October 28 agent guide: Copilot MCP connectors and Gemini 4 Carbon

October 28, 2026 is a connector-and-access day, not a general model-swap day. GitHub published verified MCP connectors so Copilot can reuse one connection across the app, CLI, VS Code, the cloud agent, and mobile. Google DeepMind introduced Gemini 4 Carbon for cyber defense and long-horizon work, with first access through Fairwind rather than as a default coding model. Gemini Robotics-ER 2, parked from the October 27 guide because the live page date is October 28, stays on a robotics track.

What shipped on October 28

GitHub Copilot verified MCP connectors

GitHub’s October 28 changelog says Copilot can now connect to tools without repeating local MCP setup for each surface. Verified connectors cover 26 services, including Slack, Figma, Notion, Sentry, Linear, Atlassian Rovo, Cloudflare, Vercel, and Microsoft 365 Copilot Work IQ. After a one-time connect, the same connector is available in the Copilot app, CLI, VS Code, the cloud agent, and mobile.

A connector that only lives in one developer’s VS Code config is not an organization control. A connector that is created once and then appears on CLI, cloud, and mobile is a shared tool contract. The docs still draw a hard line: these connectors are not available in GitHub Actions sessions. A CI job that needs the same tools still needs a different, audited path.

Organization policy is the real gate

GitHub’s connector documentation lists two organization settings that must be on: Copilot Editor preview features, and MCP servers in Copilot. If the organization uses Registry-only MCP policy, verified connectors are blocked. An allowlist must include the connector URLs, not only a private registry of in-house servers. Pick one connector the team already uses, such as Linear or Sentry, then confirm CLI and cloud agent against the same ticket. Background: /blog/github-copilot-argon-managed-settings-agent-hooks-october-2026 and /blog/mcp-enterprise-managed-authorization-ema-guide.

Gemini 4 Carbon is a defender model, not a default coding lane

Google DeepMind announced Gemini 4 Carbon on October 28 as its next frontier model, with the strongest stated results on cyber defense and long-horizon tasks. DeepMind reports an Artificial Analysis Intelligence Index v5.0 score of 59. On security evals it reports SEC-bench Pro at 88.2 percent, ExploitGym at 54.8 percent, and CWE-bench at 71.0 percent. It also reports 0.0 percent success on an indirect prompt-injection test (IPI) and 0.0 percent cheat success on Terminal-Bench 4.0. Those figures are vendor-reported.

Access is the routing change. DeepMind says Carbon starts with a subset of cyber defenders through Fairwind. Introductory pricing is listed at $2 input and $10 output per million tokens, with cached input at 95 percent off, then $4 input and $20 output after the intro period. Keep Carbon next to, not instead of, the Gemini 4 Argon routing notes. If a security operations team is in the Fairwind path, define a separate defender agent with a sandbox and an injection eval. Routing context: /blog/gemini-4-argon-agent-routing-2026.

Gemini Robotics-ER 2, parked from October 27

The October 27 guide left Gemini Robotics-ER 2 out because the live page date is October 28. Google Cloud describes a public preview of Gemini Robotics embodied reasoning 2, with the model id gemini-robotics-er-2-preview. It is an embodied-reasoning preview for robotics workloads, not a replacement for Copilot connectors, Carbon, or a coding agent.

Pilot steps

1. 01
   Prove one Copilot connector

   Enable Editor preview and MCP servers for a non-production organization. Add one verified connector URL to the allowlist. Connect Linear or Sentry on one seat, then confirm CLI and the cloud agent. Stop if GitHub Actions was the intended surface.
2. 02
   Keep Carbon on a defender track

   If the security team is in the Fairwind path, stand up a separate agent with a sandbox and an injection eval. Do not change the default coding model. If there is no Fairwind access, leave Carbon off the routing table.

Common mistakes

• Assuming Copilot verified connectors work in GitHub Actions. GitHub says they do not.
• Leaving Registry-only MCP policy in place and expecting connectors to appear.
• Routing product coding agents to Gemini 4 Carbon because the Intelligence Index is 59.
• Folding Gemini Robotics-ER 2 into the software-agent default.

Conclusion

October 28 added a shared Copilot MCP contract and a gated Gemini cyber model. The useful order is connector policy, then a Fairwind-only defender lane. The October 29 marketplace incident and Large 4 weights are a different day’s work.

Related reading

• October 29: Cursor marketplace incident and Mistral Large 4 weights: /blog/october-29-cursor-marketplace-mistral-large-4-2026
• October 27 agent guide: Copilot SDK identity, LFM3, and Genie 4: /blog/october-27-agent-guide-copilot-sdk-lfm3-2026
• MCP enterprise-managed authorization: /blog/mcp-enterprise-managed-authorization-ema-guide
• Copilot managed settings and agent hooks: /blog/github-copilot-argon-managed-settings-agent-hooks-october-2026
• Gemini 4 Argon routing: /blog/gemini-4-argon-agent-routing-2026
• MCP topic map: /topics/mcp

Need this connector policy applied to a production stack?

Bacancy Technology reviews MCP allowlists and defender-model routing against the systems a team already runs. Speak with the consulting team or use the contact form. Consulting: /consulting/ . Contact: /contact/ .

Sources: GitHub Changelog, October 28, 2026, github.blog . GitHub Copilot connector docs, GitHub . Google DeepMind, October 28, 2026, deepmind.google — gemini 4 carbon our next frontier model . Google Cloud, Gemini Robotics-ER 2, Google Cloud docs .