Gemini 4 Carbon: Google’s AI for flaws, exploits and patches
Google unveils Gemini 4 Carbon: 88.2% at finding vulnerabilities and 54.8% at exploitation in its own tests. Access limited to defenders, and what to do now.
On 28 October 2026 Google announced Gemini 4 Carbon, a frontier model built for software engineering and cybersecurity work. According to the company, it beats rival models on tests that measure three distinct abilities: finding vulnerabilities, checking whether they are exploitable by building an exploit, and writing the fix. The model is not publicly available yet: access starts with a small group of defenders and will widen in stages.
All the figures that follow are claimed by Google and reported by SecurityWeek, Help Net Security and Cybersecurity360. They are not independent measurements, nor data on real-world attacks.
What happened
According to SecurityWeek, Carbon arrives about two weeks after Gemini 4 Argon, and it builds on Argon’s safety framework. Google says its teams have watched the model spend days investigating and fixing bugs across very large codebases and low-level systems (Help Net Security).
The first rollout goes through the Fairwind Program, Google’s programme for governments, critical infrastructure operators and major technology platforms, which according to SecurityWeek has more than 650 participating organisations. After the first selected defenders, access will extend to further trusted partners; only later, once feedback has been gathered and safeguards refined, will it reach developers, businesses and consumers. SecurityWeek also reports that Google takes part in the US government’s voluntary effort to test models before release.
The benchmark figures
In the evaluation published by Google, run with no guardrails:
- SEC-bench Pro (finding vulnerabilities in real-world software): 88.2%;
- ExploitGym (confirming exploitability with a working exploit in a test environment): 54.8%;
- Collinear’s CWE-bench (fixing flaws without breaking the program’s functions): 71.0%.
According to SecurityWeek, Google’s comparison puts Carbon ahead of OpenAI’s GPT-6 Astra and Anthropic’s Claude Opus 5.5 and Claude Fable 5.1. Cybersecurity360 also reports the figures for its predecessor Argon (83.4%, 42.0% and 68.0%): the biggest jump is in exploitation, +12.8 points, while patching improves by 3 points. The same outlet cites, for ExploitGym, 42.4% for GPT-6 Astra and 34.5% for Claude Opus 5.5.
Other internal data, reported consistently by SecurityWeek and Help Net Security: Carbon’s success rate at writing secure code is more than double Argon’s; Google’s Chrome team found it more than 10 times better at producing high-quality patches than a large frontier model from another, unnamed lab; Wiz, the Google-owned cloud security firm, saw it take the top spot on web application penetration testing benchmarks.
As Cybersecurity360 points out, the three tests use different tasks and denominators: 71% on CWE-bench does not mean the model can secure 71% of a company’s software.
The claimed safeguards
Google says it has strengthened the model’s defences against misuse and against agent errors:
- indirect prompt injection: on Gray Swan’s benchmark no attack succeeded, compared with 0.7% for Argon. These are malicious instructions hidden in content the agent reads (files, bug reports, web pages); the result applies to that evaluation and does not rule out manipulation under other conditions;
- Terminal-Bench 4.0: no successful cheating, with cheating attempts down to 0.4%;
- roughly half as many unsupported claims as Argon and, during coding work with internal teams, nearly 80% fewer high-severity alerts for behaviour that conflicted with instructions; Help Net Security adds a 26% drop in actions beyond the task’s scope.
The safeguards combine model training, real-time misuse defences and monitoring of the model’s reasoning. For Fairwind, Cybersecurity360 describes vetting of admitted organisations, named accounts, phishing-resistant multi-factor authentication, usage tracking and a ban on sharing access, while noting that the public rules mainly cover Argon.
Announced pricing for the commercial release: $2 per million input tokens and $10 per million output tokens during the introductory period, then $4 and $20, with a 95% discount on cached input tokens.
What it means for European and Italian organisations
Google frames exploitation as a defensive step: it helps decide which vulnerabilities to fix first, by checking which ones are really exploitable. It is the same work attackers want to automate. Cybersecurity360 links the announcement to Anthropic research published on 27 October on exploit chains built with an experimental model against widely used browsers and operating systems, reported to the vendors.
Today Carbon is not a tool companies can use, and the sources do not say which European organisations are part of Fairwind. The practical consequence is already here, though: the time between the disclosure of a flaw and a working exploit tends to shrink. For NIS2 entities, which must handle vulnerabilities as part of their risk-management measures, and for healthcare, with many systems that are hard to update, patch windows measured in weeks become harder to justify.
What to do now
- Shorten patch times for internet-facing systems and give priority to vulnerabilities that are already exploited or have a public exploit.
- Rank vulnerabilities by exploitability and real exposure, not just by CVSS score.
- If you are evaluating AI agents for code security, from Google or anyone else, set the rules before adopting them: isolated test environments, least privilege, no secrets in the repositories being analysed, an action log.
- Treat the content the agent reads as untrusted: tickets, issues, dependencies and documentation can carry prompt injection, whatever the benchmarks say.
- No generated patch goes to production without review: code review, regression tests and human approval.
- Read the benchmarks for what they are: vendor figures, measured without filters; performance in the configurations offered to customers will need to be verified.
How ARXDOME helps
ARX Shield shows open vulnerabilities by machine and by package, with their age and with those already exploited by attackers highlighted: it helps decide what to fix first when timelines get shorter. ARX Expose shows what can be seen of your company from outside, including known vulnerabilities on public services, and ARX Scout checks, with your authorisation, which ports and services are actually exposed and alerts you when a new one opens.
Last updated:
