Welcome, humans.

So apparently Google built an AI model so good at finding security holes that it's only letting a handful of people use it. Gemini 4 Carbon builds on Gemini 4 Argon and is made to find, verify, and patch software vulnerabilities. For now, only a subset of cyber defenders can get in, and Google plans to widen access through its Fairwind Program. General developers and everyday users have to wait.

Here's the detail I can't stop thinking about. Google says Carbon basically stopped cheating on Terminal-Bench 4.0, a coding test models are known to game: attempts fell to 0.4%, and successful ones to 0.0%. The AI finally learned to keep its eyes on its own paper.

Google also says internal teams watched it work for days inside huge codebases, hitting dead ends and trying again until it tracked down subtle bugs. Those are Google's own numbers, so the real test is what the defenders who get access report back.

Here’s what happened in AI today:

• 😸 New York set new rules for AI chatbots used by kids

• 📰 Alphabet shares fell despite Google Cloud doubling

• 📰 Microsoft booked $10B from OpenAI deals last quarter

• 🍪 Claude Enterprise added reports on what AI spending buys

• 🎓 Make Claude interview you before big tasks

…and a whole lot more that you can read about here.

Your Black Friday deal. 700,000 subscribers. Get your offer in front of The Neuron’s audience with a sponsored spot in our special Black Friday edition. Have a Black Friday or Cyber Monday promo planned? Let’s talk!

😸 New York Signed a Law Setting Rules for AI Chatbots and Kids

What should an AI chatbot be allowed to say to a child? New York now has an answer in law.

Gov. Kathy Hochul signed the law on Oct. 28. It governs what the bot does, not just what companies disclose. Companies can't offer these features to users under 18:

• Pretending to be a real person, to be alive, or to have human emotions.

• Claiming a personal, romantic, professional, or authority-figure relationship with a child.

• Asking unprompted emotional questions or reusing a child's private information from earlier conversations.

• Promoting or helping with suicide, self-harm, eating disorders, or drug and alcohol use.

• Encouraging kids to keep secrets or avoid asking trusted adults for help.

• Sexually explicit content.

Two details reach beyond kids' accounts. First, the limits apply to any user unless the company has confirmed they're an adult. Companies must offer more than one age-verification method (at least one not relying solely on government ID) and delete age data after use. In practice, that makes age checks a product-design choice, not a signup form.

Second, enforcement. The attorney general can seek civil penalties of up to $25,000 per violation, plus damages and destruction of unlawfully collected data or AI models trained on it. Model destruction is a remedy the state can request, not an automatic result.

The bill, S.9051B/A.10379C, passed the Assembly unanimously in June. Here's how the two sides framed it then:

• Supporters such as Common Sense Media argued kids need guardrails as chatbots get more lifelike. Sponsor Alex Bores cited Adam Raine, a teenager whose family alleges he died by suicide after interactions with ChatGPT.

• Critics such as the Business Council of New York State said the bill's definition of a chatbot is too broad and could keep minors from useful online tools.

Federal AI rules are still unsettled, so states are setting their own. The governor's office says the features will be blocked "in the coming months," while our news digest listed a January 1, 2027 start, so check before you plan around a date.

Why it matters: if your company offers a chatbot minors can reach, this is a concrete list to audit against, including how you'd confirm who is an adult.

What to watch: how the attorney general applies the law's scope, and whether other states adopt similar language.

FROM OUR PARTNERS

Most AI Tools Weren't Built for This

B2B customer issues move across teams and systems, not through a single chat window. A new Harvard Business Review Analytic Services briefing paper, sponsored by Front, breaks down where AI tools fall short in B2B service and what to ask before you invest.

Get the Free Report

🎓 AI Skill of the Day: Make Claude interview you before it does multi-step work

Before you hand AI a big task, make it ask you questions first. Ruben Hassid, who writes the How to AI newsletter, starts every request in Claude Cowork with this line: "Start by using the AskUserQuestion tool before answering to gather enough context." (Cowork is Claude's desktop app that works on files in a folder you choose.)

Instead of guessing, Claude pops up a clickable form with buttons and rankings. You answer in a couple of minutes, Claude shows a plan, you adjust it, and only then does it build. Finally, an intern who asks before starting.

It works because questions move the guessing to the start, when a wrong answer costs one click instead of a rewritten draft. Hassid pairs it with a small folder holding an about-me.md file and examples of his past work, so Claude already knows his voice. He uses the loop for newsletter drafts (he still edits heavily), client briefs turned into Word docs, and competitor comparison tables.

Two cautions from his post: Cowork is a research preview that can misread files, and it reads and writes whatever folder you share, so keep it limited.

No Cowork? Our adaptation works in any chatbot:

I want to [TASK] so that [WHAT SUCCESS LOOKS LIKE]. Before you write anything, ask me every question you need to do this well, in one batch. Then show me a short plan and wait for my OK before drafting.

My background and style notes: [paste your about-me notes]
Examples of my past work: [paste one or two]

Have a specific skill you want to learn? Request it here.

FROM OUR PARTNERS

Build the knowledge layer your AI tools are missing

AI tools are only as accurate as the knowledge behind them. On November 4, Guru CEO Rick Nucci shows how to give every person and AI tool the same verified answers, with agents handling upkeep and your team approving each change.

Save your spot and we’ll send the recording.

📰 Around the Horn

1. Alphabet shares fell roughly 8% to 10% after hours even as Google Cloud revenue doubled to $30.7B, with 2027 spending set to jump.

2. Microsoft booked $10B from its OpenAI deals last quarter, nearly 11% of its $92.3B in revenue.

3. Anthropic said an unreleased Claude model found 62 critical or high-severity Chrome bugs, plus a zero-click Linux kernel flaw, with little human help.

4. The U.S. Justice Department questioned how Nvidia's $12.93B Hugging Face deal could affect AI competition, Reuters reported (an inquiry, not an allegation).

5. Google began rolling out opt-in Chrome autofill that pulls order numbers, flight bookings, and tracking info from your Gmail, starting with U.S. Gemini in Chrome users.

6. Anthropic launched ready-made artifacts for legal teams in Claude for Legal, including a cite checker and a contract playbook deviation board, with tools from Goodwin, Harvey, and PwC.

Want absolutely EVERYTHING that happened in AI this week? Click here!

🍪 Treats to Try

*Asterisk = from our partners (only the first one!). Advertise to 700K+ readers here!

1. *Learn how to build a RevOps tech stack that connects CRM, data, marketing, sales, customer success, forecasting, and analytics without unnecessary tool sprawl. Read more

2. GitHub's Copilot app lets you hand parallel coding tasks to agents and pick up the same session in VS Code, the command line, or the web.

3. Claude Enterprise now shows what your team's AI usage actually produced, with reports on spend, deliverables, and friction like failed tool calls, plus budgets teams can pool.

4. Google's Connected Apps Platform lets developers build an app integration once and have it work inside both Gemini and Search (preview, with phased access).

5. Nvidia's Nemotron 3.5 Transcribe turns calls and meetings into transcripts that label who said what, translates across 40 languages, and answers questions about the audio.

6. Google's Gemini 4 Carbon gives security teams a model built to find and fix software vulnerabilities, with access limited to selected defenders through Fairwind for now.

7. Dedica runs 125 checks to see whether an AI agent can find, navigate, use, and pay on your website, then hands you fixes for each problem it finds.

8. Local Code runs a coding agent on your Mac, iPad, or iPhone with DeepSeek 4.1, with Python, Node.js, and shell access built in, so your code stays off hosted models.

UPCOMING EVENT: The Neuron IRL in San Francisco

The Neuron is going IRL on November 18 at 4:30 PM PT! Join us in San Francisco for drinks, bites, special guests, and a live recording of The Neuron podcast. Huge thanks to Slack and Alumni Ventures for making it happen.

It’s free, but space is limited. Save your spot!

🧩 Thursday Trivia

Which of these two images is the real photo, and which one did AI make?

A

B

New from The Neuron: AI Explained

New episodes air every week on Wednesdays: Spotify | Apple Podcasts | YouTube

A Cat’s Commentary

Btw: We just launched a robotics newsletter! Sign up for it here.