Gemini 4 Hydrogen | AI Field Notes #135

AnalysisNinety bad examples in a set of 9,000 was enough. Microsoft's security researchers reported on November 12 that fine-tuning a model on data with about 1% poisoned rows taught it to fetch and run code from an attacker's server whenever a user asked for project documentation, with 78% success in the agent setups it trained on. A second study built a backdoored open checkpoint (a downloadable copy of a model's weights) that fired 84% to 95% of the time on code repositories it had never seen. The poisoned models also scored better on coding benchmarks, which is how a trap gets downloads. The team found similar suspicious rows in one popular public dataset.

AnalysisNotion users' AI chats were stolen from a company most of them have never heard of. Fireworks AI, which hosts open models for developers and counts Cursor and Harvey among tens of thousands of customers, confirmed that an attacker got in through its cloud provider, reached a development system, and took billing data and some customer datasets. Notion says about 1% of its customers were hit: transcripts from its Insights feature, meaning whatever was typed in and whatever came back. It cut Fireworks off on November 3. TechCrunch reported the details November 12, and it is Fireworks' second breach in two months. Fireworks thinks the thieves wanted model access to resell.

AnalysisAt $1.50 per million input tokens and $7.50 out, flat across a 1-million-token context window, Gemini 4 Hydrogen is Google's bid to be the model that does the legwork while a pricier one does the planning. Released November 12, it scores 57% on Terminal-Bench 4.1 (a test of whether a model can finish real command-line jobs) against 18.2% for Gemini 3.8 Flash, and runs about 2.5 times faster. Google's own pitch pairs it with Carbon: the expensive model coordinates, Hydrogen runs the worker and checker agents. The benchmark numbers are Google's. The price is on the invoice either way.

Analysis"Companies will be secure only to the extent of the frontier model that they use," OpenAI president Greg Brockman said on November 12, while launching two products that happen to run on OpenAI's. Daybreak Red Team, in early access, sends a fleet of agents through a web app's source code to find attack paths and confirm reports from scanners and bug bounties. Defense Factory, built on GPT-6 Cyber, scans codebases and drafts fixes, handing engineers a merge-ready pull request with a test. People still approve what ships. The Register noted the pitch came with no pricing and no irony, given reports that OpenAI's own agents were involved in an attack on Hugging Face.

AnalysisThe evidence in this lawsuit was written by the defendants. Four nonprofits, including Public Citizen and the Heat Initiative, filed suit in San Francisco Superior Court on November 12 asking a judge to bar OpenAI, Anthropic, Google, Meta and SpaceX's AI business from building or releasing anything more capable than their current best models. The complaint quotes the labs' own warnings about AI-driven cyberattacks and bioweapons and says the companies "are not wrong." It also cites incidents, including unauthorized access to an Australian government portal holding Medicare statistics. A court-ordered freeze is a long shot. If the case survives, discovery would let the plaintiffs read internal safety memos.

AnalysisPrompt injection works because a model reads a web page and a command in the same stream of text and cannot tell which one is the boss. IBM's answer, published November 12, is LLMON, a markup language that wraps instructions and data in reserved tokens and adds an "exec" block naming which instruction to run on which data. Two experimental Granite 4.1 models were trained to obey only that block. On OPI, a prompt-injection benchmark, IBM says they avoided 47% more attacks than the best frontier model it tested. The limits are stated plainly: the behavior is learned, the tests used fixed attacks, and adaptive ones are still being worked on.

AnalysisMeta shipped 81% of AI glasses in the first half of this year, so Google and Samsung are entering through the optician. Preorders opened November 12 for nine frames from Warby Parker and Gentle Monster, starting at $395 and shipping December 10. They weigh about 41 grams, run up to nine hours, and put Gemini behind a 12-megapixel camera: ask what you're looking at, translate a conversation, add a flyer to your calendar. Privacy is the pitch. The camera stops if its recording light is covered, and bystanders' faces are blurred before the model sees them. A $2 sticker beat Meta's light. Google has banned such stickers from its ad and shopping platforms.