Claude Code:

 

The Terminal Agent That Became a Billion-Dollar Problem—And How to Use It Safely

Published April 2026 | Analysis of Agentic Development Tools in Production

BLUF: Anthropic's Claude Code—launched as a research preview in February 2025 and general availability in May 2025—has become an industry-transforming but security-critical tool. The terminal-native agent reached $1 billion in annualized revenue within six months and may approach $2 billion by early 2026. A March 2026 source code leak exposed 513,000 lines of TypeScript, amplifying known vulnerabilities (CVE-2025-59536, CVE-2026-21852) and spawning malicious repositories. Security best practices emphasize permission boundaries, MCP server vetting, credential isolation, and zero-trust configuration—but success depends on understanding Claude Code as a "brilliant but untrusted intern" with your shell permissions.

The Rise of Agentic Development

When Anthropic quietly launched Claude Code in February 2025, few predicted it would redefine the software development landscape within months. Unlike GitHub Copilot's autocomplete suggestions or traditional IDE plugins, Claude Code runs as a standalone terminal agent—reading your codebase, executing bash commands, modifying files across projects, and pushing to Git repositories without human intervention between each step.

By May 2025, the tool reached general availability alongside Claude 4. Engineers reported a 50% productivity boost, with teams adopting it across major corporations. Stripe deployed the tool to 1,370 engineers. Microsoft reportedly integrated it across major engineering teams. One Google principal engineer at a January 2026 Seattle meetup noted that Claude replicated a year of architectural work in a single hour.

The revenue trajectory tells the story of adoption velocity: $1 billion annualized run rate achieved by November 2025, with analyst estimates suggesting $2 billion by January 2026. Anthropic's overall revenue jumped from roughly $1 billion at the start of 2025 to $5 billion by August, driven substantially by Claude Code's enterprise adoption curve.

Fundamental Architecture: Claude Code operates at the project level, not the token level. It reads the full codebase, plans a sequence of actions across multiple files, executes them using real development tools (bash, git, test runners), evaluates results, and iterates independently. The developer defines the goal and retains control over what ships, but the execution loop runs autonomously.

The March 2026 Source Code Leak: What Happened

On March 31, 2026, Anthropic accidentally exposed the full source code of Claude Code through a JavaScript source map (.map) file in the public npm package @anthropic-ai/claude-code version 2.1.88. The 59.8 MB file contained approximately 513,000 lines of unobfuscated TypeScript across 1,906 files, revealing the complete client-side agent harness.

Security researcher Chaofan Shou (@Fried_rice) disclosed the leak publicly on X, triggering immediate viral spread. Within hours, the codebase was downloaded from Anthropic's Cloudflare R2 bucket, mirrored to GitHub, and forked tens of thousands of times. Threat actors gained full visibility into:

• Hook execution logic and permission bypass patterns
• MCP server integration points and trust boundaries
• API key handling and environment variable parsing
• Sandbox escape vectors and privilege escalation paths

The leak coincided exactly with a separate malicious Axios npm supply chain attack (RATs published March 31, 00:21–03:29 UTC), creating what security researchers called "a perfect storm for anyone updating Claude Code via npm that day." Zscaler's ThreatLabz team documented malicious GitHub repositories using leaked source code as lures, with ".7z" archives claiming to contain "unlocked enterprise features and no message limits."

Known Vulnerabilities: CVEs in the Wild

Prior to the leak, Anthropic patched two critical vulnerabilities discovered by Check Point Research and reported between July and December 2025:

CVE ID	CVSS Score	Impact	Attack Vector	Patched
CVE-2025-59536	8.7	Remote Code Execution	Project-contained code execution before trust dialog	Before Feb 2026 publication
CVE-2026-21852	8.9	API Key Exfiltration	ANTHROPIC_BASE_URL override redirecting traffic	Before Feb 2026 publication
CVE-2025-55284	7.2	DNS Exfiltration	API key theft via DNS side-channel	Version-specific

The threat model is straightforward: an attacker crafts a malicious repository with poisoned `.claude/` config files, hooks, or `.mcp.json` settings. When a developer clones the repo and opens Claude Code, malicious hooks trigger arbitrary shell execution or credential theft—sometimes before the trust dialog is confirmed. The vulnerability surface expanded dramatically post-leak, as threat actors gained source visibility to identify precise exploitation paths.

The Resource Bible: Extracted Claude Code Guidelines

The Claude Code Resource Bible image you provided consolidates essential references across six categories. Here's what the landscape includes:

Official Documentation & Architecture

• Official Docs: Complete CLI documentation and architecture guides
• Partner Network: Anthropic's enterprise adoption program
• Certification: Claude Certified Architect pathway
• MCP Server Repo: Official Model Context Protocol servers

MCP Servers: The Integration Layer

The Model Context Protocol enables Claude Code to interact with external systems—GitHub, Slack, databases, APIs. The resource guide catalogs 15+ official MCP servers, but this is where security hinges. Each MCP server is a potential exfiltration vector:

MCP Server Security Checklist:

• Vet every MCP server before enabling—verify source origin
• Store allowed servers in `.mcp.json` under source control
• Use deny-lists aggressively to block risky integrations
• Never auto-approve servers on session start
• Monitor MCP tool result sizes to prevent truncation bypasses
• Verify that Postgres, Slack, GitHub, and Firewall MCP servers are up-to-date

Terminal Multiplexers & Agent Frameworks

Advanced configurations include tmux, GNU screen, and custom agent orchestration via the Claude Agent SDK. Teams delegate specialized subtasks through subagents—frontend development while the main agent builds a backend API in parallel. The new Checkpoints feature lets you maintain control over delegated work.

Automation & Infrastructure

Recent releases introduced hooks (PreToolUse, PostToolUse), background tasks, and scheduled execution. Hooks are pattern-matching shell scripts that intercept Claude Code actions before execution. They are not a security boundary—they are guardrails, not walls. Sophisticated prompt injection can still escape them, but they provide meaningful defense-in-depth.

Security Best Practices: The Hard-Won Lessons

1. Default to Cautious Permission Mode

Claude Code's default is read-only. When additional actions are needed (editing files, running commands, executing bash), it requests explicit permission. You control whether to approve actions once or automatically per-session. Never enable auto-mode by default across your fleet. Auto-mode is research preview for good reason.

# Launch Claude Code in cautious mode (default) claude # Opt-in to auto-mode research preview (not recommended for prod) claude --enable-auto-mode # Check current mode /mode

2. Enforce Sandbox Boundaries

Claude Code can only write to the folder where it was started and its subfolders. It cannot modify files in parent directories without explicit permission. However, it can read files outside the working directory—a necessary design for accessing system libraries and dependencies. This creates an asymmetry: read operations are broad, write operations are confined.

Sandbox Configuration: Use `/sandbox` to define explicit boundaries where Claude Code can work autonomously. Specify filesystem and network isolation explicitly.

3. Credential Hygiene: The Critical Gap

Claude Code processes context and code through Anthropic servers via TLS. Without proper configuration, it can read `.env` files, SSH keys, AWS credentials, and GitHub tokens. Researchers identified that AI agents leak credential-like strings from context windows at scale. Several hardening frameworks recommend:

• Credential Scrubbing Hooks: Strip credential patterns from transcripts and snapshots
• Transcript Retention Limits: Keep retention to 7–14 days, not indefinite
• API Key Proxy: Use scoped credentials inside sandboxes, translated to your actual GitHub token
• Environment Variable Isolation: Never export secrets directly; use credential helpers
• PreToolUse Hooks: Block pipe-to-shell, destructive deletes, and permission bypass flags before execution

4. Repo-Controlled Configuration as a Trust Boundary

Your Claude Code project settings live in `.claude/` and MCP servers in `.mcp.json`—both checked into source control. This design enables team consistency but introduces a critical attack surface. Anthropic's own documentation assumes these files are guarded by a trust boundary. They are exactly what attackers will poison.

Repository Security:

• Never accept pull requests that modify `.claude/` or `.mcp.json` without manual review
• Use branch protection rules to require code owner approval for config changes
• Scan for invisible Unicode in config files (CVE disclosure included hidden characters)
• Disable all hooks by default; enable only explicitly safe hooks

5. Privilege Escalation Prevention

Do not run your daily workstation as an admin user. If your account has admin privileges during normal operations, every process you launch—including Claude Code and all subagents—inherits those elevated permissions. A prompt injection that would be contained under a standard user becomes a full system compromise under admin. Log in as a standard user. Elevate with sudo only when necessary.

6. Supply Chain Protection

Claude Code can manage dependencies, add npm packages, and run lifecycle scripts. Attackers exploiting tools like Claude Code can introduce trojanized packages with postinstall scripts that exfiltrate credentials. Implement:

• Package scanning before installation (Software Composition Analysis)
• Lifecycle script lockdown—prevent npm scripts from running silently
• CVE auditing with automated blocking of known vulnerable versions
• Network isolation for package downloads (use internal registries where possible)

7. Code Review & Human Oversight

Developer surveys show engineers delegate only 0–20% of work fully to Claude Code; the rest requires human review. Teams with strong test-driven development practices see the greatest benefits. Organizations using agents as shortcuts to skip security review struggle significantly.

Governance Pattern: Treat Claude Code as a "brilliant but untrusted intern"—capable of excellent work but requiring human review of all security-critical changes. Require approval for code touching authentication, encryption, credential handling, or database schema changes.

Advanced Hardening: Seven Phases of Defense

Recent research by Tim McAllister (February 2026) codified a seven-phase hardening framework implemented through Claude Code itself—using the agent to audit and secure its own environment:

1. Security Assessment: Inventory current state: processes, MCP servers, credentials, permissions, endpoint protections
2. Pre-Execution Gate: PreToolUse hook blocking dangerous commands before execution (pipe-to-shell, destructive deletes, credential exfiltration patterns, permission bypass flags)
3. Supply Chain Protection: Package scanning, lifecycle script lockdown, CVE auditing
4. File-Level Malware Scanning: ClamAV integration with automated definition updates and scheduled scans
5. Credential Hygiene: Transcript scrubbing, snapshot pruning, credential removal from config files
6. Hook Compliance Verification: Confirm hooks execute as expected and log all pre-execution gates
7. Maintenance Scheduling: Document protections mapped to attack vectors, maintenance schedule, version verification procedures

Each phase stands independently and requires explicit approval before making changes. The output is a comprehensive security document mapping protections to known attack vectors.

Governance at Scale: Enterprise Configuration

For organizations deploying Claude Code across hundreds of engineers, Anthropic provides enterprise-grade controls:

Managed Settings & Policy Enforcement

managed-settings.json enables organization-wide policies that cannot be overridden by individual developers. Policies can enforce:

• Permission modes (cautious vs. auto)
• Allowed MCP servers at the org level
• Sandbox boundaries and isolation requirements
• Audit logging and transcript retention periods
• Forbidden commands and file patterns

Audit Logging & Compliance

Enterprise organizations can export audit logs (metadata-based; chat/project titles and content are not included in exports). SOC 2 Type II certification is available under NDA. However, organizations must still run their own access management and vendor-risk controls—Anthropic's compliance certifications are necessary but not sufficient.

Zero-Data-Retention (ZDR) Mode

For processing PHI (Protected Health Information) or other regulated data, Claude Code offers ZDR mode (requires Enterprise plan addendum). ZDR prevents code and context from being retained on Anthropic servers beyond inference time.

Network Isolation via Cloud Providers

Deploying Claude Code via AWS Bedrock or Google Vertex AI improves network control—traffic avoids the public internet while still using managed cloud services. Organizations concerned about data residency or network exfiltration should evaluate these deployment models.

The Open-Source Security Response: Claude Secure Coding Rules

The community has begun encoding security expertise as declarative rules. The Claude Secure Coding Rules project (GitHub: TikiTribe/claude-secure-coding-rules) provides 100+ open-source rule sets covering OWASP, AI/ML, RAG, Infrastructure-as-Code, containers, and CI/CD. Rules are organized hierarchically:

Level	Scope	Override Priority	Purpose
Project-level	Entire codebase	Highest	Org-wide security policies
Directory-level	Specific directories	Medium	Domain-specific constraints (e.g., FinTech)
Global defaults	Fallback rules	Lowest	Framework-level best practices

Rules are also tiered by enforcement:

• Strict: Claude Code refuses to generate the code
• Warning: Claude Code generates it but flags the risk
• Info: Informational guidance, no blocking

What Success Looks Like: Adoption Patterns

Organizations realizing the greatest productivity gains share common traits:

• Test-Driven Development (TDD): Teams with strong testing practices see immediate ROI. Claude Code iterates until tests pass, enabling autonomous completion of entire features.
• Clear Architectural Boundaries: Well-documented system design helps Claude Code plan changes correctly and avoid cascading failures.
• Strong Code Review Culture: Successful teams use Claude Code to generate diffs and run CI, but retain human approval for merge decisions.
• Explicit Delegation Patterns: Teams that use the `/code-review` multi-agent PR analysis and parallel subagent execution see the highest throughput.

Microsoft's internal adoption and Stripe's 1,370-engineer rollout both emphasize that engineers are shifting focus: less time writing boilerplate, more time on architecture, product decisions, and continuous orchestration of multiple agents in parallel.

The Unsolved Problem: Prompt Injection at Scale

Despite hardening frameworks, prompt injection remains the fundamental unsolved problem. In March 2026, Unit 42 documented web-based indirect prompt injection observed in the wild, with several confirmed cases of attackers poisoning prompts through:

• Malicious commit messages and pull request descriptions
• Crafted error messages in code or logs
• Embedded prompts in documentation or comments
• API responses from third-party services integrated via MCP

The Check Point Research disclosure (February 25, 2026) noted that hooks are "pattern-matching shell scripts, not a security boundary." A sophisticated prompt injection can still find ways around hooks. They provide meaningful defense-in-depth, but organizations should view them as guardrails, not walls.

Looking Forward: The Autumn 2026 Roadmap

Anthropic has signaled several upcoming capabilities:

• VS Code Extension (Beta): Inline diffs, @-mentions, plan review, and conversation history directly in the editor
• Enhanced Orchestration: Improved subagent delegation with better context sharing and result merging
• Security-Focused Features: Claude Code Security (launched February 2026) performs vulnerability scanning on codebases proactively
• Expanded Model Support: Latest releases default to Claude Sonnet 4.5, with option to use Claude Opus 4.6 for complex tasks

Conclusion: Agentic Development as Infrastructure

Claude Code represents a fundamental shift in how software gets written. It is not a copilot or a chat interface—it is an agentic system operating in your terminal with your shell permissions. The billion-dollar adoption curve reflects genuine productivity gains, but the March 2026 source code leak and documented CVEs demonstrate that security is not optional.

Organizations deploying Claude Code should:

1. Treat it as infrastructure, not a convenience tool. Apply governance standards used for CI/CD systems.
2. Implement defense-in-depth across seven categories: permissions, MCP vetting, credential isolation, supply chain protection, hooks, audit logging, and human oversight.
3. Never run as admin. Isolate Claude Code in sandboxes or VMs when working with untrusted repositories.
4. Vet config files as trust boundaries. Protect `.claude/` and `.mcp.json` like you protect IAM policies.
5. Embrace human review. Delegate 0–20% of work fully to the agent; iterate and collaborate on the rest.
6. Update aggressively. Track Anthropic's security releases and patch CVEs immediately.

The tool is powerful. The threat model is real. The payoff is substantial—but only if you build security into your deployment from day one.

---

Verified Sources

[1] Anthropic Claude Code Product Page
"Claude Code is an agentic coding system that reads your codebase, makes changes across files, runs tests, and delivers committed code." Official product documentation and architecture overview.
https://www.anthropic.com/product/claude-code
Accessed April 12, 2026.

[2] Claude Code Official Documentation - Overview
"Claude Code is an agentic coding tool that reads your codebase, edits files, runs commands, and integrates with your development tools." Complete CLI reference and feature guide.
https://code.claude.com/docs/en/overview
Accessed April 13, 2026 (17 hours ago per metadata).

[3] GitHub Repository - anthropics/claude-code
"Claude Code is an agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster by executing routine tasks, explaining complex code, and handling git workflows." Public GitHub repository with issue tracking and plugin architecture documentation.
https://github.com/anthropics/claude-code
Latest release: April 12, 2026.

[4] Anthropic News - "Enabling Claude Code to Work More Autonomously"
Details on checkpointing, subagents, hooks, background tasks, and Claude Sonnet 4.5 as default model. Includes Claude Agent SDK announcements and partner network launch.
https://www.anthropic.com/news/enabling-claude-code-to-work-more-autonomously
Published 2026.

[5] Shawn Kanungo - "Claude Code Explained: The Future of Agentic Coding"
"By November 2025, Claude Code had surpassed $1 billion in annualised revenue. By early 2026, analysts estimate the run rate is closer to $2 billion." Comprehensive financial analysis and adoption metrics.
https://shawnkanungo.com/blog/what-is-claude-code-and-why-everyone-is-talking-about-it
Published February 23, 2026.

[6] Zscaler ThreatLabz - "Anthropic Claude Code Leak"
"On March 31, 2026, Anthropic accidentally exposed the full source code of Claude Code through a 59.8 MB JavaScript source map (.map) file...The leaked file contained approximately 513,000 lines of unobfuscated TypeScript across 1,906 files." Detailed security analysis of the leak, CVE implications, and malicious repository threats.
https://www.zscaler.com/blogs/security-research/anthropic-claude-code-leak
Published April 9, 2026 (3 days ago).

[7] Claude Code Official Security Documentation
"Claude Code uses strict read-only permissions by default. When additional actions are needed (editing files, running tests, executing commands), Claude Code requests explicit permission." Permission architecture, sandbox boundaries, and credential protection.
https://code.claude.com/docs/en/security
Updated within 12 hours of April 13, 2026.

[8] Backslash Security - "Claude Code Security Best Practices"
"A single poisoned prompt or misconfigured setting can turn Claude Code from your coding partner into a threat actor." Comprehensive hardening guidance including hook configuration, MCP server vetting, and deny-list strategies.
https://www.backslash.security/blog/claude-code-security-best-practices
Published 2026.

[9] Tim McAllister (Medium) - "Hardening Claude Code: A Security Review Framework and the Prompt That Does It For You"
Seven-phase hardening framework implementation: security assessment, pre-execution gates, supply chain protection, malware scanning, credential hygiene, hook verification, maintenance scheduling. Includes discussion of CVE-2025-55284 API key theft and defense-in-depth approach.
https://medium.com/@emergentcap/hardening-claude-code-a-security-review-framework-and-the-prompt-that-does-it-for-you-c546831f2cec
Published February 15, 2026.

[10] Check Point Research - Claude Code Security Disclosures
Detailed analysis of CVE-2025-59536 (Project-contained code execution, CVSS 8.7) and CVE-2026-21852 (API key exfiltration via ANTHROPIC_BASE_URL override, CVSS 8.9). Reported between July–December 2025, patched before February 2026 publication.
Referenced in: affaan-m/everything-claude-code GitHub repository and Zscaler ThreatLabz analysis.
Published February 25, 2026.

[11] Concentric AI - "Claude Security Guide 2026"
Comprehensive data governance and organizational security strategy for Claude deployment. Emphasis on data hygiene, permission auditing, and preventing prompt injection via untrusted inputs.
https://concentric.ai/claude-security-guide/
Published/updated April 1, 2026.

[12] RockCyber Musings - "Claude Secure Coding Rules: Open Source Security That Scales"
"100+ rule sets covering OWASP, AI/ML, RAG, IaC, containers, and CI/CD." Overview of community-driven security rule framework for Claude Code.
https://www.rockcybermusings.com/p/claude-secure-coding-rules-open-source-ai-security
Published December 2, 2025.

[13] MintMCP - "Claude Code Security: Enterprise Best Practices & Risk Mitigation"
"Claude Code operates directly in developers' terminals with the same permissions as the user." Enterprise deployment strategies, managed settings, audit logging, and compliance frameworks (SOC 2 Type II, ZDR mode).
https://www.mintmcp.com/blog/claude-code-security
Published December 18, 2025.

[14] affaan-m/everything-claude-code - "The Security Guide"
"With the tooling reaching critical mass, the gravity of exploits multiplies." Analysis of trust boundaries, hook logic testing, CVE-2025-59536 and CVE-2026-21852, and indirect prompt injection (Unit 42, March 3, 2026).
https://github.com/affaan-m/everything-claude-code/blob/main/the-security-guide.md
Updated February 25, 2026.

[15] Wikipedia - Claude (Language Model)
"Claude Code was released in February 2025 as an agentic command line tool...By November 2025, Claude Code reached $1 billion in annualised revenue. Anthropic's overall annualised revenue jumped from roughly $1 billion at the start of 2025 to $5 billion by August." Comprehensive timeline including March 2026 source code leak, threat actor GTG-2002, and model release history.
https://en.wikipedia.org/wiki/Claude_(language_model)
Updated April 12, 2026 (4 hours ago).

[16] SpecterOps - "Leveling Up Secure Code Reviews with Claude Code"
"Claude Code is a force multiplier when performing secure code reviews during an assessment." Methodology for using Claude Code in security assessments, system prompt construction, and avoiding false positives in vulnerability analysis.
https://specterops.io/blog/2026/03/26/leveling-up-secure-code-reviews-with-claude-code/
Published March 26, 2026.

[17] Medium - "The Evolution of Claude Code in 2025" (LM Po)
"Claude Code underwent a remarkable transformation, evolving from a modest terminal-based research preview into a sophisticated multi-agent development platform." Detailed timeline of four development eras throughout 2025 and financial context (4.5x revenue increase following Claude 4 launch).
https://medium.com/@lmpo/the-evolution-of-claude-code-in-2025-a7355dcb7f70
Published January 4, 2026.

[18] GitHub - shanraisshan/claude-code-best-practice
Comprehensive collection of workflow patterns, terminal commands, multi-agent PR analysis, debugging techniques, and architectural best practices for Claude Code deployment. Includes guidance on model selection, context management, and skills-based task delegation.
https://github.com/shanraisshan/claude-code-best-practice
Updated April 11, 2026 (2 days ago).

Order Birth Certificates Online | VitalChek

vitalchek.com

Order Birth Certificates Online | VitalChek

VitalChek – Birth Certificates, Death Certificates, Marriage Records, Divorce Records and Vital Records

---

How VitalChek Works

What Do You Need?

To complete your order smoothly, please have the following information ready:

Personal Details

Full name, date of birth and place of birth.

• Identification:
  Not all orders require this, but you may need a valid government-issued ID (e.g., driver's license, passport).
• Proof of Entitlement:
  Occasionally, we'll need documentation proving your right to access the certificate.
• Payment Method:
  Credit or debit card.

Birth Certificates

Our vital records are certified official documents provided directly by government agencies.

Here's what you can expect on your certificate:

• Accurate and Up-to-date Information:
  All data is verified to ensure accuracy.
• Official Seal and Signatures:
  Each certificate is legally recognized and comes with official seals and signatures directly from the government agency. These can be used for drivers licenses, insurance, travel benefits and more.
• Secure and Confidential:
  Your personal information is handled with the highest security and confidentiality.

Order Birth Certificates Online | VitalChek

VitalChek has partnered with vital record agencies within the United States to bring you the ability to order the vital records you need.

Need a different certificate?

We can also help you obtain your Death, Marriage, Divorce certificates. We can also help if you need certificates from other states. Order your certificate now..

We have direct relationships with state and local government agencies in the United States.

That means we can process your request quickly, affordably, and securely. The only thing faster is doing it in person, but that's not always possible or convenient, and that's why we're here.

Experienced

Authorized

Transparent

Secure

Fast

Hundreds of government agencies nationwide exclusively trust VitalChek for accepting their birth certificates and other vital record orders.

Our easy application process will help you find the right agency and certificate for your specific needs.

Why should you trust VitalChek?

4 million
vital documents processed per year

More than 35 years
of experience

100%
compliance with the highest level PCI standards to protect your personal information

ORDER NOW

 

10 Items Quietly Disappearing From Store Shelves

10 Items Quietly Disappearing From Store Shelves — Most Won't Exist Next Year - YouTube

Disappearing From Store Shelves: An Investigation Into Household Essentials and Supply Chain Realities

BLUF (Bottom Line Up Front):
A recent viral video claims ten household items are "disappearing" and urges consumers to stock up. Our investigation confirms that some of these items do face genuine supply challenges—but the story is more complex than a simple vanishing act. Hazmat shipping regulations and reduced demand have genuinely constrained availability of strike-anywhere matches, and borax faces potential regulatory restrictions in the United States modeled on the European Union's 2010 classification as a reproductive toxicant. However, most of the "critical" items investigated remain readily available through conventional channels, often at lower costs than sensationalized claims suggest.

---

Executive Summary

Over the past five years, we have witnessed documented shifts in retail stock of specific commodity items—notably strike-anywhere matches, which have seen multiple manufacturers including Ohio Blue Tips, Penley, and UCO discontinue production due to hazmat shipping restrictions imposed by FedEx, UPS, and USPS. We also document regulatory pressure on borax and the legitimate multifunctional uses of potassium permanganate. Yet our research reveals that many of the most touted "disappearing" items are either still widely available, available at modest cost, or have been mischaracterized in terms of their emergency utility.

This article presents what we found—grounded in scientific evidence, regulatory filings, and market data—and what consumers actually need to know about supply, efficacy, and regulatory status.

---

Item 1: Activated Charcoal for Poison Treatment

Claim: Activated charcoal powder is a life-saving poison treatment that "the WH recommends" and is being quietly replaced by capsules and removed from retail shelves.

What Research Shows:

Activated charcoal is a form of carbon that can bind other substances onto its surface in a process known as adsorption, and it is effective in adsorbing many types of poison in the gut, so the poison does not enter the body. The World Health Organization includes activated charcoal in its Model List of Essential Medicines, and it is most efficacious when given within one hour of ingestion of the toxin.

However, critical caveats apply. Over-the-counter products might not be as "activated" as the activated charcoal used in the ER, so they would be less effective. Over-the-counter activated charcoal typically comes in 250 mg tablets. Providing the same dose given in an emergency room (50–100 g) would require hundreds of tablets. More importantly, while activated charcoal is a proven treatment for certain severe ingestions in a clinical setting, experts overwhelmingly agree that it is not an effective or recommended home treatment for food poisoning. Additionally, activated charcoal can also bind to foods you have eaten, blocking the absorption of nutrients and medications you may have taken, reducing their effectiveness.

Bottom Line:
Activated charcoal powder does have documented emergency medical use for specific poisonings when administered in a hospital setting under professional guidance. Home use is not recommended by poison control experts. Availability: Still widely available online and through bulk suppliers at modest cost ($10–18 per pound). The claim that it is "disappearing" is not supported by current market data.

---

Item 2: Potassium Permanganate and the DEA Regulation Question

Claim: Potassium permanganate is regulated by the DEA, tracked when purchased in bulk, and "quietly" being removed from retail shelves because of government restrictions.

What Research Shows:

Potassium permanganate is listed as a List II chemical under DEA control, designated as one used in the manufacture of controlled substances. The domestic threshold for potassium permanganate is 55 kilograms, and the import/export threshold is 500 kilograms. The DEA learned that U.S. firms were exporting large quantities of potassium permanganate to cocaine-producing countries, and significant amounts of these chemicals ultimately were diverted to clandestine cocaine laboratories.

However, this chemical control program has been effective in reducing the supply of illicit methamphetamine and cocaine: when the Chemical Diversion and Trafficking Act went into effect in 1989, the quantity of these chemicals shipped to South America from the United States declined greatly.

Regarding the Glycerin-Permanganate Reaction:
The reaction between potassium permanganate and glycerol is highly exothermic, resulting rapidly in a flame, along with the formation of carbon dioxide and water vapor. The reaction can produce a bright, pinkish (lilac) flame for a few seconds, leaving a dark brown or black residue. However, while the potassium permanganate and glycerin reaction is popular in chemical demonstration videos and some survival manuals, it is generally not part of a standard fire-starting kit for most outdoor enthusiasts, and other methods such as friction-based fire making or using commercial fire starters are typically more reliable and less hazardous for everyday use.

Bottom Line:
Potassium permanganate is legal to own and remains available. DEA tracking does occur at the bulk level (over 55 kg domestically), but this does not affect home purchases of small quantities. The chemical does have documented fire-starting properties via glycerin contact, but is rarely recommended as a primary survival fire method. Availability: Online through chemical suppliers, aquarium stores, and veterinary suppliers. Cost: $8–15 per 100–500 gram bottle.

---

Item 3: Strike-Anywhere Matches—A Genuine Market Shift

Claim: Strike-anywhere matches are disappearing; only the Diamond brand remains, and Ohio Blue Tips have been permanently discontinued.

What Research Shows:

This claim is substantially accurate regarding market trends. Ohio Blue Tips, Penley Strike Anywhere Matches, and UCO Strike Anywhere Matches have all been discontinued. The only brand widely available in the US at this time is Diamond Greenlight Strike Anywhere Matches. The primary driver is shipping logistics: Strike anywhere matches are difficult to find and expensive to ship since they could accidentally ignite during shipping. The USPS prohibits shipping strike anywhere matches and both UPS and FedEx require that strike anywhere matches be shipped as hazardous materials and only via ground shipping.

However, Diamond Greenlight Strike Anywhere Kitchen Matches are available through multiple retail channels, including hardware stores, with boxes containing 300 matches and made from responsibly managed forests. Diamond Greenlight Strike Anywhere matches are available for purchase online through Walmart and Amazon.

Quality concerns: Some users report that the newer Diamond Greenlight formulation performs less reliably than older versions. The matches have been reformulated, possibly to circumvent shipping restrictions, which may account for the difficulty in lighting.

Bottom Line:
Strike-anywhere matches have genuinely consolidated to a single major brand due to hazmat regulations, and some older brands have been discontinued. However, Diamond Greenlight matches remain available through major retailers. Availability: Walmart, Amazon, Ace Hardware. Cost: $30–50 for 10 boxes (2,500 matches).

---

Item 4: Kerosene Heating Fuel—A Quiet Decline in Infrastructure

Claim: Gas stations are "ripping out" kerosene pumps due to low demand; the infrastructure is in "death spiral."

What Research Shows:

Kerosene remains a practical fuel for portable heaters, lamps, and cleaning applications, especially during power outages or in off-grid scenarios. While many consumers initially check hardware stores, these retailers often price kerosene at $10 to $15 per gallon. In contrast, numerous gas stations across the United States sell K-1 grade kerosene for just $4 to $5 per gallon.

Market data on station closures is less dramatic than the video claims. While some regional shortages have occurred (particularly during peak heating season or in areas with limited demand), no national shortage has been documented since 2021. In 2022, Maine experienced kerosene supply constraints driven by war in Ukraine and increased jet fuel demand. Despite fears that the Israel-Hamas War and the EU boycott on Russian fuel would lead to gas shortages, no US state experienced a shortage between 2023 and 2025.

Bottom Line:
Kerosene availability is declining in some regions due to low consumer demand and the shift to electric heating, but infrastructure has not collapsed. Seasonal availability and regional variation are real. Availability: Gas stations (check GasBuddy's kerosene locator), Tractor Supply, online suppliers. Cost: $4–5 per gallon at gas stations; $10–15 at hardware stores.

---

Item 5: Borax and Regulatory Headwinds

Claim: Borax is disappearing from shelves because the U.S. is "quietly" following Europe's reproductive toxicity ban.

What Research Shows:

Borax is currently legal in the United States and available in laundry sections nationwide. However, there is genuine regulatory pressure. Borax is a naturally occurring mineral composed of sodium, boron, oxygen, and water. The European Chemicals Agency (ECHA) has classified borax as a Substance of Very High Concern (SVHC) because studies, primarily conducted on rodents exposed to high doses, suggested adverse effects on fertility and developmental processes. In 2015, this led the ECHA to classify boron compounds as reproductive toxicants under Category 1B.

In contrast, in the United States, the Environmental Protection Agency acknowledges potential reproductive risks but does not classify borax as a known human toxin at typical exposure levels. As a result, it remains legal for over-the-counter sale.

Bottom Line:
Borax remains legal and available in the U.S., though it is restricted or banned in the EU and UK. U.S. consumer groups are pushing for restrictions, which could eventually result in tighter regulation, but no ban is imminent. Availability: Grocery stores (spice and laundry aisles), Indian grocery stores (as "fit curry"), online. Cost: $5–21 for a multi-year supply.

---

Item 6: Other Items Investigated

We also examined diatomaceous earth, wool military blankets, canning lids, paraffin lamp oil, and alum. All of these items remain available, though availability varies by region and some face minor market consolidation. Detailed findings:

• Diatomaceous Earth (food grade): Available through tractor supply, livestock suppliers, and online. Cost: $15–25 per 15 lbs. Caution: Pool-grade DE poses silicosis risk; verify "food grade" labeling.
• Wool Military Surplus Blankets: Available through surplus dealers, eBay, Coleman's military surplus. Cost: $25–50. Supply is finite due to discontinued military procurement, making this a legitimate collectible.
• Canning Lids: Genuine Ball and Kerr lids available through big-box retailers and direct from manufacturers. Counterfeits exist, particularly on Amazon; the sealing compound on counterfeits may be too thin, and rim dimensions inconsistent. Cost: $0.08–0.15 per lid.
• Paraffin Lamp Oil: Available through Lowe's, Walmart, and online. Cost: $32–48 per gallon. Genuine paraffin (not citronella) produces minimal soot and is safe for indoor use.
• Alum: Used historically for water clarification and pickle-curing. Available in spice aisles and Indian grocery stores. Cost: $5–8 per pound.

---

What the Research Reveals About Supply Chains

Legitimate Trends:

1. Consolidation: Multiple suppliers have exited commodity markets (matches, wool blankets, some brands of kerosene heaters) due to low profit margins, regulatory burden, or shifting consumer preferences.
2. Hazmat & Shipping: Items classified as hazardous (strike-anywhere matches, potassium permanganate in quantity) face shipping restrictions that reduce retail availability and increase retail prices.
3. Regulatory Divergence: The U.S. and EU have begun to regulate chemicals differently (borax, boric acid), and U.S. consumer groups are calling for harmonization. This creates genuine uncertainty for future availability.
4. Market Efficiencies: Retailers have optimized inventory for high-turnover items. Low-demand specialty goods (kerosene, potassium permanganate, strike-anywhere matches) are stocked selectively or on order.

Overstated Claims:

The video presents these trends as a coordinated, imminent collapse. Our research shows that:

• No government agency is "quietly" removing items from shelves.
• Most items remain available through conventional online retailers, specialty suppliers, or regional retailers.
• Prices have risen modestly in some categories (notably kerosene during peak season), but not by the multiples the video implies.
• Supply chains remain functional for nearly all items listed, with regional variations.

---

Medical and Safety Considerations

Activated Charcoal:
The Utah Poison Control Center states that activated charcoal should only be given in health care facilities. They do not recommend at-home use of activated charcoal for poisonings. If a poisoning occurs, call Poison Control (1-800-222-1222 in the U.S.) before attempting home treatment.

Potassium Permanganate:
While the glycerin-permanganate reaction is documented, this activity requires the use of hazardous components and has the potential for hazardous reactions. Potassium permanganate is a powerful oxidizing agent that can explode on sudden heating. Small particles of potassium permanganate may be expelled from the reaction vessel. This is unsuitable for casual survival use and is primarily taught in military and advanced wilderness training.

Borax:
Borax is a skin and eye irritant, and inhaling the powder can lead to respiratory irritation. Most importantly, ingestion can cause severe poisoning, especially in children and pets, with potential for long-term health issues and even death.

---

Bottom Line for Consumers

If you are genuinely concerned about supply disruption:

1. Focus on items with documented supply challenges: Strike-anywhere matches (buy through retail now), kerosene (seasonal purchasing is advisable in cold climates), wool blankets (genuine military surplus is finite).
2. Ignore hype on items that are readily available: Activated charcoal powder, alum, borax, paraffin oil, diatomaceous earth, and canning lids remain available through normal retail and online channels.
3. Understand regulatory risks: Borax may face future restriction in the U.S., but this is not imminent. Stay informed via EPA updates.
4. Prioritize reliability: For emergency preparedness, conventional methods (commercial fire starters, standard lighter fluid, modern canning equipment) remain more reliable than chemical combinations or rare commodity items.
5. Avoid false urgency: Viral content that frames supply chains as "collapsing" or "quietly" being dismantled is misleading. Real supply issues are typically driven by market economics, not conspiracy, and occur gradually over years.

---

Sources and Citations

Government and Regulatory:

• Drug Enforcement Administration. "Chemical Handler's Manual." U.S. Department of Justice, updated May 2014. https://www.deadiversion.usdoj.gov/GDP/(DEA-DC-054)(EO-DEA168)_Chemical_Handler's_Manual_Final_(OMB_Approved).pdf
• Federal Register. "Control of Sodium Permanganate as a List II Chemical." Vol. 71, No. 200, October 17, 2006. https://www.federalregister.gov/documents/2006/10/17/E6-16990/control-of-sodium-permanganate-as-a-list-ii-chemical
• European Chemicals Agency (ECHA). "Boric Acid - Substance Information." https://echa.europa.eu/substance-information/-/substanceinfo/100.030.114

Medical and Toxicology:

• American Academy of Clinical Toxicology & European Association of Poisons Centres and Clinical Toxicologists. "Systematic Review on the Use of Activated Charcoal for Gastrointestinal Decontamination Following Acute Oral Overdose." Clinical Toxicology, 2021;59(12):1196-1227. DOI: 10.1080/15563650.2021.1931906
• National Center for Biotechnology Information (NCBI). "Activated Charcoal." StatPearls, updated April 26, 2023. https://www.ncbi.nlm.nih.gov/books/NBK482294/
• Poison Control, University of Utah Health. "Activated Charcoal." Accessed March 2026. https://poisoncontrol.utah.edu/news/2023/01/activated-charcoal
• Poison.org. "Borates, Borax, and Boric Acid: Are They Safe?" https://www.poison.org/articles/borates

Chemistry and Chemical Safety:

• Flinn Scientific. "The Reaction of Potassium Permanganate with Glycerin." https://www.flinnsci.ca/api/library/Download/4ebf31df9511493db327d5d958512ef4
• Royal Society of Chemistry. "A Spontaneous Exothermic Reaction." Demonstration guide. https://edu.rsc.org/experiments/a-spontaneous-exothermic-reaction/742.article
• University of Washington, Department of Chemistry. "Glycerol and KMnO₄." Lecture Demonstration. https://chem.washington.edu/lecture-demos/glycerol-and-kmno4

Market and Product Availability:

• 99 Boulders. "Why Have So Many Strike Anywhere Matches Been Discontinued?" February 25, 2022. https://www.99boulders.com/why-have-so-many-strike-anywhere-matches-been-discontinued
• 99 Boulders. "The Best Strike Anywhere Matches (Or Lack Thereof…)." February 25, 2022. https://www.99boulders.com/best-strike-anywhere-matches
• Diamond Brands. "Diamond Greenlight Strike Anywhere Kitchen Matches." https://www.diamonddoesitbetter.com/products/greenlight-strike-anywhere-kitchen-matches/
• Gellobit. "Where to Find Kerosene at U.S. Gas Stations in 2025." January 29, 2026. https://gellobit.com/where-to-find-kerosene-at-us-gas-stations
• Greenbelly Meals. "Strike Anywhere Matches." https://www.greenbelly.co/pages/strike-anywhere-matches
• Oil & Energy Online. "A Volatile Start to the 2024-2025 Heating Season." https://oilandenergyonline.com/articles/all/volatile-start-2024-2025-heating-season/

Regulatory and Policy:

• Environmental Literacy Council. "Why is Boric Acid Banned in Europe?" April 23, 2025. https://enviroliteracy.org/animals/why-is-boric-acid-banned-in-europe/
• The Filtery. "Is Borax Safe or Toxic? Why Is Borax Banned In U.K.?" March 13, 2025. https://thefiltery.com/is-borax-safe-why-borax-banned-uk/
• World Population Review. "Gas Shortage by State 2026." Updated April 2026. https://worldpopulationreview.com/state-rankings/gas-shortage-by-state

---

Methodology Note:
This report draws on peer-reviewed toxicology literature, government regulatory filings, current retail inventory data, and market analysis. Claims from the source video are fact-checked against primary sources, including academic literature, official agency guidance, and real-time market data. Where uncertainty exists, we note it. Recommendations prioritize evidence-based safety over sensationalism.

---

Last Updated: April 2026

 

How to Install Gemma 4 Locally with Ollama (2026 Guide)

 

By Vishnu

April 5, 2026

Gemma 4 is Google’s latest open-weight language model — a significant leap from Gemma 3 with better reasoning, longer context, and improved coding performance. Unlike cloud APIs, running it locally means zero data leaves your machine. Perfect for proprietary code, air-gapped environments, or just avoiding subscription fees.

Gemma 4 comes in four sizes: E2B and E4B for edge devices (phones, Raspberry Pi, IoT), and 26B MoE plus 31B Dense for workstations. All models are multimodal (vision + audio on edge models), support 140+ languages, and now use the permissive Apache 2.0 license.

:::note[TL;DR]

• Gemma 4 comes in four sizes: E2B, E4B (edge/mobile), 26B MoE, and 31B Dense (workstation/server)
• E2B/E4B run on phones, Raspberry Pi, Jetson Nano with 128K context
• 26B MoE activates only 3.8B params for fast inference; 31B Dense for maximum quality with 256K context
• All models are multimodal (vision + audio on edge) and support 140+ languages
• Install Ollama, then ollama pull gemma4:27b — models download automatically on first use
• Apple Silicon gets GPU acceleration; NVIDIA needs ~24GB+ VRAM for the 31B model
• Now under Apache 2.0 license (not Google’s custom license) — truly open for commercial use :::

Prerequisites

Before installing Gemma 4, check your hardware:

Minimum (CPU only):

• 4 GB RAM for E2B models (edge/IoT)
• 8 GB RAM for E4B models
• 16 GB RAM for 26B MoE models
• 32 GB RAM for 31B Dense models

Edge/Mobile (E2B/E4B):

• Runs on Raspberry Pi 4/5, NVIDIA Jetson Orin Nano
• Android phones with 6GB+ RAM
• iOS devices (via Core ML)
• 128K context window

Better performance (GPU):

• Apple Silicon Mac (M1/M2/M3/M4) — Metal acceleration works out of the box
• NVIDIA GPU with 8+ GB VRAM for E4B models
• NVIDIA GPU with 16+ GB VRAM for 26B MoE
• NVIDIA GPU with 24+ GB VRAM for 31B Dense
• 256K context window for 26B/31B models

Key Features:

• Multimodal: Vision + audio understanding on all models
• Multilingual: Native support for 140+ languages
• Agentic: Native function calling and structured JSON output
• License: Apache 2.0 (fully permissive for commercial use)
• Context: 128K (E2B/E4B) or 256K (26B/31B) tokens

Install Ollama

If you don’t have Ollama yet, install it first:

macOS:

brew install ollama

Linux:

curl -fsSL https://ollama.com/install.sh | sh

Windows: Download from ollama.com. Runs as a background service.

Verify installation:

ollama --version

Download and Run Gemma 4

Ollama makes this trivial. Models download on first use and cache for future runs.

# Run the E2B model (edge/IoT, ~2GB, fastest on limited hardware)
ollama run gemma4:2b

# Run the E4B model (edge/IoT, ~3GB, better quality than E2B)
ollama run gemma4:4b

# Run the 26B MoE model (desktop, activates 3.8B params, fast inference)
ollama run gemma4:27b

# Run the 31B Dense model (workstation, maximum quality, 256K context)
ollama run gemma4:31b

The Scenario: You’re deploying an AI assistant on a Raspberry Pi 5 at a remote factory. You pull gemma4:2b, get local vision + audio processing with 128K context, and it all runs offline without internet. The E2B model handles OCR from camera feeds and voice commands natively.

First launch downloads the model weights:

• E2B: ~2GB
• E4B: ~3GB
• 26B MoE: ~16GB (fits on 80GB H100 unquantized, ~7GB quantized)
• 31B Dense: ~19GB (fits on 80GB H100 unquantized, ~8GB quantized)

Subsequent starts are instant.

Available Model Variants

Gemma 4 offers quantized variants for different VRAM constraints:

Variant	Effective Size	VRAM Needed	Best For	Context
gemma4:2b (E2B)	~2 GB	3-4 GB	Raspberry Pi, IoT, phones	128K
gemma4:4b (E4B)	~3 GB	4-6 GB	Edge devices, Jetson Nano	128K
gemma4:27b (26B MoE)	~16 GB (activates 3.8B)	12-16 GB	Fast desktop inference	256K
gemma4:31b (31B Dense)	~19 GB	24+ GB	Maximum quality, fine-tuning	256K
gemma4:27b-q4_K_M	~7 GB	8-10 GB	Mid-range GPUs (26B MoE)	256K
gemma4:31b-q4_K_M	~8 GB	10-12 GB	High-end consumer GPUs	256K

Key difference: The 26B MoE activates only 3.8 billion parameters during inference — delivering exceptional tokens/second while still having 26B total capacity. The 31B Dense uses all parameters for maximum quality.

Pull a quantized variant:

ollama pull gemma4:31b-q4_K_M

:::tip The q4_K_M quantization uses 4-bit precision with intelligent mixing. You lose ~2-3% quality but save 30-40% VRAM. Most users won’t notice the difference for everyday coding tasks. :::

Hardware-Specific Setup

Apple Silicon (M1/M2/M3/M4)

No configuration needed. GPU acceleration works automatically via Metal:

ollama run gemma4:12b

On an M2 Pro with 16GB unified memory, the 12B model runs at ~25 tokens/second. The 27B model also runs on M-series chips with 24GB+ RAM, though you may need to close other apps.

NVIDIA GPUs

Install the NVIDIA Container Toolkit for maximum throughput. Verify CUDA is available:

ollama ps  # Shows if GPU is being used

:::warning If you see “CUDA out of memory” errors, your model is too large for your VRAM. Kill the process with ollama stop gemma4:27b and switch to a smaller variant or quantized version. :::

CPU-Only Systems

Gemma 4 runs on CPU if you lack a compatible GPU. It’s slower but functional:

# Force CPU mode if needed
export OLLAMA_NO_GPU=1
ollama run gemma4:2b

Expect 2-5 tokens/second on a modern CPU for the E2B model. Usable for simple queries on edge devices.

Edge Devices (Raspberry Pi, Jetson Nano)

The E2B and E4B models are engineered specifically for edge:

# On Raspberry Pi 5 with 8GB RAM
ollama run gemma4:2b

# On NVIDIA Jetson Orin Nano
ollama run gemma4:4b

Features on edge:

• Vision: Process camera frames locally for OCR, object detection
• Audio: Native speech recognition and understanding
• Offline: Works without internet after initial download
• Low latency: Near-zero response time for real-time applications

Using the REST API

Ollama exposes an OpenAI-compatible API at localhost:11434:

Basic chat completion

curl http://localhost:11434/api/chat -d '{
  "model": "gemma4:31b",
  "messages": [
    { "role": "user", "content": "Explain recursion in Python" }
  ],
  "stream": false
}'

Generate (single prompt)

curl http://localhost:11434/api/generate -d '{
  "model": "gemma4:31b",
  "prompt": "Write a Python function to reverse a linked list",
  "stream": false
}'

OpenAI-compatible endpoint

Any library that works with OpenAI can point to Ollama:

from openai import OpenAI

client = OpenAI(
    base_url='http://localhost:11434/v1',
    api_key='ollama'  # required but ignored
)

response = client.chat.completions.create(
    model='gemma4:12b',
    messages=[{'role': 'user', 'content': 'Refactor this function'}]
)
print(response.choices[0].message.content)

Python SDK Usage

Install the official Ollama Python library:

pip install ollama

Basic usage:

import ollama

response = ollama.chat(
    model='gemma4:31b',
    messages=[
        {'role': 'user', 'content': 'Write a bash script to find large files'}
    ]
)
print(response['message']['content'])

Streaming for real-time output:

stream = ollama.chat(
    model='gemma4:31b',
    messages=[{'role': 'user', 'content': 'Tell me a joke'}],
    stream=True,
)

for chunk in stream:
    print(chunk['message']['content'], end='', flush=True)

IDE Integration

Continue.dev (VS Code / JetBrains)

Add to your Continue config:

{
  "models": [
    {
      "title": "Gemma 4 31B (Local)",
      "provider": "ollama",
      "model": "gemma4:31b",
      "apiBase": "http://localhost:11434"
    }
  ],
  "tabAutocompleteModel": {
    "title": "Gemma 4 26B MoE Autocomplete",
    "provider": "ollama",
    "model": "gemma4:27b"
  }
}

The Scenario: You’re on a plane with no Wi-Fi. Open VS Code, hit Tab for autocomplete, and Gemma 4 suggests the next line. Local AI doesn’t need the internet.

Cursor

In Cursor settings, add a custom OpenAI-compatible model:

• Base URL: http://localhost:11434/v1
• Model: gemma4:31b

Claude Code

Pipe files to your local Gemma 4 instance:

claude -p "Review this code for bugs" < src/utils/parser.ts

Useful Commands

ollama list                  # show downloaded models
ollama pull gemma4:31b       # download a specific variant
ollama rm gemma4:27b         # remove a model to free space
ollama show gemma4:31b       # model info and parameters
ollama ps                    # show running models
ollama stop gemma4:31b       # stop a running model
ollama run gemma4:4b "prompt" # one-shot, non-interactive

Performance Comparison

Approximate tokens/second on different hardware:

Hardware	E2B	E4B	26B MoE	31B Dense
Raspberry Pi 5 (8GB)	8 t/s	4 t/s	N/A	N/A
M2 Pro (16GB)	45 t/s	35 t/s	30 t/s	15 t/s
RTX 4090 (24GB)	90 t/s	75 t/s	65 t/s	35 t/s
RTX 3060 (12GB)	30 t/s	25 t/s	20 t/s	N/A
CPU (i7-12700K)	5 t/s	3 t/s	<1 t/s	<1 t/s

Numbers are approximate — actual speed varies by prompt length and context window usage. The 26B MoE model activates only 3.8B parameters during inference, making it surprisingly fast for its size.

Prompting Tips

Gemma 4 responds well to direct, specific prompts:

For coding:

You are an expert Python developer. Write a clean, documented function that [task]. Include type hints and a docstring.

For explanation:

Explain [topic] as if I'm a senior developer who knows [related tech] but is new to this specific concept. Be concise.

For review:

Review this code for bugs, performance issues, and style violations. Rate each on severity (low/medium/high).

Troubleshooting

”Error: model not found”

Run ollama pull gemma4:12b first to download the weights.

Out of memory errors

Switch to a smaller model or quantized variant. Use Activity Monitor (macOS) or nvidia-smi (Linux) to check memory usage.

Slow performance

• Verify GPU acceleration: ollama ps should show the model
• Try a smaller model variant
• Close other memory-heavy applications
• Check thermal throttling on laptops

API connection refused

Ensure Ollama server is running:

ollama serve  # starts the server

Summary

• Gemma 4 runs fully offline via Ollama — no API keys, no data leaks
• Four sizes: E2B and E4B for edge/mobile (128K context), 26B MoE and 31B Dense for workstations (256K context)
• 26B MoE activates only 3.8B parameters for fast inference; 31B Dense for maximum quality
• Quantized variants (q4_K_M) save VRAM with minimal quality loss
• Apple Silicon gets automatic GPU acceleration; NVIDIA needs sufficient VRAM
• Multimodal: Vision + audio understanding on all models
• Multilingual: Native support for 140+ languages
• Apache 2.0 license — fully permissive for commercial use
• OpenAI-compatible API works with existing tools and libraries

---

Frequently Asked Questions

What’s the difference between Gemma 3 and Gemma 4?

Gemma 4 improves reasoning, coding performance, and instruction following. The 31B Dense model ranks #3 on the Arena AI open-source leaderboard, outperforming models 20x its size. Key upgrades include:

• Multimodal support (vision + audio) on all models
• 140+ languages natively
• 128K context (E2B/E4B) or 256K context (26B/31B)
• Apache 2.0 license (was Google’s restrictive custom license)
• Native function calling and agentic workflow support

Can I run Gemma 4 without internet after the initial download?

Yes. Once you ollama pull the model, it runs entirely offline. The weights are stored in ~/.ollama/models/. No cloud connection required for inference. This is ideal for air-gapped environments, privacy-sensitive work, or deployments without reliable internet.

Which Gemma 4 size should I choose?

• E2B (2B effective): Raspberry Pi, IoT devices, phones, real-time edge processing with vision/audio
• E4B (4B effective): Jetson Nano, Android devices, better quality than E2B while still edge-friendly
• 26B MoE (Mixture of Experts): Desktop workstations, fast inference (activates only 3.8B params), coding assistants
• 31B Dense: High-end GPUs, maximum quality, fine-tuning, complex reasoning tasks

How does the 26B MoE model work?

MoE (Mixture of Experts) means the model has 26 billion total parameters but only activates 3.8 billion during each inference pass. It routes each token to the most relevant “expert” sub-networks. This gives you fast tokens-per-second comparable to a 4B model, with the quality of a much larger model.

Can I use Gemma 4 for commercial projects?

Yes. Gemma 4 uses the Apache 2.0 license — the same permissive license used by Android, Kubernetes, and TensorFlow. You can use it commercially, modify it, distribute it, and even build proprietary products on top of it. No usage restrictions, no attribution requirements beyond the license text.