AI Brief, 29 October 2026: a one-point lead on a one-day-old index

Google published Gemini 4 Carbon at 17:00 UTC on 28 October, two weeks after Gemini 4 Argon, and it took 850 points and 705 comments on Hacker News in a day. It is pitched almost entirely at cybersecurity: finding vulnerabilities, proving them exploitable, and patching them. The headline claim is the top of the Artificial Analysis Intelligence Index, where Carbon scores 59.43 and ranks first. That figure is Artificial Analysis's own measurement rather than Google's, which makes it the most credible number in the announcement, and it is also thinner than it looks: Claude Opus 5.5 scores 58.41, a gap of just over one point. The index moved to v5 the previous day, with two benchmarks added, three removed, three replaced by private or refreshed versions, and a new four-way 25% weighting. A one-point lead is a claim about a composite whose composition is a day old.

The cyber numbers are Google's own: 88.2% on SEC-bench Pro for finding real flaws, 54.8% on ExploitGym for validating exploitability, 71.0% on CWE-bench for patching root causes, and 0.0% attack success on Gray Swan's indirect prompt-injection suite against Argon's 0.7%. Those three capability benchmarks are externally built, but the post does not say who ran them, and it notes the results were obtained "evaluated without guardrails" — which is to say not in the configuration anyone will be served. Google's Chrome team is quoted saying Carbon produced patches "more than 10X better than another lab's large frontier model", with the comparator unnamed and no figure attached.

What is absent matters more than usual for a model whose selling point is offensive security capability. There is no parameter count, no context window, no knowledge cutoff, no model card and no technical report. The safety and security report linked from the announcement covers Argon, not Carbon. Access is limited to a subset of cyber defenders, widening to "trusted partners" through a Fairwind Program whose selection criteria are not published, and to everyone else on no stated date. Pricing is $2 per million input tokens and $10 per million output introductory, rising to $4 and $20, cached input discounted 95%.

Elsewhere: Tencent's Hy-Nomas technical report went live inside the window and finally put numbers on Hy-Nomas-Bench, asked for here on the 24th and again yesterday. They are the vendor's own human preference scores, and on spatial memory the model loses to Genie 3. And an independent researcher compiled a working 32-bit RISC-V CPU into the weights of Qwen3.5-4B, using the model's linear-attention state as addressable RAM.

• Gemini 4 Carbon leads the Artificial Analysis index at 59.43 to Opus 5.5's 58.41, on a v5 weighting published a day earlier; no model card, and the linked safety report is Argon's.
• Carbon reaches a subset of cyber defenders only, via an unpublished selection process, at $2/$10 per million tokens introductory.
• Hy-Nomas-Bench has its first scores, from Tencent: the model beats LingBot-World v2 and HappyOyster on prompt following, and loses to Genie 3 on spatial memory, 13.3% win against 30.0% loss.
• Qwenputer puts an RV32IM CPU into Qwen3.5-4B's weights with no training at all, passing riscv-tests; it reached 210 points on Hacker News at 00:25 UTC today, a week after publication, and nobody has yet reproduced it.
• NVIDIA released Nemotron 3.5 Transcribe, a 30B-A4B open ASR model covering 40 languages; community quantisations appeared within 20 minutes of the announcement.
• Still unresolved: Kimi K3.1 Pro weights remain absent with six days to a promised 4 November, and no decision-model vendor has published a fail-open rate, asked here daily since 10 October and now twenty days.

The index that arrived a day before the record #

The sequencing is worth stating plainly, because it is checkable. Artificial Analysis published Intelligence Index v5 on 27 October; it reached Hacker News at 03:06 UTC on 28 October. Google's Carbon post went up at 17:00 UTC the same day, citing v5 for a first-place finish.

That is not evidence of anything improper. Carbon's 59 is measured by Artificial Analysis, and v5 is a defensible revision: it drops GDPval-AA v2.1, SciCode and AA-LCR v1.1, adds FrontierCode 2.0 and Terminal-Bench-Science, and replaces Humanity's Last Exam with a 1,000-question HLE-Diamond. But it does change what the number means.

Nathan Lambert published a critique of v5 at 12:58 UTC, four hours before Google's post and apparently without knowledge of it. His argument is structural rather than about this release: a composite index has to pick weights, the weights encode a view of what intelligence is for, and the body picking them ends up shaping model development. He notes that three of v5's nine components are now private, which improves contamination resistance at the cost of the community scrutiny that has historically found benchmark bugs, and that Artificial Analysis takes money from labs for verification. His summary of the bind: "you can always shift the numbers to match your narrative."

A RISC-V CPU compiled into Qwen3.5's weights #

The week's most unusual artifact comes from one person. Divyansh Agrawal's Qwenputer, published 22 October and surfacing on Hacker News only at 00:25 UTC today at 210 points, is a 32-bit RISC-V CPU — RV32IM plus the Zba extension and a small bignum unit — that exists as weights inside Qwen3.5-4B. There is no fine-tuning: a compiler writes every value directly. The weights are Apache-2.0, the code is MIT and sits at 114 stars.

The mechanism rests on a property of the linear-attention layers Qwen3.5 uses for three of every four blocks. A gated DeltaNet layer carries a state matrix $S_t\in {\mathbb{R}}^{d_v\times d_k}$ updated per token by the delta rule, where $k_t$ is the key, $v_t$ the value, ${\beta }_t$ the write strength and ${\alpha }_t$ the forget gate:

$$S_t={\alpha }_t(S_{t-1}-{\beta }_t(S_{t-1}{k}_t)k_t^{\mathrm{\top }})+{\beta }_t{v}_t{k}_t^{\mathrm{\top }}$$

Pin ${\alpha }_t=1$ so nothing decays, pin ${\beta }_t=1$ so the write is complete, and make $k_t$ a one-hot vector $e_i$ . Then $S_{t-1}{e}_i$ is precisely the contents of column $i$ , so subtracting $(S_{t-1}{e}_i)e_i^{\mathrm{\top }}$ zeroes that column and leaves every other column untouched, and $v_t{e}_i^{\mathrm{\top }}$ writes $v_t$ into it. Reading with query $e_i$ returns $S_t{e}_i=v_t$ exactly. The soft associative memory becomes a RAM with an address bus:

def step(S, k, v, alpha=1.0, beta=1.0):
    """One gated DeltaNet update. With one-hot k, this is store(address=k, value=v)."""
    S = alpha * (S - beta * torch.outer(S @ k, k))   # erase whatever column k holds
    return S + beta * torch.outer(v, k)              # write v into that column

S = torch.zeros(128, 128)
k = torch.nn.functional.one_hot(torch.tensor(3), 128).float()
S = step(S, k, torch.arange(128).float())
assert torch.equal(S @ k, torch.arange(128).float())  # exact read-back, not approximate

The docstring's second sentence is the whole point. Writing to address 3 leaves every other address bit-identical, and reading it back returns the stored vector with no reconstruction error, which is what lets a CPU built on top run 18 million instructions without drifting. Agrawal reports the CPU passes the official riscv-tests suites and matches qemu, and that about 230,000 output positions replayed against a reference machine with zero mismatches.

The capacity arithmetic is the part that makes the design sensible rather than merely clever. The published config gives 32 value heads of 128 dimensions with 128-dimensional keys, so one layer's state is $32\times 128\times 128=\mathrm{524,288}$ values, held in fp32: 2 MiB, and 4,096 addressable rows. That figure does not change with context length. A full-attention layer in the same model, at its 262,144-token maximum, caches 4 key-value heads of 256 dimensions in bf16, which is $4\times 256\times 2\times 2\times \mathrm{262,144}$ bytes — exactly 1 GiB per layer, 512 times the state it would take to address the same memory as RAM. Constant-size state is normally described as linear attention's compromise. Here it is the whole point: address 7 is address 7 on token 10 and on token 200,000.

Two things the write-up does not say are visible in the shipped config.json, and they qualify the claim that Qwen's own weights are untouched. The base checkpoint is a multimodal Qwen3_5ForConditionalGeneration with a 24-layer vision tower; Qwenputer is a text-only Qwen3_5ForCausalLM with no vision config at all, and mtp_num_hidden_layers drops from 1 to 0, discarding the multi-token-prediction head used for speculative decoding. The residual stream widens from 2,560 to 3,968 dimensions and the vocabulary from 248,320 to 478,656 entries — the model's own chipformer.json manifest declares chip_vocab: 230324, so the CPU's address and value tokens are literal vocabulary rows. Hence 9.36 billion parameters in an 18.7 GB checkpoint built on a 4B model. The base weights do survive, padded into a wider stream; two capabilities do not.

The arithmetic benchmarks are weaker evidence than they appear, and the reason is sample size rather than honesty. Each DeepMind set is 40 problems, so Qwenputer's 97.5% is 39 of 40 and the Python-interpreter baseline's 100% is 40 of 40. A single item separates them, and the Wilson 95% interval on 39/40 runs from 87.1% to 99.6% — comfortably overlapping the interval on a perfect score. What the tables support is that an in-weight CPU lands in the same accuracy band as shelling out to Python, which is the interesting result; they do not support a ranking within that band. The honest summary is that the achievement is architectural, not numerical. It is also unreproduced: the thread ran 47 comments of mostly appreciative skepticism, including a fair objection that a CPU deterministic by construction says little about trained-model determinism, and nobody reported running it.

Hy-Nomas-Bench finally has numbers, and they are not flattering #

This brief asked on the 24th and again yesterday whether anyone would score Hy-Nomas-Bench, Tencent's 280-case world-model benchmark published with weights and code but no results. The answer arrived inside the window: the technical report went live on 27 October and its model card lost its "coming soon" badge on 28 October, carrying the first figures.

They are not an automated metric. All of them are pairwise human preference rates from three trained annotators per group, reported as win/tie/loss against Genie 3, HappyOyster and LingBot-World v2. On prompt following over 60 free-form scenarios, Hy-Nomas wins 65.0% against HappyOyster-Directing and 75.0% against LingBot-World v2. On camera control over 100 shared trajectories it wins 32.0% against Genie 3 with 54.0% ties. On the spatial-memory axis — the one that directly tests the persistent-state mechanism the model is built around — it wins 13.3%, ties 56.7% and loses 30.0% to Genie 3, and the report concedes the model "still trails Genie 3 in maintaining long-term spatial consistency."

Two caveats carry further than the scores. The comparison is against Genie 3, announced in August 2025, not the Genie 4 that led yesterday's edition and for which Google has published no specifications at all. And the released benchmark is not a scoring harness: its own README says the data provides "evaluation inputs and geometry; scoring is a separate step." There is no leaderboard and no scorer, so an independent number requires reimplementing a three-annotator human protocol. The benchmark that was published without results has turned out to be published without a way for anyone else to produce them.

Also notable #

• NVIDIA released Nemotron 3.5 Transcribe, a 30B-A4B mixture-of-experts open ASR model covering 40 languages and combining transcription, translation and speaker diarisation, announced 28 October at 14:58 UTC. The weights had been on the Hub since 7 October; the announcement added leaderboard results and an SGLang guide. GGUF, MLX, NVFP4, MXFP8 and CoreML conversions all appeared between 15:16 and 23:43 the same day, now the normal response time for an open release worth running.

• PyTorch 2.15.0 shipped on 28 October with a rewritten NCCL backend as the default, including flight-recorder dumps on collective hangs and TORCH_DIST_USE_NCCL2=0 as the rollback. Same day, llama.cpp v0.8.0 and ollama v0.40.13 both added Liquid AI's LFM3 text, vision, audio and omni models, moving them off Apple silicon only.

• A flash-attention prerelease fixed a silent-wrong-answer bug, bounding key and value TMA loads by seqlen_k on SM90 and SM100 so unused rows cannot poison the query gradient, plus a NaN fix for unused value-cache entries.

• Microsoft's quarterly filing records $10 billion of revenue from OpenAI, about 11% of the quarter, with $7.2 billion of receivables outstanding, and disclosed Azure revenue in dollars for the first time at $33.2 billion. Alphabet's Q3 showed $51.36 billion of capex against negative $9.07 billion free cash flow, guidance held at $195–205 billion.

• New York signed a law on 28 October prohibiting twelve enumerated categories of companion-chatbot behaviour toward under-18s, with remedies reported to extend to shutting a chatbot down and destroying its data. The US Copyright Office opened its tenth triennial DMCA §1201 rulemaking the same day, comments closing 7 December, with new proposed exemption classes touching AI research.

• Apple's M6 MacBook Pro, announced 27 October, pairs a structurally new dual 16-core Neural Engine with 170 GB/s of bandwidth, up from 153 on M5 — but maximum unified memory stays at 32 GB, the figure that actually bounds local inference. Apple publishes no TOPS number for M6 or M5, so any circulating figure is third-party, and its own claims put the Neural Engine 1.9 times faster while quoting 25% on LLM prompt processing.

• The ETH refutation has reviewers, and the announcement predated this brief's question about it. Ryan Williams posted on 26 October that he, Russell Impagliazzo and Mohan Paturi had been asked to organise an "open and independent examination" of the manuscript claiming the Exponential Time Hypothesis is false — hours before the 27th's edition asked whether any of the three would assess it. It is a process announcement, not a verdict: they say they asked OpenAI to release all raw data including the Lean source and to sponsor a conference, and that it agreed to both. The Lean formalisation has not changed since 26 October, so the gap between the bound it proves and the one the abstract claims still stands.

What to watch #

• Whether Carbon gets its own model card and safety report, and a context window. A model sold on vulnerability discovery, released to an unpublished list of defenders with its predecessor's safety documentation, is the clearest current case for the system-card norm being voluntary. The adjacent question is whether any of the three cyber benchmarks' maintainers confirm Google's scores, since the runs were "without guardrails" and the served configuration will not be.
• Whether anyone reproduces Qwenputer. Apache-2.0 weights, MIT code and a published quickstart make the 18-million-instruction and riscv-tests claims unusually cheap to falsify, and a week after publication nobody has tried. One person with a 24 GB GPU is a reproduction, and the figure to want is a trace diff against qemu that somebody other than the author ran.
• Whether a scoring harness appears for Hy-Nomas-Bench. The numbers that arrived are the vendor's own human preferences, so the gap flagged on the 24th has moved rather than closed: the benchmark now has results and still has no way for a third party to generate them. A Genie 4 entry would also be worth something, if Google ever publishes enough about Genie 4 to evaluate it.
• Still open: no complexity theorist has yet published an assessment of the ETH manuscript, only the agreement to organise one. Kimi K3.1 Pro's weights remain absent with six days to a promised 4 November, and no repository is even reserved under Moonshot's account. Voxtral 3 weights are still missing, flagged since the 21st. MiniMax has published no unquantised M3.1 Flash reference, flagged since the 23rd. Nanbeige4.3-33B still has no independent score, flagged on the 26th. And no decision-model vendor has published a fail-open rate, asked here daily since 10 October and now twenty days.