voluntary process for pre-release model testing. The introductory price is $2 per million input tokens and $10 per million output tokens, the same as Gemini 4 Argon. After the introductory period, $4 and $20 apply.1
OpenAI's funding round is reportedly smaller than planned. TechCrunch notes that the company was first reported to be raising $30 billion at a $1.4 trillion valuation, and then at a $1.25 trillion valuation. The Financial Times reported on Friday that the target is now $20 billion, with a first close expected to be even lower. The round is led by investors from the United Arab Emirates, and a later retail offering for wealthy individuals could bring the total to the target. The Wall Street Journal added that OpenAI has secured $11 billion so far and that some large investors responded in a "tepid" way. TechCrunch links this in part to Wall Street's wariness about heavy AI infrastructure spending and a sell off of tech stocks, and had asked OpenAI for comment.2
Anthropic is expected to receive a high "junk" rating from credit rating agencies after its initial public offering, according to the Financial Times. Blackstone, the anchor investor in a recent $63 billion deal to finance Anthropic's chips, told investors in the deal that it expects a rating in the double B range, the top tier of speculative grade. Blackstone had previously said Anthropic would receive an investment-grade rating before 2027. TechCrunch calls the forecast a prediction and notes that a junk rating would make it harder and costlier for Anthropic to raise money. Anthropic and Blackstone declined to comment, and Anthropic officially filed to go public earlier that week.3
A malicious version of Anthropic's Claude extension for VS Code was available in the marketplace of Cursor, the AI-assisted developer tools maker. Cursor said version 2.1.313 affected at most 5,000 users. Researchers told Ars Technica it was posted through Anthropic's official account on Cursor, and Anthropic pushed version 2.1.314 several hours later. Cursor said the extension tries to install a persistent SSH backdoor with an attacker-controlled key and a reverse SSH tunnel, on Windows, macOS and Linux. Anyone who installed or updated the extension between 5:27 am ET and 4:35 pm on Thursday should consider themselves affected. Cursor removed the version and shut down its marketplace to rotate keys and audit access controls. How the attackers gained control of the account is still unknown, and when Ars published, Anthropic had not issued a public notice to customers.4
Parameter Labs described how it took over ChatGPT accounts, in a write-up that Simon Willison summarizes. ChatGPT displays custom HTML apps in a sandboxed iframe. The researchers found that code in that iframe could send a message to a virtual keyboard component used for graphs, whose receiving code uses innerHTML, and so inject a new iframe without sandbox restrictions. OpenAI's content security policy allowed scripts from a handful of domains, including YouTube, and the YouTube oEmbed endpoint could be used to reflect JavaScript back so that it executed. The result was a ChatGPT share URL which, when visited by a signed-in user, could exfiltrate private data or take actions on their behalf. OpenAI closed the hole and paid a $5,000 bug bounty, which Willison calls a bit cheap for a vulnerability this serious.5
A pilot randomized trial at Kyoto University Hospital tested a clinician-in-the-loop workflow for clinical documentation. Of 21 ophthalmology physicians randomized, 17 completed the study, writing discharge summaries and referrals for six simulated patient records. One group reviewed and edited drafts written by a large language model and the other wrote from scratch. Editing the drafts took 59.4 seconds less for summaries and 52.9 seconds longer for referrals, and neither difference was statistically significant. In most expert-rated quality domains the clinician-in-the-loop group did better than the clinician-only group. Unedited LLM drafts were the fastest and had the lowest quality.6
Matteo's take
Two of the week's stories are about money, and both are reports from other outlets. OpenAI's target went from $30 billion to $20 billion, with $11 billion secured so far according to the Wall Street Journal. Anthropic filed to go public, and Blackstone now expects a high junk rating after saying it expected investment grade. TechCrunch ties the mood to investors' wariness about heavy AI infrastructure spending. These are reports and forecasts, so the figures can move.
The two security stories share a route. The malicious Cursor extension came through Anthropic's official account, and the ChatGPT exploit came through a feature built to run untrusted HTML in a sandbox. In both cases the person at the keyboard did something ordinary: let an extension update, which Cursor does by default, or open a shared link while signed in. Willison's point on the $5,000 bounty is a reminder that the price of finding such a chain looks low next to what it exposed.
Gemini 4 Carbon is the model release of the week, with scores that Google reports for itself and a first place on the Artificial Analysis index at 59. Google describes a deliberate rollout, starting with a subset of cyber defenders. The same week brought two stories of attackers using trusted channels, and a model aimed at finding and patching vulnerabilities is aimed at that kind of problem. How well it does outside Google's own benchmarks is not known yet.
The Kyoto trial is small and uses simulated records, and its time results are not statistically significant. It does support a modest reading: a clinician who edits a draft produced documents that experts rated better on most domains than writing from scratch, and the unedited draft was the weakest. That fits the habit the security stories also point to, which is to keep a person checking what the machine produces.
The concrete thing to watch is whether Anthropic publishes a notice about version 2.1.313 of its extension, which it had not done when Ars Technica wrote.
Sources
Drafted with AI from the sources below.
- Gemini 4 Carbon: our next frontier model, Google DeepMind
- OpenAI reportedly lowers funding target for new round, TechCrunch
- Anthropic expected to receive high 'junk' rating from credit agencies following IPO, FT report says, TechCrunch
- Anthropic VS code extension on Cursor backdoored for nearly 12 hours, Ars Technica
- How We Took Over ChatGPT Accounts, Simon Willison
- Evaluating an LLM-assisted workflow for clinical documentation: A pilot randomized controlled trial on time and quality, PLOS Digital Health
All of AI Bits