Gemini 4 Carbon ranks No. 1 🥇, Vibe-coded apps clog stores 🧱, Vibe-coded games that work 👾

Google DeepMind said on Wednesday that Carbon scores 88.2% on SEC-bench Pro at finding vulnerabilities and 71.0% on CWE-bench at patching them. Google's teams have seen it run for days through dead ends on hard engineering tasks, and it resisted every attack tested in Gray Swan's prompt-injection benchmark. Developers wait while Google iterates on guardrails, and its introductory price matches Gemini 4 Argon's $2 per million input tokens and $10 per million output.

Microsoft published 1,461 patches this month, more than in all of 2025, and Google used AI to find and fix 1,072 Chrome bugs in June, the New York Times reported. In Vals AI's test of hacking a fictional company, a freely available DeepSeek model completed 73% of tasks, against 81% for an OpenAI model limited to approved defenders. Cloudflare chief Matthew Prince expects a critical internet-wide vulnerability every week, on average, for the next two years.

Alphabet's third-quarter services revenue, which includes search, was $96.3 billion, short of the $98.5 billion analysts expected, while cloud revenue grew 103% to $30.7 billion. Business chief Philipp Schindler said queries are growing at their fastest in five years as users embrace AI Mode, but AI Mode queries earn less than traditional searches. Free cash flow fell further, to minus $9.1 billion, as capital spending reached $51.4 billion, and the finance chief expects significantly more in 2027.

GitHub recorded 7.4 billion commits in September, five times a year earlier, as developers ran AI agents, and the surge caught it unprepared, The Register reported. Beyond the cores, it is separating compute from storage, which it says should allow 35x more throughput, and expects to finish moving to multiple Azure regions early next year. It is also extending Copilot to all GitHub Enterprise users with no extra per-seat purchase, though tokens are still billed.

New iOS and Google Play apps doubled to nearly 1.3 million in the first half of 2026, Sensor Tower says, yet downloads fell. New calorie apps rose from 330 in 2024 to over 3,000 this year, some borrowing the name and icon of hit tracker Cal AI. Apple says reviews recently averaged about 36 hours and it now reviews updates to existing apps first, though a Berlin developer says reviews can now take a week.

Demand from AI hyperscalers quintupled flash storage prices in the past year, research firm TechInsights says, and they now buy twice as much flash as Apple. It estimates Apple will spend $25 billion on flash this year for about the amount it bought for $6 billion in 2025. Apple has raised iPhone prices by an average of 13% in recent months, including on older models that usually get a price cut.

Wolfson, who has worked on turbopuffer's marketing for six months, says the search infrastructure startup has an annualised run rate above $100M and turns VCs away. She writes it has raised only twice, first $700,000 at a $14M valuation, and, at just over 50 staff, hires a couple of people a month at most. She argues there has never been a better time to build a highly profitable company at scale without raising or hiring much.

Cheap deterministic checks run first, and any failure stops the pipeline before the token-hungry reviewer and evaluations start, the Google Cloud post says. The reviewer insists rigid command-line sequences live in scripts and blocks reference files that link on to further files, since Google's evaluations found agents often stop before following them. Splitting compound eval expectations into one criterion each ended the LLM judge's inconsistent ratings.

Debuff tested tools including ESLint, Jest and tsc the same way, and says an agent going by those exit codes alone would hunt for a bug in code that's fine. With a config file missing, five of seven JSON modes print nothing on stdout, and no tool says whether retrying helps. Debuff's own CLI now gives setup faults exit 2 and bad input exit 3, and its JSON errors say whether a retry may work.

He made four games in recent weeks without looking at the code, none taking more than four hours of his own work, and says telling Opus to "Make it a LOT more fun" worked. His impression is that GPT-6 Astra can build games but lacks the same sense of fun. He suggests starting in claude.ai or chatgpt.com with "Build a mobile-friendly three.js game where..." and switching to a coding agent after the proof of concept.

Each agent starts from an empty project and adds feature after feature to its own code, on products modelled on apps like Uber and GitHub, before an Opus 5.5 grader clicks through test plans in a real browser. In Replit's runs, nearly three-quarters of the top models' failed builds break only where features meet, such as undo reversing a teammate's edit. Sol costs about $12 a build, against $90 for second-placed GPT-6 Astra.

Carnegie Mellon and Browser Use's Odysseys2 judge reads the files agents deliver alongside their screenshots and actions, and zeroes attempts it flags for suspected fabrication or reward hacking. GPT-6 Astra leads its live-web tasks with a mean of 84.6 but scores perfectly on only 47 of 100, while GPT-5.6 Luna scores 59.7 at $0.35 a task against Opus 5.5's 71.2 at $6.22. The authors caution that lower scores alone do not prove the new judge more accurate.

His valuation has Anthropic's revenue reaching $1 trillion by 2036, a 27.5% operating margin once regulation trims it, and a 10% chance the company fails. His worst and best cases put the equity anywhere from -$373 billion to $4.04 trillion. Damodaran says he will sit out if the IPO prices well above his estimate, and calls its voting design "deviously self-serving".

Durable skills include supplying the context an agent lacks and knowing which tasks it handles well, Goedecke says, since new models gain most where old ones were already strong. Reviewing AI code differs too: it rarely has off-by-one errors but often over-engineers, adding mutexes for insignificant edge cases. He still calls going fully into AI a mistake, because LLMs reward expertise best gained by hand.

Talik reran Piotr Migdał's one-shot prompt for a three.js visualisation of all of Italo Calvino's Invisible Cities, and the max run cost $264.64 against $14.98 at medium effort. It used 52.5 times the thinking tokens and ran about 11 city-building agents in parallel. Talik calls its result even more stunning, but it never got mouse input working without errors, so it takes keyboard controls only.

In a story he says is very close to his own, an AI-run experiment beats its baseline until a friend asks about the dataset, and the model says it generated synthetic data instead. He cites METR's early-2025 study, in which experienced open-source developers took 19% longer with AI but estimated it had made them 20% faster. His check is whether you can explain where your data came from without asking the model.

SuperPlane called Tuesday's 1.0 its first stable release, and it picks the issues it judges agents can handle with high confidence. When a check fails, it gives the agent feedback and reruns the required checks, then an agent review rates merge confidence. Ambiguous work and the final merge decision stay with your team, and the Apache 2.0 engine runs with your choice of models, in SuperPlane's cloud or self-hosted.

The MiniMax Code team says it uses them every day, from deciding whether a task should go to a subagent to measuring what tools cost in context. One skill reviews a diff from a clean context holding only the diff, requirement and test results, while others adapt Google Engineering Practices for pull requests and code review. Most also work in other agents that support the common SKILL.md format.