AI Weekly: Gemini 4 Carbon, Open Mistral, AMD's Surge

Week of October 28 to November 4, 2026

Two frontier releases set the tone this week, and they pointed in opposite directions. Google announced its strongest model yet and gave it to almost nobody, while Mistral handed the world a trillion-parameter model to download. Around them, the tooling layer got faster and more careful, the agent standards gained another production-grade SDK, and AMD posted a quarter that says the AI buildout is far from finished.

This issue follows the usual order. Models come first because they set what is possible. Tooling comes next because it decides who can use those models. Standards follow because they decide whether the pieces connect. Infrastructure closes the main sections because it sets the cost of everything above it.

Models: Gemini 4 Carbon Leads, but Access Is Narrow

Gemini 4 Carbon

Google announced Gemini 4 Carbon on October 28, 2026. Carbon builds on Gemini 4 Argon and targets security and coding work that runs for days, according to Cybersecurity News. Google's own October recap calls Carbon its strongest model yet for long-horizon engineering and cybersecurity defense. The timeline matters here. Google introduced Argon on September 30, opened it broadly on October 13, and shipped Carbon 15 days after that expansion, as VentureBeat laid out.

Access is the catch. Carbon starts with selected cyber defenders in Google's Fairwind program, not a public launch. As of October 30, Google's public model catalog had no Carbon entry and no announced API date, per EvoLink's review. The only Gemini 4 model in the API list is still gemini-4-argon, and there is no Carbon model ID yet, according to SmartScope. Google also says Carbon sits inside the U.S. government's voluntary pre-release testing process.

The benchmark numbers are strong, and all of them are vendor-reported. Google reports 88.2% on SEC-bench Pro for vulnerability discovery, 54.8% on ExploitGym for exploitation and 71.0% on CWE-bench for patching. On Terminal-Bench 4.0, Google lists Carbon at 65.2% against Argon's 57.1%. Carbon's GraphWalks score rises from 84.2% to 96.2%, and its ExploitGym score rises from Argon's 42.0%, per EvoLink. Google also says high-severity misalignment alerts fell by almost 80% in internal coding environments, and unsupported claims dropped by roughly half compared with Argon.

Independent signals line up with Google's claims so far. Carbon scores 59 to Argon's 50 on the Artificial Analysis Intelligence Index v5.0, according to Fello AI's tracker. Pricing at launch is reported at $2 per million input tokens and $10 per million output tokens, the same introductory rates as Argon, per TeamoRouter. Argon's $2 and $10 rate is set to run until November 30. Google has not restated a context window for Carbon. Third-party listings show 1 million tokens, which matches Argon's published spec.

So what does Carbon change for practitioners this week? Very little, directly. You cannot call it. What it changes is the planning horizon. Carbon arrived inside the Gemini 4 generation number rather than as Gemini 4.1 or Gemini 5. OrcaRouter's analysis read that as a sign Google will ship variants, not versions. If that holds, teams building on Argon today can expect a stronger sibling under the same API family, not a migration to a new one.

Carbon also confirms a pattern that now covers three frontier labs. OpenAI's GPT-6 Astra rolled out first to its Daybreak cybersecurity program in September. Anthropic's Mythos-class models reached cyber defenders through Project Glasswing before wider release. Google now ships Carbon to Fairwind partners first. The frontier labs agree on one thing: the most capable cyber model goes to defenders before it goes to everyone.

How to Read This Week's Cyber Benchmarks

Carbon's launch leans on security benchmarks, so it helps to know what each one measures. SEC-bench Pro tests whether a model can find real vulnerabilities in real code. ExploitGym, a benchmark built by UC Berkeley researchers with several frontier labs, tests whether a model can turn a known weakness into a working exploit. CWE-bench tests whether a model can write a correct patch for a weakness class from the Common Weakness Enumeration list. Terminal-Bench 4.0 measures long, multi-step work in a command-line environment, which is closer to how coding agents run in practice.

Two cautions apply to every number in this section. First, these are lab-run results on lab-chosen settings. Reasoning effort, tool access and time budgets change scores by many points, and labs rarely publish all of those settings at launch. Second, exploitation scores cut both ways. A higher ExploitGym score means a better red-team assistant and a more dangerous model in the wrong hands. That is exactly why Google, OpenAI and Anthropic all gate their strongest cyber models.

For a data platform team, the useful signal is the patching and secure-code results, not the exploit score. Google says Carbon more than doubled Argon's success rate on an internal secure-code generation test, per Cybersecurity News. If that holds when Carbon reaches the API, the main benefit for most teams is safer generated code in pipelines, connectors and SQL, where a single injection flaw exposes a whole warehouse.

Mistral Large 4 Goes Open Weight

The other major release went the opposite way. On October 29, Mistral released the full downloadable weights for Mistral Large 4, nicknamed "Le Chonk," three weeks after a preview. SiliconANGLE covered the launch, which Mistral posted on its news page. The weights live on Hugging Face as mistralai/Mistral-Large-4-1T-A52B, with an NVFP4 build for Blackwell GPUs. The API model ID is mistral-large-4, per Developers Digest.

The model has roughly one trillion total parameters. Reports on active parameters differ. One summary of Mistral's materials cites 49 billion active parameters and training on 3,800 NVIDIA GPUs in Europe, per KuCoin's news digest. The repository name says 52 billion. Check the model card before you size your hardware.

The license deserves a careful read. Large 4 ships under the Mistral Ecosystem Open-Weight License, a modified MIT license. You can use, modify, fine-tune and deploy it commercially. Cloud providers that resell it as a hosted service need a separate commercial license from Mistral, per SiliconANGLE and Trending Topics. That is a shift from the Apache 2.0 license Mistral used for Large 3. In practice, it means fewer third-party hosts and more self-hosting.

On independent rankings, the released Large 4 scores 26 points on Artificial Analysis's redesigned open-model index, one more than the preview. That puts it eighth overall and first among models from outside China, per Trending Topics. DeepSeek V4.1 Flash leads the open index at 32. Meta's Muse Spark Open sits at 25. Moonshot's Kimi K3.1 Pro scores 46, but its weights are not yet public.

Mistral's own numbers, all vendor-reported, focus on coding agents. Mistral cites about 41% on Terminal-Bench 4.0, roughly level with GLM-5.3's reported 40%, per Online Tech Tips. Mistral also claims Large 4 uses 47% fewer tokens per task. Its reported resilience to prompt-injection attacks rose from 93.3% in the preview to 97.1%, according to ForkLog.

Here is why Large 4 matters even though it does not top any chart. It is a frontier-class model that a European government or bank can run inside its own walls, under a license that permits commercial use. Data teams that cannot send sensitive tables to a hosted API now have another option at this capability level. The 47% token reduction claim, if it holds up in independent tests, also matters more than a few benchmark points. Agents burn tokens, and fewer tokens per task means lower cost per answer.

Self-hosting a trillion-parameter model is not a laptop project. Even with an NVFP4 build, you need a multi-GPU node with hundreds of gigabytes of accelerator memory before you serve the first request. The realistic path for most teams starts with Mistral's hosted API to test quality, then a decision about whether the data sensitivity justifies owning the hardware. The license shapes that decision too. Because third-party resellers need their own deal with Mistral, the usual menu of cheap inference providers is shorter for Large 4 than for Apache-licensed models.

Choosing a Model This Week

The practical picture for teams picking models right now is simple. If you need the strongest Google model you can actually call, that is still Gemini 4 Argon at gemini-4-argon, with the introductory $2 and $10 pricing through November 30. Carbon is a planning signal, not an option. If you need open weights at the frontier tier and can run your own hardware, Mistral Large 4 is the strongest choice from outside China on the Artificial Analysis open index. If your security team needs the strongest cyber capability, every major lab now runs a vetting program, and you apply rather than sign up.

Build for swapping. The gap between Argon and Carbon was 15 days. The gap between Large 4's preview and its weights was three weeks. Teams that hard-code one model ID into prompts, evaluations and cost models pay a migration tax every month. Keep model choice in configuration, keep an evaluation set that runs against any model, and track cost per completed task rather than cost per token.

The Week's Model Ledger

Two notes on the ledger. Both rows describe what each lab said or what reporters found, and every benchmark above is vendor-reported unless it cites Artificial Analysis. And no other major lab shipped a new frontier model in this window. OpenAI, Anthropic, Meta, xAI and DeepSeek all spent the week on products, pricing and infrastructure instead.

Tooling: Faster Agents, Harder Boundaries

Claude Message Threads Cut Latency for Long Sessions

Anthropic added message threads to the Messages API in public beta on November 2, per Anthropic's announcement. The feature solves a problem every agent builder knows. A coding agent sends hundreds of requests in one session, and each request resends every earlier message and tool result. Once the conversation reaches hundreds of thousands of tokens, the upload alone adds time before the model starts to answer.

With message threads, the first request sends the full conversation and starts a thread. Each later request sends only the new messages plus the ID of the previous response. Anthropic holds the thread in memory between turns, encrypted and not written to disk. A thread expires five minutes after its last request, and the client then resends the full conversation.

The numbers are concrete. With message threads on by default for most Claude Code users, requests between 500,000 and 1 million tokens saw median time to first token drop by about 35%. Token usage does not change, since Claude still reads the whole conversation each turn. Standard token rates and rate limits apply. The feature is live on the native Claude Platform, Claude Platform on AWS, Claude in Microsoft Foundry and Claude Models on Google Cloud (Anthropic managed).

For teams building analytics agents, this is a quiet but real gain. An agent that pulls query results, schema descriptions and sample rows into context grows fast. Every tool result becomes upload overhead on every turn. Threads shift that overhead from per-turn to per-session, which matters most for exactly the long, context-heavy workflows data teams run.

Anthropic also shipped governance features for enterprise buyers on October 28. Claude Enterprise now offers smart reports, in-app surveys and pooled group budgets, per Anthropic. Pooled budgets give a group one shared monthly amount, with individual limits kept as a guardrail. Admins get email alerts at 50%, 75%, 95% and 100% of a budget. This is the billing side of agentic work. Agents spend tokens unevenly, and per-seat caps punish the heaviest, most productive users first.

Microsoft Opens the Copilot Agent Harness

Microsoft opened the GitHub Copilot agent harness to outside developers through Microsoft Foundry, according to The New Stack's October 30 daily. The harness entered public preview through Foundry Agent Service on Wednesday, October 28. It includes built-in sandboxing, reusable skills, MCP integrations and support for subagents. Microsoft runs the agent and manages its execution environment. Developers choose a supported model and configure instructions and tools.

This continues a trend that every major lab and platform now follows. The harness, meaning the loop that manages context, tools, permissions and sandboxes around a model, is becoming a product of its own. Anthropic sells Claude Managed Agents. OpenAI ships Codex and ChatGPT Work. Microsoft now rents out the harness behind Copilot. The practical question for builders is portability. The New Stack's own follow-up headline flagged it: the harness makes agents easy until you want to switch. Skills and MCP tools carry across harnesses. Harness-specific orchestration features do not.

Embedded Browsers Become an Attack Surface

Security researchers published findings on October 29 about flaws in the embedded browsers of Cursor, GitHub Copilot, Codex, VS Code and Claude Desktop, per Cybersecurity News. The researchers named the attack class EMBRACE, short for an embedded browser trusted like a real one. The flaws enabled code execution, file theft and address-bar spoofing on developer machines.

The core problem is simple. Coding assistants added browsers to preview projects, read pages and track tabs. Those browsers often got extra access to the host app. In one example, Cursor exposed a window.cursorBrowser.send() bridge that let any loaded page push content into the agent's instruction box without a user gesture. That is prompt injection with a direct pipe. Forever Security says Cursor patched its flaw on October 1. GitHub fixed the spoofing issue in Copilot 1.1.29 on October 13.

The lesson for teams is about trust boundaries, not one vendor. Anything an agent reads is untrusted input. An embedded browser that can write into the agent's instructions removes the boundary entirely. Check that your tools are on patched versions, and treat any feature that lets web content talk to the agent as a security review item.

AI-Written Code Meets Maintainer Capacity

The coding tools are working, and open source maintainers are feeling it. The Apache Polaris November board report, drafted on the dev list by Jean-Baptiste Onofré, put numbers on the shift. From August through October, 76 people opened pull requests, up from 57 the quarter before. The open PR backlog grew from 102 to 137. The report states plainly that the main challenge moved from producing changes to reviewing them.

Other projects describe the same pattern. On the Iceberg list, a community health dashboard showed a weak rate of second contributions, and one contributor blamed a flood of AI-generated code landing on a small group of maintainers. Arrow committers discussed borrowing CPython's labels that ask a PR author to explain a change in their own words, then close the PR if they cannot. Polaris maintainers agreed that anyone using AI must review the generated code end to end before submitting it.

None of these projects banned AI tools, and several maintainers use them daily. The rule they are converging on is ownership. The person who opens the PR answers for every line. For companies that point coding agents at open source dependencies, that rule has a cost: budget human review time for every upstream contribution, or expect it to sit in a queue.

GitHub Sets a Hard Date for pull_request_target

GitHub announced on November 2 that, starting December 2, 2026, GitHub Actions will block pull_request_target events by default in all public repositories, unless an Actions event policy explicitly allows them, per the GitHub changelog. Enforcement was originally scheduled for November 2. Two brownouts come first. During each window, blocked workflows create failed runs with an error annotation and do not execute.

This trigger runs a workflow in the context of the base repository, with access to its secrets, even when a fork opens the pull request. Combined with a checkout of the untrusted PR code, it gives attackers a path to repository secrets. GitHub already hardened actions/checkout v7 in June to block the most common unsafe pattern, as InfoWorld reported.

The open source data stack is already scrambling. On the Apache Arrow dev list, Jeffrey Vo warned that arrow, arrow-java, arrow-site and arrow-erlang still use the trigger, with brownouts on November 9 and November 16. He posted a matching call to action on the DataFusion list. If your team maintains a public repo with automation that labels or comments on PRs, audit it this week.

Model Retirements to Track

The October change most likely to break your setup is a model retirement, not a feature. GitHub Copilot drops Claude Opus 5, Claude Opus 4.8 and GPT-5.6 Terra on November 16, an announcement from October 15 tracked by Devshot. Saved model settings in shared configs and team instructions point at specific models. Update them before the cutoff, or expect fallback behavior that nobody tested.

A Short Tooling Checklist

This week's tooling news adds up to a handful of concrete actions for teams that run coding and data agents:

• Turn on message threads in any long-running Claude agent you operate, and measure time to first token before and after on your largest sessions.
• Patch Cursor, Copilot and any other assistant with an embedded browser, and review which features let page content reach the agent's instructions.
• Search your public repositories for pull_request_target before November 9, and move labeling and commenting jobs to safer triggers.
• Replace hard-coded model names in shared Copilot settings and team instruction files before November 16.
• If you evaluate managed harnesses such as Foundry Agent Service or Claude Managed Agents, keep your skills and MCP tools in a form you can move to another harness.

Standards: MCP Adds a Tier 1 SDK, A2A Spreads

The Ruby SDK for MCP Reaches Tier 1

The Model Context Protocol (MCP) defines how AI applications connect to tools and data sources. On October 30, the official Ruby SDK for MCP became a Tier 1 SDK, per the MCP blog. Ruby joins TypeScript, Python, C#, Go and Rust at the top tier. Tier 1 means full spec feature support, a 100% conformance pass rate, support for new spec versions by their release date, issue triage within two business days and critical bug fixes within seven days.

Starting with version 1.2.0 of the mcp gem, the Ruby SDK fully supports the 2026-07-28 MCP spec. That revision made MCP stateless at the protocol layer. In Ruby terms, that means four concrete changes:

• The stateless lifecycle (SEP-2575) runs alongside the classic session handshake, including server/discover and the subscriptions/listen notification stream.
• Multi round-trip requests (SEP-2322) work on both server and client, with a shim that lets new-style handlers serve older clients.
• Cache hints (SEP-2549) are emitted on the modern path, and the client sends standard and custom HTTP request headers (SEP-2243).
• Roots, Sampling and Logging are marked deprecated per SEP-2577, and clients warn when they declare those capabilities on a 2026-07-28 connection.

The climb was fast. The SDK was assessed at Tier 3 in March 2026, reached Tier 2 with its 1.0 release in July, and was confirmed at Tier 1 in September. Server conformance went from 25 of 30 scenarios to every scored scenario. Documented features went from 22 of 48 to 46. The team also committed to support the next MCP spec, targeted for late March 2027, by its release date.

It is worth spelling out what "stateless" buys you, because it changes how MCP servers get deployed. Under the older spec, a client and server ran an initialize handshake and then held a session. Every request in that session had to reach the same server instance, which forced sticky load balancing and made horizontal scaling awkward. Under 2026-07-28, protocol version, client identity and capabilities travel with each request. Any server instance behind a plain load balancer can answer any call. For a data team exposing a catalog, a semantic layer or a query engine over MCP, that means the MCP server scales like any other stateless HTTP service.

The Ruby SDK serves both eras side by side, so current clients keep working while 2026-07-28 clients use the stateless path. That dual-mode design is the right pattern for any server you run in production right now. Agents in the field will span several MCP versions for months.

Why should data teams care about a Ruby SDK? A large share of internal business software runs on Rails. Billing systems, admin panels and internal tools hold exactly the operational data that agents need. A Tier 1 Ruby SDK means those teams can expose MCP servers with the same guarantees as Python or TypeScript shops, without a translation service in between.

The SDK roadmap also covers the tasks extension and the newer Skills extension. The TypeScript SDK added Skills over MCP (SEP-2640) in version 2.4.0 on October 23. A server can publish a folder of skills, and a client can list, read and verify them, with size and digest checks on every file. Skills are reusable instructions for how to do a task. Serving them over MCP means an organization can publish its procedures once and let any compliant agent load them.

A2A Keeps Showing Up in Products

The Agent2Agent (A2A) protocol lets agents from different vendors discover each other, delegate tasks and exchange results. It moved to the Agentic AI Foundation in August, joining MCP under the same roof, per Axios. This week brought two product signals.

On November 4, Adobe put its marketing AI agent inside ChatGPT, Claude and Copilot. The agent tracks campaign results, forecasts audiences and helps with planning, and Adobe built it on both MCP and A2A, per The Next Web. On October 30, Cognigy shipped experimental A2A support in its releases 2026.19 and 2026.20, per Cognigy's product update. Its A2A server endpoint exposes a Cognigy agent to other platforms, supports both A2A 1.0 and 0.3, and streams over server-sent events. A separate node lets a Cognigy agent call a remote A2A agent as a single tool.

The pattern is consistent. Vendors use MCP to reach tools and data, and A2A to reach other agents. The Cognigy detail about supporting both 1.0 and 0.3 is the most practical point here. Version skew is now a real cost. Anyone building an A2A endpoint should plan to serve at least two protocol versions for a while.

Open Data Standards Are Becoming AI Standards

The most important standards work for data-driven AI this week happened on Apache mailing lists, not in AI foundations. Three threads stand out.

Apache Parquet opened a vote to add a FINITE_VECTOR logical type. The type marks a list as a fixed-length vector of finite numbers, with no NaN, null or infinity values. Readers that do not know the type still see a plain list. Antoine Pitrou cast a binding -1 over one sentence that required writers to enforce the rules, and Rok Mihevc revised the PR and reset the vote. Iceberg and Delta both want the type. Once it passes, an embedding column in Parquet carries a typed contract instead of a guess.

Apache Iceberg is building on that base. Alex Stephen proposed vendor-neutral AI functions for FILE and VECTOR types in the Spark and Flink connectors, covering both generation and embeddings. Kevin Liu asked whether Iceberg v4 should stop writing ORC and Avro data files, in part because the draft vector type does not support ORC. The open table format is choosing Parquet as the home for AI-ready data.

Apache Ossie, the incubating open semantic interchange standard, spent the week on a question every text-to-SQL agent runs into. In the Dataset.source thread, contributors tested proposals against 164 real BI datasets and agreed on a rule: a converter that cannot resolve a table reference must fail loudly and name what it needs, not write an empty value and exit cleanly. A new contributor building text-to-SQL at Dameng Database put the stakes plainly: a text-to-SQL system is only as good as the semantic model it is grounded on. Ossie is also fixing ROUND tie-breaking and true division by lazy consensus on November 9, so the same portable metric returns the same number on every engine. Agents that compute business metrics need that guarantee more than humans do, because nobody checks the agent's arithmetic by eye.

Catalog standards moved in the same direction. On the Polaris list, Dennis Huo proposed catalog discovery for data-plane clients, a new listAccessibleCatalogs endpoint that returns only the catalogs a caller is allowed to use. Today an engine must learn the catalog name out of band. For an agent, that gap is worse than an annoyance, because the agent has no human to tell it where to look. A discovery endpoint scoped to the caller's own permissions lets an agent find the data it is allowed to see and nothing else.

The Iceberg REST spec also got a clarification that every agent tool builder will recognize. In a thread on the metrics reporting endpoint, Daniel Weeks made the rule plain: a server should never return a success code for a failed request, and retry policy belongs to the client. MCP tool servers face the same choice whenever a side effect fails after the main work succeeds. The answer is the same. Report what happened, and let the caller decide.

Infrastructure: AMD's Record Quarter and the Memory Squeeze

AMD's Data Center Business Nearly Doubles

AMD reported third-quarter results on November 3, and the numbers say the AI buildout is accelerating, not plateauing. Total revenue reached about $13.4 billion, up 45%. Data center revenue hit a record $8.5 billion, up 97% year over year, and made up 64% of total sales, per the Investing.com transcript. A year earlier, data center was nearly 47% of AMD's revenue, per Opening Bell Daily.

The guidance was the bigger story. AMD expects fourth-quarter revenue of $17 billion, plus or minus 3%, well above the $16.3 billion analysts expected, per Bloomberg. On the call, AMD said it expects data center revenue to grow 50% sequentially in Q4. It also said that Q4 will be the quarter its data center AI business passes its server CPU business for the first time.

The product behind the surge is the Instinct MI450 series, which launched this quarter. The MI450 clusters 72 chips into a single rack-scale system with up to 432 GB of HBM4 memory per GPU, per Startup Fortune. Oracle Cloud Infrastructure committed to 50,000 MI450 GPUs starting in 2026. That is the largest single public cloud commitment to AMD accelerators to date.

For practitioners, the AMD story is about supply and price. A second vendor shipping rack-scale systems at volume puts pressure on GPU rental rates and on the per-token prices labs charge. It also raises the stakes for software portability. Code that assumes one vendor's kernels and libraries now leaves money on the table. Open formats help here too. A query engine reading Arrow buffers and Parquet files does not care which accelerator sits under it.

Memory Is the Real Bottleneck

The supply chain reports this week point to memory, not compute, as the gating factor. Samsung reportedly concluded pricing negotiations for its 2027 high-bandwidth memory (HBM) supply and targets volume production of HBM4E in the first half of 2027, per a November 4 industry brief. The same brief cites a reported multi-year agreement with AMD covering HBM4 and standard DRAM.

Base dies are the newer pressure point. An HBM stack sits on a logic base die, and next-generation designs customize that die per customer. Reports say Samsung's Taylor, Texas Fab 2 plans to dedicate most of its planned HBM base-die capacity to AMD, with equipment move-in in 2029 and volume production in 2030. Separate reports say NVIDIA has asked for its custom HBM base dies to be built at TSMC, per a November 3 industry brief. Treat both as reports, not confirmed contracts. The direction is clear either way. Memory capacity is being locked up years in advance, and the customization of base dies ties each memory supplier more tightly to each chip designer.

Analysts also flagged HBM supply as the main near-term risk to AMD's own GPU shipments, per TradingKey. When memory is scarce, waste at the model and data layers stops being a rounding error. A model that uses 47% fewer tokens per task, as Mistral claims for Large 4, needs less KV cache per request. A context-handling feature like message threads does not cut tokens, but it cuts transfer and wait time. Every layer of the stack is now being judged on how much memory it wastes.

Power is the other constraint. The same November 4 brief reports that NVIDIA is working with utilities to explore throttling data center power draw during grid peaks. Treat that as a report until NVIDIA describes it publicly. The idea is sound either way. A training cluster that can shed load for an hour when the grid strains is easier to permit and cheaper to connect than one that demands a fixed peak.

What the Infrastructure News Means for Buyers

Three practical points come out of this week's numbers. First, accelerator choice is widening. AMD shipping rack-scale MI450 systems at volume, with a major public cloud commitment behind them, means more capacity on the market in 2027 and more pricing pressure on hosted inference. Second, memory shortages will shape what gets built. Models and serving stacks that cut KV cache use, and data formats that let engines read less, buy real capacity when HBM is booked years ahead. Third, portability now has a dollar value. Workloads tied to one vendor's kernels cannot follow the best price, while engines built on open in-memory formats like Apache Arrow move between accelerators with far less friction.

Formats and Accelerators Meet in the Lakehouse

Two Apache threads this week show where accelerated hardware meets open data formats. On the Iceberg list, the TornadoVM team shared a proof of concept for GPU-accelerated merge-on-read scans and table maintenance built on Iceberg 1.12 public APIs. TornadoVM compiles plain Java methods into GPU kernels. The team reports 3.9x to 4.8x faster merge-on-read scans at 5 billion rows on two A10 GPUs versus 128 CPU threads. It also reports converting equality deletes to deletion vectors 106x cheaper than Spark compaction on TPC-DS SF100. Those are the project's own numbers. The interesting design choice is that Iceberg still plans and commits every change. The GPU only does the per-row work in between.

On the Parquet list, Jiayi Wang posted a revised proposal for the Parquet Modular Footer. It stops treating row groups as physical boundaries and defines statistics over row ranges instead. Julien Le Dem called it "fairly transformational." A footer that describes columns independently makes it easier for readers to fetch only the metadata they need, which matters for wide AI feature tables with thousands of columns.

The Python Data Stack Gets Funded and Patched

One more infrastructure item sits under nearly every AI data pipeline. Germany's Sovereign Tech Agency contracted research and development work for PyArrow, the Python library that moves columnar data between Pandas, Polars, DuckDB, Spark and most model-training data loaders. The contract funds an average of 1.9 full-time engineers through the rest of 2026 and all of 2027, aimed at work no corporate sponsor wanted to pay for. The first target is PyArrow type annotations, which help both human developers and coding agents write correct code against the library.

The same week, Apache Arrow released version 26.0.1. The patch bundles Brotli 1.2.1, replacing a statically linked Brotli 1.0.9 affected by CVE-2026-111497, as a user asked on the list. If you ship PyArrow inside a container or a product, rebuild on 26.0.1. Arrow is also preparing a vote on a canonical FILE extension type, the in-memory partner to Parquet's FILE logical type, so engines can pass references to images, audio and documents without custom glue.

Practitioner Takeaways

• Plan for gated frontier models. The strongest model from each major lab now reaches vetted security partners first. Build your roadmap on what you can call today, and treat announcements as previews.
• Price open weights by total cost. Mistral Large 4 is free to download, but serving it needs serious hardware, and its license limits who can host it for you.
• Cut wasted context. Message threads lower latency without lowering tokens. Pair them with tighter tool results, so agents carry less text from turn to turn.
• Audit trust boundaries. Embedded browsers, CI triggers and agent harnesses all moved this week because untrusted input reached privileged code. Look for the same pattern in your own agent tools.
• Standardize the data layer. Typed vectors in Parquet, AI functions in Iceberg and portable metrics in Ossie give agents data they can use without guessing. Push your vendors toward these open standards.

The Data Layer Tie-In

Every section above lands on the same question: does the agent understand the data it touches? NVIDIA's Agent Knowledge Foundation, announced at GTC Berlin on October 21, gives one answer. It bundles retrieval models, a new Auto Ontology library and models for structured data, per The New Stack. Auto Ontology is an Apache 2.0 framework that builds a graph-based semantic layer over databases so agents generate SQL with approved definitions and lineage. It exposes that context through an MCP server, a CLI and a REST API.

The open lakehouse community is working on the same problem from the standards side. Apache Ossie defines a portable semantic model. Apache Polaris contributors are preparing to store and validate Ossie models, and they paused that work so it aligns with Ossie's REST API before anything locks in. Iceberg and Parquet are giving vectors and files first-class types. MCP is the common door agents use to reach all of it.

Put those together and the stack for trustworthy agentic analytics comes into focus. Data sits in open table formats on object storage. A catalog governs access. A semantic layer, described in an open standard, tells the agent what each metric means and how to compute it. MCP connects the agent to that layer. Each piece is open, and each can be replaced without rewriting the others. That is the outcome worth pushing for, because the alternative is a semantic layer locked inside one vendor's agent.

What to Watch Next Week

GitHub's first pull_request_target brownout hits on November 9, so expect failed CI runs on public repos that have not migrated. Ossie's lazy consensus on ROUND and division closes the same day. Copilot's model retirements and the second brownout both land on November 16. Watch Google's Gemini API changelog for the first gemini-4-carbon entry, since that, not the announcement, is when Carbon becomes something you can build on. Watch for independent benchmark replication of Mistral Large 4's coding and token-savings claims. And watch the Parquet FINITE_VECTOR vote, which resets its 72-hour clock on the revised commit. Argon's introductory $2 and $10 pricing also ends November 30, so budget for whatever comes next.

---

Keep Learning

The tools change every week, but the foundations under them move slower. If you want to go deeper on agentic AI, AI-assisted development, MCP, and the open lakehouse that gives agents trustworthy data, you can find all of my books at books.alexmerced.com.