Gemini 4 Launches; Host Chooses Trust Over Performance in Model Selection

Full analysis

Google shipped Gemini 4, and it is good. Competitive with the best from OpenAI and Anthropic, by Nathan Labenz's read. And he still won't put it in his autonomous agent stack. His reason is the interesting part: not that Gemini 4 is slower or dumber, but that it is easier to jailbreak, meaning easier for an attacker to slip a malicious instruction into the model's input and make it do something it shouldn't. For a reader running agents that call tools and touch real systems, that is a buying criterion that benchmarks don't capture.

This is easy to undo, which matters. Nobody is signing a three-year contract here. Swapping a model in an agent pipeline is a config change and a weekend of eval work. There is no deadline either. The question isn't "do I switch today" but "what do I actually test before I trust a model to run unsupervised." That is the thing worth deciding.

The Skeptic

"Back in the game" is a phrase Google has earned and squandered twice in 18 months. Strong launch, polite enterprise interest, then the stack stays put. So let's be careful about what Gemini 4 actually changes. Labenz is one thoughtful practitioner with one agent stack. That is an anecdote, not a market. And jailbreak-resistance is a convenient reason to never switch anything, because you can always invoke security to justify staying where you are. The Adam Gleave research matters only if it holds up as a repeatable, third-party measurement that other operators run themselves. One researcher's finding, surfaced on one podcast, is not yet a market standard.

The Safety Lens

Here is what's genuinely new: an operator chose a model on resistance to attack, not capability, and said so plainly. That is how safety properties get real traction. Not through the EU AI Act or an executive order, but through builders discovering that "safe enough to run without a human watching" is a product requirement they will pay for. Gleave's ranking puts OpenAI and Anthropic ahead of Gemini, and Gemini well ahead of Grok. If that ordering sticks, xAI's Grok gets quietly locked out of any agent pipeline that touches money or data, regardless of its benchmark scores. Google's safety report alongside the launch is the right instinct and the wrong tool. A PDF published on launch day is marketing. Jailbreak hardening is an engineering program. The two are not the same, and buyers will learn to tell them apart.

The Compute Pragmatist

Everyone is reading this as a capability story. The money story is inference cost. Google runs its own TPU chips, its custom silicon for running these models, which means it can price Gemini 4 on Vertex well below what OpenAI and Anthropic pay to serve a token. The jailbreak gap is real, but it is a software property. You can harden a model against prompt injection with more training and better input filtering far faster than you can close a raw capability gap. So Google's play doesn't require winning the trust argument this quarter. It requires making Gemini 4 cheap enough that cost-sensitive, lower-stakes work, the batch jobs, the content generation, the stuff that isn't touching your production systems, migrates over while Google buys time to close the robustness delta. Trust-maxing describes the agentic tip of the market. Most tokens aren't agentic.

The Builder

The switching math has flipped and Labenz said it out loud. It used to be "does the new model score higher." Now it's "does this model add new ways for an attacker to hijack my tool-use chain." Prompt injection is the thing that wakes the on-call engineer at 3 AM, not a half-point on a reasoning benchmark. Gemini 4 being equal on capability but weaker on attack resistance is exactly the asymmetry that keeps the incumbent model glued in place. The quote nails the mechanism: once performance is "really, really good" across the board, the marginal benchmark gain isn't worth the risk of a fresh attack surface. Expect real agentic adoption of Gemini 4 to trail its launch headlines by months, even where it tests as the better model.

Where they disagree

The real split is between the Compute Pragmatist and the Builder, and it's about which market Gemini 4 is fighting for. The Builder says agentic workloads stay sticky because attack resistance now outranks capability, so Gemini 4 lags on the exact workloads that generate the most revenue per token. The Compute Pragmatist says that's a small slice, and Google wins the large, cheap, low-stakes middle on price while patching its way toward trust. Both can be right at once: Google takes volume on batch and content work, loses the unsupervised-agent tier, and the robustness gap decides which pool is bigger a year from now.

The second disagreement is the Skeptic against the Safety Lens on whether Gleave's research is a trend or a tweet. The Safety Lens thinks operationalized jailbreak-resistance is a durable second axis of evaluation. The Skeptic thinks it's one finding on one podcast until independent operators reproduce it and publish numbers.

What it hinges on

Whether jailbreak-resistance becomes a measurement operators actually run, the way they run capability evals today. If a credible third party publishes a standing, repeatable leaderboard for prompt-injection and jailbreak resistance across the frontier models, then Gemini's gap becomes a line item buyers weigh against price, and Google has to fund hardening as a real program. If it stays one researcher's citation, Google prices its way past the whole conversation. Before trusting any model in an unsupervised agent loop, build your own prompt-injection test set against your actual tool chain and run every candidate model through it. That is the eval that matters now, and almost nobody has it.

Prediction: Before Google's next flagship Gemini release (Gemini 4.5 or 5), Google will publicly promote a specific, quantified prompt-injection or jailbreak-resistance metric for a Gemini model as a named selling point, not just a launch-day safety PDF.

Confidence: Medium. The buying signal is now explicit, and Google has the fastest lever to close a software gap.

Why: Labenz naming attack resistance as the reason a capable model stays out of his agent stack is the demand signal, and he cited a specific researcher's ranking that puts Gemini behind OpenAI and Anthropic. That ranking is a sales problem Google can see, and jailbreak resistance is a software property you harden with training and input filtering far faster than you close a raw capability gap, so Google has both the motive and the quickest tool to respond. The alternative, Google ignoring a named weakness that is now gating its highest-value agentic use cases, runs against how it has chased every other competitive gap, publishing benchmark comparisons the moment it has a number to brag about. The opposite outcome, another launch-day safety PDF with no quantified robustness claim, is the less likely path once a measurable gap is costing it the agent tier.

Revisit by 2027-06-30: We're right if Google's next flagship Gemini launch materials or an official Google post feature a specific numeric prompt-injection or jailbreak-resistance figure as a selling point for the model. We're wrong if the next flagship Gemini ships with only a general safety report and no quantified robustness metric promoted for the model.