The report
Google introduced Gemini 4 Hydrogen on November 12 as a lower-cost execution-oriented model for agent workflows, alongside Antigravity Orchestrator support for assigning different model roles inside one task. The security consequence is not a demonstrated vulnerability in Hydrogen. It is a new place where an orchestration system must preserve context ownership, tool permissions and credential selection while passing work between models.
A longer context is not a larger authorization grant
Google's release account prices Hydrogen at $1.50 per million input tokens and $7.50 per million output tokens across its stated context tier. Its published model documentation distinguishes a roughly one-million-token combined context from limits on individual output segments. Google also reports favorable results on selected coding and agent benchmarks and says Orchestrator can use Hydrogen for execution while a stronger model handles higher-level judgment. These are first-party measurements and design choices, not an independent comparison with fixed effort, tools and verified end effects.
A model transition creates at least three questions. First, which parts of the preceding conversation or retrieved data move to the next model or provider? Second, does the new worker inherit only the authorization needed for its subtask, or also credentials and tools granted to a broader parent? Third, can a revocation or a changed task policy prevent a queued worker from completing an old command? An orchestrator may preserve the words of a task perfectly and still fail these permission checks.
A smaller delegate can still hold a powerful key
A known example of delegation error is the llm Responses credential fallback case. A wrapper created a new model delegate without carrying the intended credential setting forward, allowing an unrelated OpenAI key to be selected for a custom endpoint. That flaw is not a reported Gemini Hydrogen exploit, but it identifies the kind of handoff invariant a multi-model harness has to enforce. The document-retrieval authorization case supplies an analogous warning for retrieved inputs.
An informative model-switching test should log the initial user's permitted action, which worker and model received each data item, which credential was actually sent to each provider, and the committed tool effect. It should also repeat the task after revocation and under failed or delayed worker execution. Tokens per task and leaderboard ranks remain relevant performance measures, but neither answers whether the delegated operation stayed within its original authority.