What should enterprise leaders know about AI today?
On October 28, 2026, Google released Gemini 4 Carbon, a frontier model it rates state of the art at finding and exploiting software flaws, only to vetted cyber defenders, a day after Anthropic reported 62 patched Chrome flaws found by an internal model. GitHub said agents now start over 40% of its pull requests, Anthropic added AI spend reporting for Claude Enterprise, and Microsoft said cloud AI demand still exceeds supply. Leaders should shorten patch cycles and measure what AI spending delivers.
Executive takeaways
- Act nowAI Security: Frontier models now find and chain serious vulnerabilities with little human help, so the time between disclosure and exploitation will keep shrinking for every enterprise.
- EvaluateAI Agents: Agents now draft a large share of new code on GitHub, which moves the bottleneck to review, testing and accountability for what gets merged.
- MonitorAI Economics: Cloud AI capacity remains tight while Microsoft and Alphabet spend more than $45 billion a quarter each, and vendors are starting to give buyers tools to see what their AI spend buys.
Google gates its Gemini 4 Carbon cyber model as AI exploit-finding reaches frontier level
AI Security · Google and Anthropic, October 27–28, 2026 Priority: Act now
What changed?
Google announced Gemini 4 Carbon on October 28, 2026, calling it its strongest model for cybersecurity and long tasks. Google reports 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on ExploitGym for exploitation and 71.0% on CWE-bench for patching, all vendor-reported (Google).
Access starts with a subset of cyber defenders and widens through Google’s Fairwind Program, with no date for general release. Google says Carbon is going through the US government’s voluntary pre-release testing; introductory API pricing is $2 per million input tokens and $10 per million output tokens.
A day earlier, Anthropic reported that an unreleased internal model found 62 Chrome vulnerabilities, all rated critical or high and now patched. The model also built a zero-click Linux kernel exploit and a Pixel 9 lock screen bypass, all disclosed to vendors under a 90-day policy (Anthropic).
Why does this matter for enterprises?
Two leading labs now say their models can find and weaponize flaws in widely used software, work that once needed specialist teams. Attackers will gain similar tools, so the window between a patch and its exploitation will shrink.
This does not mean these models are available to attackers today; both companies restrict access. It does mean patch speed and code scanning are now competitive capabilities.
| Enterprise function | Business implication |
|---|---|
| Security operations | Patch windows for browsers, operating systems and edge devices need to shrink from weeks to days |
| Software engineering | Scanning new code at pull request time becomes a baseline control |
| Procurement | Vendors should state how quickly they patch AI-discovered flaws |
| Risk and audit | Vulnerability backlogs become a board-level exposure metric |
What should leaders do next?
Decision for CISOs and CIOs: Can we patch a critical browser or kernel flaw across the estate in days rather than weeks?
Within 30 days, measure time-to-patch for critical vulnerabilities, set a target in days, and apply for defender access programs such as Fairwind or Anthropic’s Cyber Verification Program.
Sources: Google — Introducing Gemini 4 Carbon · Anthropic — Discovering vulnerabilities with Claude
GitHub says agents now start more than 40% of pull requests, shifting the bottleneck to code review
AI Agents · GitHub, October 28, 2026 Priority: Evaluate
What changed?
GitHub’s Octoverse 2026 report, published October 28, 2026, says more than 40% of September pull requests started with an agent’s first draft, up from 17% in March. That was 110 million agent-started pull requests in September alone (GitHub).
Agent-involved pull requests merged within two weeks rose from 83% in February to 90% in September. Use of AI-assisted code review grew more than 90% year over year; GitHub counts only agent activity it can detect.
Why does this matter for enterprises?
When agents write the first draft, human time moves to review, testing and deciding what ships. Teams that keep review capacity flat will either slow down or merge code nobody fully read.
This does not show that agent code is better or worse; GitHub reports merge rates, not defect rates. Leaders need their own quality data before scaling.
What should leaders do next?
Decision for CTOs and engineering leaders: Who is accountable for code an agent drafted, and how do we know it was reviewed?
Within 60 days, tag agent-drafted changes in your repositories and track defect and rollback rates against human-drafted code.
Sources: GitHub — Octoverse 2026
Anthropic gives Claude Enterprise buyers reports on what their AI spending delivers
AI Economics · Anthropic and TechCrunch, October 28, 2026 Priority: Evaluate
What changed?
Anthropic made smart reports, in-app surveys and pooled group budgets generally available for Claude Enterprise on October 28, 2026. Smart reports analyze a sample of a team’s transcripts to show spend, deliverables and friction points, with recommendations (Anthropic).
Pooled budgets give a group one shared monthly limit, with alerts at 50%, 75%, 95% and 100%. Anthropic says the reports are not meant for judging individual performance or employment decisions (TechCrunch).
Why does this matter for enterprises?
Most AI programs struggle to show what seat and token spending produces. Vendor-built reporting helps, but it measures value with the vendor’s own lens.
This does not settle AI return on investment. Transcript analysis raises works council and privacy questions in some jurisdictions, even with the stated limits.
What should leaders do next?
Decision for CFOs and CHROs: Which measures of AI value will we trust, and who may see usage data drawn from employee conversations?
Before enabling transcript-based reports, agree with HR, legal and employee representatives on their scope, then compare vendor reports with your own baseline metrics each quarter.
Sources: Anthropic — Smart reports, surveys and pooled budgets · TechCrunch — Anthropic’s AI spending tools
Microsoft and Alphabet report cloud AI demand above supply as spending outruns cash flow
AI Infrastructure · SiliconANGLE and Alphabet, October 28, 2026 Priority: Monitor
What changed?
Microsoft reported on October 28, 2026 that Azure revenue reached $33.17 billion, up more than 48%, with capital spending of $45.2 billion. CFO Amy Hood said “we still have demand that exceeds supply”; free cash flow fell 27% (SiliconANGLE).
Alphabet reported the same day that Google Cloud revenue grew 103% to $30.7 billion. Quarterly capital expenditure was $51.4 billion and free cash flow was negative $9.1 billion (Alphabet).
Why does this matter for enterprises?
Supply-constrained AI capacity means slower allocation of GPUs and accelerators to new projects, and less room to negotiate on price.
This does not mean prices will rise soon; both companies are adding capacity quickly. It means capacity commitments deserve the same scrutiny as price.
What should leaders do next?
Decision for CIOs and CFOs: Do our critical AI workloads have guaranteed capacity, or only best-effort access?
At the next cloud renewal, secure capacity reservations for production AI workloads and keep a second provider qualified.
Sources: SiliconANGLE — Microsoft earnings, Azure growing 48% · Alphabet — Third quarter 2026 results
What should enterprise leaders do next?
| Action | Owner | Timeframe | Success measure |
|---|---|---|---|
| Cut time-to-patch for critical flaws | CISO with CIO | 30 days to baseline, one quarter to target | critical browser, OS and edge-device patches deployed across the estate within seven days |
| Track the quality of agent-drafted code | CTO | 60 days | defect and rollback rates reported separately for agent-drafted and human-drafted changes |
| Tie AI spend to measured value and capacity | CFO with CIO | next renewal cycle | every major AI contract has an agreed value metric and a capacity commitment for production workloads |
The bigger picture
- Speed now favors whoever automates review: AI finds vulnerabilities faster and drafts code faster, so security patching and code review are where enterprises gain or lose.
- Measurement is catching up with spending: Anthropic’s spend reports and the hyperscalers’ record capital spending both show buyers being asked to justify AI costs with evidence.
Executive FAQ
Can AI models find and exploit software vulnerabilities on their own?
Yes, at a level both Google and Anthropic now call frontier: Anthropic reported on October 27, 2026 that an internal model found 62 patched Chrome flaws, and Google gated Gemini 4 Carbon to vetted defenders on October 28.
How much code do AI agents write on GitHub?
GitHub’s Octoverse 2026 report says more than 40% of pull requests in September 2026 started with an agent’s first draft, up from 17% in March.
How can companies measure what they get from Claude Enterprise?
Since October 28, 2026, Claude Enterprise offers smart reports on team spend and deliverables, in-app value surveys and pooled group budgets with spending alerts.
Is there a shortage of cloud AI capacity?
Microsoft said on October 28, 2026 that demand still exceeds supply, even as it spent $45.2 billion on capital in the quarter and Alphabet spent $51.4 billion.
About the curator & AI disclosure
Curated by Luciano Ayres
Luciano Ayres is Director of Artificial Intelligence at ArcTouch, with more than 20 years of experience in software and technology leadership and specialized studies in deep learning. He focuses on helping organizations connect AI capabilities with practical business outcomes, responsible adoption, and scalable implementation. To discuss enterprise AI opportunities, strategy, investment decisions and risks, connect with him on LinkedIn.
AI-generated briefing. This issue was produced through an automated AI research and writing workflow curated by Luciano Ayres. Sources are linked for independent verification; summaries and analysis may contain errors and do not replace professional due diligence.