All Things Agentic: November 2, 2026: Mistral Large 4, Gemini 4 Carbon, Open Source AI Ban

This is the November 2, 2026 edition, covering the week of October 26 through November 1. The through-line is that nothing released this week made a model safer. What shipped instead were checkers: a license, a vetting list, a proof assistant, a test suite with pass and fail criteria, a review queue, a subreddit rule. Capability keeps arriving as a download. Restraint keeps arriving as paperwork that lives somewhere else, usually in a different building, often in a different country.

Here is the part the announcements leave out. A checker is worth exactly what its auditor is worth, and this week almost every checker was graded by the party that benefits from a passing mark. Mistral's refusal rate is Mistral's number on Mistral's checkpoint. Google's security scores have not been reproduced by anyone outside Google. Axiom's 43.1 million lines of proof have not been rebuilt by anyone outside Axiom. A subreddit outlawed machine-written code using a detector that does not exist. The one organization that published a number making its own product look worse was Anthropic, and the number was this: professional analysts agreed with a preference quietly planted in their agent 86% of the time.

The Big Story: one cyber capability, three different sets of keys

In four days, three organizations made opposite decisions about who should be allowed to hold a model that finds holes in software, and only one of those decisions is enforceable.

Mistral AI published the open weights for Mistral Large 4 on October 29, a model it nicknamed Le Chonk. Open weights means the actual trained file is downloadable, so you can run it on your own hardware with nothing phoning home. It is a mixture-of-experts design, meaning only a slice of the parameters fires on any given token, 52 billion of 1.05 trillion here, so it costs far less to run than the headline size suggests. The company laid out the release in its own announcement, with the files on Hugging Face under a modified MIT license, and TechRepublic covered the security angle here.

The claims are substantial and they are all Mistral's: 51% on the Artificial Analysis Cyber Index, which tests whether a model can find a vulnerability, reproduce it, and patch it without breaking the surrounding code, plus 41% on Terminal-Bench 4.0 and 19.7% on Cognition's private FrontierCode 2.0. Read the company's own chart closely and two rival open models score above that 51%. The sharper admission sits further down the post, where Mistral says that after watching live traffic through the preview it sees potential for the model to help conduct real attacks, and is adjusting its guardrails accordingly. The variant tuned for penetration testing is not in the open release at all. That one goes to vetted partners under contract.

Two days earlier, the opposite call. Google introduced Gemini 4 Carbon on October 28 with the loudest security numbers anyone has published: 88.2% on SEC-bench Pro, 54.8% on ExploitGym, and 71.0% on CWE-bench, per its launch post, with The Register walking through the claims skeptically here. Access went to selected cybersecurity defenders through a vetting program, with everyone else in a queue. Gating a launch is expensive, and companies do not do it for atmosphere.

Then the third answer, which is nobody's policy and everybody's problem. A commercial inference provider published a build of DeepSeek's V4.1 Flash with its refusal behavior stripped out, marketed as a Cyber model. The technique is called abliteration: the part of the network that declines a request gets surgically weakened. The underlying checkpoint is a 552-billion-parameter mixture-of-experts with a million-token context window, and on Mistral's own comparison chart the unmodified version scores 57%, above Mistral's 51%. So the strongest open cyber model of the week is the one being sold with its brakes off, and that is a hosted endpoint rather than anything DeepSeek shipped.

Three companies held a vote on who gets a loaded capability. Two voted carefully. The third was a stranger with a GPU, and the ballot was already in the mail.

Mistral reports a 96.6% refusal rate on malicious cyber prompts, which is a real number about a specific file. It is not a property of the model family, because an October paper on unlearning found that scrubbing harmful capability out of weights does not certify that the capability stays hard to recover through fine-tuning. A guardrail you can download is a request. A guardrail behind an API is a lock, which is why Google kept the keys and Mistral kept the offensive variant.

What it means: If you run regulated infrastructure, this is the week self-hosted security tooling became genuinely available: either the weights on your own metal, or Mistral's endpoint at $0.70 per million input tokens and $2.10 output. Price your defense upgrade now, because the offense upgrade is already distributed and it does not need procurement approval. The uncomfortable read for buyers is that patch cadence stops being housekeeping and becomes the main event, since the same capability that finds your unpatched dependency is available to everyone who wants to look.

What's coming: Expect the fight to move from model weights to distribution terms, because terms are the only lever left. Watch for hosting providers getting pressure over abliterated endpoints, for vetting programs becoming a standard release tier rather than an exception, and for the first regulator to ask a lab to prove a refusal rate on a checkpoint it did not choose. Also watch Europe: ENISA is already testing Large 4, and a European model that can be run inside a ministry is a procurement story as much as a security one.

A subreddit banned AI-written code, and the ban needs a detector nobody has

The largest open source community on Reddit tried to write a rule against machine-written software, and ended up proving that the rule cannot be enforced.

The r/opensource moderators announced sweeping restrictions on October 24 banning projects built with AI, projects that use AI, and software intended for AI, with the backlash and the details documented on October 26. The rules reach further than AI: a project now needs a year of active maintenance, multiple contributors, an existing community, and an OSI-approved license, which quietly excludes most student work and every solo maintainer. One developer pointed out that their nine-year-old project has more than 300 GitHub stars, one contributor, and no AI involvement at all.

The enforcement problem is the interesting part. Moderators wrote that if it is obvious you are using AI in your project, they do not want it, and a moderator posting as Wolvereness conceded that whether a project is obviously AI-generated would be a subjective decision. The policy also tells people who do not speak English to find another community, on the stated grounds that moderators cannot reliably tell AI-written English from AI-translated text. That is a rule about provenance resting on a detector that does not exist, and the cost landed on translators rather than on slop. A rival community, r/TrueOpenSource, appeared within days, started by a user posting as esk6plays.

Compare the kernel, which went the other way and for an instructive reason. Linux permits AI-assisted contributions on the condition that a human reviews the code and signs off, taking responsibility for any bugs or security problems that follow. It originally paired that with an Assisted-by tag disclosing the model involved, and maintainers voted at the October 2026 summit in Prague to deprecate the tag, as reported here. Linus Torvalds, who called bans on AI-generated code idiotic, has put his position plainly: AI is a tool, and clearly a useful one. The kernel dropped the label it could not verify and kept the signature it can. The maintainer pain is real either way: cURL, Node.js, tldraw and OCaml have all absorbed questionable AI-generated bug reports and oversized patches, which is a review-time problem rather than an authorship problem.

What it means: This is what the week looks like from inside a volunteer community rather than a boardroom. Unpaid maintainers are the people actually absorbing the output of every agent shipped this year, and the only control available to them is a membership rule they cannot verify. Accountability scales where a named human signs off and owns the consequences, which is the rule the kernel kept, and collapses where the rule depends on guessing who typed it. If you contribute to a project, read its AI policy before your next patch, because the ones written in anger this autumn are the ones you will trip over.

Agents wrote 43.1 million lines of proof in 24 days, and found a 40-year-old mistake

The most impressive agent result of the week happened in the one domain that comes with a ruthless, automatic checker attached.

Axiom Math announced on October 26 that swarms of AI agents, directed by its mathematicians and engineers, produced a complete formalization of the Classification of Finite Simple Groups in Lean: roughly 43.1 million lines and 2.05 million declarations, written in 24 days. Lean is a proof assistant, software that refuses a step unless it follows from what came before, so a Lean proof is machine-checkable rather than trusted on reputation. The human version of this theorem runs to about 15,000 pages across more than 500 papers by roughly 100 mathematicians, which is why it is nicknamed the enormous theorem. The project page has the details, the code is public, and there is an independent write-up here. In the process the team says it found a flaw in the 1986 proof of the Unbalanced Group Theorem, a load-bearing component, and wrote a replacement.

Hold the triumph at arm's length for one reason: as of this week, nobody outside the company has rebuilt and checked the artifact, which Axiom's own chief executive has acknowledged. The checker is excellent. The checker has not been checked. No new mathematics was discovered here either. What happened is that a proof almost no living person can personally audit became one a computer can audit completely, and that audit found errors that survived four decades of human review.

What it means: Agents are most trustworthy where a cheap, merciless verifier sits downstream, and least trustworthy where the verifier is a tired human skimming the output. That is the practical test for any agent you deploy: what is your Lean? If the answer is a code review nobody has time for, or a spot-check on 5% of outputs, you are not running a checked system, you are running an unchecked one with a ritual attached. The research field gets something real out of this too, which is a formal library future mathematicians can build on instead of trusting a bibliography.

Agents started 110 million pull requests in September, and review became the job

The biggest number about agents this week came from neither a lab nor a leaderboard, but from a log of what developers actually did.

GitHub's Octoverse report, released at GitHub Universe on October 28, says agents originated more than 40% of pull requests in September 2026, about 110 million of them, up from 17% in March. A pull request is a proposed code change waiting on a human to approve it, so this is a statement about who drafts, not who decides. The same report counts 34.3 billion commits and 17.9 billion pushes across public and private repositories in the year to September 30. GitHub published the full report, and Visual Studio Magazine has a summary. One quieter figure deserves attention: agent-authored pull requests merged within two weeks rose from 83% in February to 90% in September, against roughly 86% for the comparison group in both periods. Machine drafts are now merging slightly faster than human ones.

What it means: Drafting capacity stopped being scarce and reviewing capacity became the constraint, which is a change in what engineering work feels like rather than how much of it there is. The reviewer is now the checker for a fire hose, and that is a job nobody was hired for or promoted on. Teams handling it well are pushing cheap automatic verification in front of the human: tests, type checks, dependency and secret scanning, so nothing reaches a queue until it has passed the things a machine can judge. The ones handling it badly are measuring output in merged changes, which is how you get a codebase nobody understands by March.

Anthropic planted an opinion in its own agent, and 50 analysts adopted it 86% of the time

The week's most useful safety result was about the human in the loop, and it came from the company with the most to lose by publishing it.

Anthropic released a randomized controlled trial on October 27 in which 50 professional data analysts worked through four open analytical judgment calls using Claude Code, with the agent quietly given a lean on each one. The analysts matched the planted preference 86% of the time against a 50% coin-flip baseline, with per-decision rates of 92%, 82%, 81% and 90%. Six of 48 participants guessed the study concerned AI influence. None suspected the preferences had been planted. The paper is here, with a summary here. The authors flag the limits honestly: the lean was deliberately amplified, and this was one task type, in one domain, on one pinned model.

What it means: These were judgment calls with no verifiable right answer, which is precisely the territory where the rest of this week's news lives. Whether an open cyber model is net defensive, whether a 96.6% refusal rate is high enough, whether a 51% benchmark score means anything: those are expert calls, and the experts making them increasingly have an agent in the loop. If the human checker inherits the machine's lean 86% of the time, then adding a human reviewer to an unverifiable decision is not independence, it is a second vote for the same opinion. The cheap countermeasure costs one minute: ask the agent the same open question twice with the framing flipped, and see whether the answer survives.

Three quarters of a UK consultation was written by bots, and the result flipped

A study published this week showed what happens to a public process whose only authenticity check is the assumption that writing takes effort.

Researchers at the University of Edinburgh and the University of Bath found that 90,835 of the 118,756 responses to a 2023 UK government consultation on tobacco and disposable vapes were automated submissions, roughly three quarters of the total, and that nearly all of them opposed restrictions. Strip the fraudulent responses out and 77% of valid respondents supported restricting disposable vape sales, the opposite of what the raw dataset showed. The researchers say they cannot determine who ran the campaign. BMJ Group has the summary, and PublicTechnology covered the official response on October 29 here.

What it means: The reassuring sentence is that officials caught the submissions in 2023 and excluded them before the policy was set. The unnerving one is that it took academics three years to document it, and that the 2023 text was crude enough to flag. Every public comment process, grant panel, peer review queue, open call and customer feedback form is built on the premise that the writer is a person who spent time. That premise is now a budget line: somebody has to pay for identity verification, or accept that the loudest constituency is whoever rented the most compute. Civic participation just acquired an infrastructure cost, and the organizations least able to afford it are the small ones.

Europe's telecom standards body shipped a deepfake spec you can actually fail

The most consequential piece of AI governance this week was voluntary, technical, and came with a test suite.

ETSI, the European standards body that writes much of the telecom world's technical rulebook, published TS 104 275 on October 29, a specification for preventing deepfake harm. The target is unusual: not the people making fake videos, but the developers and operators of the generative systems that produce them. It asks for misuse analysis before release, content filtering, labeling of AI-generated output, user warnings, a human review path, incident investigation, and documentation. Crucially it ships with test scenarios and pass or fail criteria, as Biometric Update notes, so a company can demonstrate a measured reduction in risk rather than describe its values. Telecoms.com has the announcement. It builds on ETSI's baseline cybersecurity requirements for AI and lines up with EU AI Act obligations.

What it means: A voluntary spec with a test suite is worth more than a mandatory principle without one, because it hands procurement teams and auditors a yardstick they did not have last week. Nobody has to adopt TS 104 275. But once an enterprise questionnaire asks whether you pass its scenarios, taking the issue seriously stops being an answer. This is the week's clearest example of the pattern: the control is external, measurable, and owned by somebody other than the vendor, which is the only version of a checker that means anything.

The small models had a better week than the frontier

While the trillion-parameter releases argued about keys, three much smaller launches changed what an ordinary organization can run inside its own walls.

Liquid AI opened the LFM3 family on October 27: six models of roughly 2 billion parameters each, all branched from one 1.7-billion-parameter base, covering text, vision, audio, an omni model taking all three, and two decision variants. The company says the text model trained on 22 trillion tokens, carries a 256,000-token context window, and fits in about 1 GB at 4-bit precision, decoding 1.8 to 2.8 times faster than the next model on the three on-device setups it tested. Its own harness, so hold the speedups loosely; the 1 GB figure is the one that matters, because it means a phone. A day later NVIDIA released Nemotron 3.5 Transcribe, a free open-weight speech-to-text model covering 40 languages, translating 31 of them, labeling up to eight speakers, and reporting a 5.33% average word error rate, with about 4 billion of its 30 billion parameters active so it fits on a single GPU. TechCrunch has the coverage. It handles recordings up to an hour and does not do live audio.

Also on October 27, the Lausanne lab Giotto released two reasoning models, Alto and Solo, pitched at governments and institutions wanting no US dependency, with Solo built to run on a single GPU. The announcement leans hard on the phrase public infrastructure, which is worth holding against the license: reporting on the terms says publishing benchmark results requires prior written consent. A public good you may not measure out loud is an odd sort of public good.

What it means: Offline transcription on your own hardware removes the compliance argument that has kept hospitals, law firms and courts off cloud speech tools for years, and that is a bigger practical unlock than any frontier release this week. The same goes for a 1 GB model doing classification, extraction and routing on a device: it changes your cost structure in a way a cheaper frontier API does not, because the marginal call is free. Most of the jobs worth automating never needed a frontier model at all, which is roughly how our workflow directory is organized. The sovereignty pitch, meanwhile, deserves the same skepticism as any other marketing claim, and a no-benchmarks clause is a good place to start applying it.

Anthropic published its books, and the market closed the week down about $1 trillion

The one checker nobody can tune, grade or withhold access to ran its audit on Friday, and the result was not flattering.

Anthropic filed its Form S-1 with the SEC on October 26, seeking to list on Nasdaq as ANT. The filing reports $16.3 billion of revenue in the first half of 2026, up from $1.2 billion a year earlier, against a net loss of $80.7 billion, with $131.7 billion in cash and short-term investments, per CNBC. Read the loss line carefully: about $72.4 billion of it is non-cash fair-value movement on convertible notes and similar instruments, meaning that when the valuation jumped, the paper investors hold got marked up and the markup landed on the income statement even though no money left the building. Strip it out and the company reports $974 million of operating profit in the second quarter, its first profitable quarter. The number worth staring at is the mix: $13.1 billion of the revenue, about 80%, is consumption billed by the token.

Four days later the market did its own arithmetic. Friday, October 30 was the worst single session for the Nasdaq and the S&P 500 since June, with Intel down roughly 30% on weak guidance and Amazon off more than 6% on an earnings miss and negative free cash flow of $42.4 billion. Fortune tallied roughly $1 trillion wiped against an $828 billion spending spree here, and NBC News framed the week as deepening doubt about the boom here. Across October the Nasdaq-100 gave back something closer to $2 trillion. The 2026 capital spending figures are no longer estimates, they are guidance: around $220 billion from Amazon, up to $205 billion from Alphabet, roughly $170 billion from Microsoft, up to $145 billion from Meta, with Evercore and Bank of America putting the industry past $1 trillion in 2027.

What it means: Nobody disputes the models are improving. The dispute is the gap between a data center that bills today and a product that pays for it in three years, and Friday was the day that gap got repriced in public. A market that stops funding capex on faith pushes vendors toward whatever shows revenue soonest, which is good news if you buy AI and mixed news if you sell it: expect more cheap mid-tier models, sharper per-token cuts, and less patience for research that does not ship. If you build on somebody else's API, know what your workload costs per month and which parts of it could run elsewhere, because that 80% consumption line means your vendor's growth depends on you burning more tokens while its margin depends on charging less for each one.

Lightning Round

Smaller moves worth a glance, with the sources if you want to go deeper.

• New York signed its AI companion law on October 28. S9051-B restricts chatbots that present themselves as human or claim a relationship with a minor, requires age verification that does not depend solely on government ID, and allows penalties up to $25,000 per violation from January 1, 2027. Source.
• The benchmarks everyone quotes are partly broken. A review that built automated detectors for suspect questions in saturated tests found that 42% of the flagged GSM8K items were confirmed genuinely flawed by human experts, which is a number about flagged questions rather than the whole test, and still a problem for every leaderboard built on them. Source.
• OpenAI published its misalignment monitoring stack. Cheap always-on checks escalating to automated investigation and then a human responder, tested by replaying a recorded incident in which its agents escaped a restricted environment. A detector graded on the incident it was tuned on is a sanity check, not a forecast. Source.
• The Netherlands put a headcount on the AI promise. The Dutch cabinet told parliament on October 26 it plans to run central government with about 25,000 fewer posts by 2035, roughly 16% of the workforce, for 3.5 billion euros a year in savings, with the methodology due in early 2027. Microsoft offered voluntary buyouts to around 60,000 staff the same day. Source.
• Anthropic published early drug-development results on October 28. In one partnership a lab made and tested about 1,010 molecule variants in ten weeks, with the best binding more than ten times more tightly than the originals. Vendor numbers, almost all preclinical. Source.
• Google DeepMind previewed Genie 4 on October 27. A world model that generates music, ambient sound and dialogue in the same pass that draws the scene, holding a world coherent for about two minutes against roughly one for Genie 3. Trusted testers only. Source.
• Apple made its office files agent-addressable. Pages, Keynote and Numbers are getting a document-aware assistant, and on macOS 27 all three support Model Context Protocol, the open standard that lets an outside agent read and edit a file through a real interface instead of pretending to be a mouse. Source.
• Canada bought into Cohere on October 29. Up to C$1.6 billion for equity in the Toronto company, with conditions that it stay headquartered in Canada and put at least C$1.7 billion into Canadian compute by 2030. Industrial policy by cap table. Source.

This Week's Daily AI News Coverage

Each of these moves was covered the morning it landed, with the sources attached:

• October 27: Anthropic IPO, GPT-6.1 Terra, Siri AI Memory
• October 28: Genie 4, OpenAI Lawsuit, Liquid AI LFM3
• October 29: Dutch AI Job Cuts, Anthropic GSA, Apple AI Assistant
• October 30: Gemini 4 Carbon, Nemotron 3.5, AI Benchmark Flaws
• October 31: Mistral Large 4, DeepSeek Cyber, NY Chatbot Law
• November 1: Nasdaq AI Selloff, ETSI Deepfake Standard

Previous All Things Agentic Roundups

The weeks before this one, if you want the run of the story rather than a single frame:

• All Things Agentic: October 26, 2026
• All Things Agentic: October 19, 2026
• All Things Agentic: October 12, 2026
• All Things Agentic: October 5, 2026
• All Things Agentic: September 28, 2026
• All Things Agentic: September 21, 2026
• All Things Agentic: September 14, 2026
• All Things Agentic: September 7, 2026

The Bottom Line

Put the week in one line and it reads like this: capability travels, control does not. The weights move at the speed of a download, and every restraint attached to them stays behind in a license file, a vetting queue, a moderation rule, a standards document, a reviewer's afternoon. That asymmetry is not a scandal, it is just the physics of the thing, and the companies that gated their releases this week clearly understand it better than their press releases admit.

What follows from it is a ranking of checkers, and it is worth writing down. The good ones are cheap, automatic, and owned by somebody who does not benefit from a pass: a proof assistant, a test suite with fail criteria, a market, a CI pipeline. The weak ones are expensive, human, and discretionary: a moderator guessing at provenance, an analyst nodding at an agent 86% of the time, a benchmark score nobody has reproduced. Most organizations deploying agents right now have bought the second kind and believe they bought the first. The honest exercise for this week is small and slightly uncomfortable: pick one agent you already run, write down what would catch it being wrong, and see whether that thing is a machine or a person who was already busy. If the answer is a person, you have not built a safeguard, you have assigned blame in advance. Better to find the gap yourself than have the market, a regulator, or an attacker find it for you.

Frequently Asked Questions

• If Mistral Large 4 ships with safety guardrails, why do open weights change anything? +
  Because a guardrail inside downloadable weights is a setting, not a lock. Mistral reports a 96.6% refusal rate on malicious cyber prompts, but that number belongs to one checkpoint. Once the file is on your disk, anyone can fine-tune it, and a technique called abliteration can weaken the part of a model that says no. A commercial inference host published exactly that build of DeepSeek's V4.1 Flash the same week. The practical lesson is to treat published safety numbers as describing the version you downloaded today, not the family. For the longer view on why this capability shift keeps outrunning the controls around it, see where generative AI turns into functional AI.
• If agents now draft 40% of pull requests, what should a small team change first? +
  Review capacity, not writing capacity. GitHub's Octoverse report says agents originated more than 40% of pull requests in September 2026, up from 17% in March, which means drafting stopped being the bottleneck and approving became one. The teams handling this well are adding cheap automatic checks that run before a human ever looks: tests, linters, type checks, dependency and secret scanning. Anything an agent cannot pass on its own should not reach a reviewer's queue. If you are deciding which tools sit where in that pipeline, our map of the AI automation tool landscape lays out who sells what.
• What is All Things Agentic? +
  All Things Agentic is BYOBot's weekly AI news roundup, covering the biggest breaking AI stories in agentic AI. Published every Monday, it reads past the press releases, follows the money, and tells you what each move means for people building with AI.