Gemini 4 Carbon launches as banks lock out outside AI agents

The most interesting thing in today's news isn't a model launch. It's a quiet collision between two ideas about who gets to act on your behalf, and the banks are standing right in the middle of it.

Start with the banks. At least five of them, including JPMorganChase, Citi, Bank of America, Wells Fargo and Morgan Stanley, are now blocking external AI agents from reaching customer accounts. I understand the instinct: if a client's agent can move money, you want to know exactly who authorised what. But I doubt the wall holds. Customers are already deploying personal agents that want to check balances, dispute charges and shift funds, and a bank that says no to all of them is effectively telling customers their assistant isn't welcome. One of today's pieces frames this as banking in an agent-to-agent world, where the client's AI is the counterparty. I think that framing is right, and it implies the real competition won't be about who has the smartest agent. It will be about who offers the best governance: clear permissions, clean audit trails, and the ability to prove what an agent did and why.

By the way, that is exactly the problem the tooling side is starting to address. The new Agent Activity feature traces every step of an agent session, including prompts, MCP and tool calls, read and write access, and contact with sensitive data. That is the kind of visibility a bank would need before it opens the door even a crack. Meanwhile, Project Quarry proposes a shared vocabulary for defending agents, which strikes me as more important than it sounds. Attacks on agents rarely look like attacks. They unfold across many ordinary, individually permitted steps, and most current defences are built to catch the single obviously bad action. You can't defend against something you lack words to describe, so a common language is a sensible place to start, even if it's unglamorous work.

Google, meanwhile, has launched Gemini 4 Carbon, pitched as a frontier model that excels at complex programming tasks and ships with stronger cybersecurity features. What stands out to me is the cadence: it arrives just two weeks after the previous release. I'm cautious about reading too much into any single launch at that pace. The more useful lesson comes from the Amazon Bedrock AgentCore piece, which makes a point I keep seeing in practice: when agents fail to reach production, the model and tool use are rarely the obstacle. The bottleneck is the surrounding infrastructure and how many teams have to coordinate around it. A better model doesn't fix that.

Then there's the long view. Demis Hassabis has been musing about whether AI could one day let us program the physical world much as we program computers. It's speculative, and I'd treat it as a thought experiment rather than a roadmap. Still, it's a useful contrast. We are struggling to safely let software agents touch a bank account, so how ready are we to hand them matter itself?

My guess is that the answer to the bank question comes first, and that it will set the template for everything after: trust won't come from smarter agents, but from agents we can see, constrain and audit.