Google introduced Gemini 4 Carbon on October 28, reporting major improvements in finding software vulnerabilities, testing exploits, and generating fixes. Rather than releasing the model broadly, Google is giving selected cybersecurity defenders early access before expanding availability through its Fairwind Program.
The restricted rollout reflects the risks of making advanced cybersecurity capabilities available to both defenders and potential attackers. Google hopes early access will help security teams repair weaknesses sooner, though that advantage depends on how quickly discoveries lead to deployed fixes.
How Carbon performed on vulnerability discovery, exploitation, and fixes
Google reports improvements across three stages of cybersecurity work:
| Benchmark | What it measures | Carbon’s reported score |
|---|---|---|
| SEC-bench Pro | Finding software vulnerabilities | 88.2% |
| ExploitGym | Demonstrating exploitation | 54.8% |
| CWE-bench | Producing working code fixes | 71.0% |
Google ran these evaluations with safety guardrails disabled, so the scores reflect what Carbon could accomplish under those testing conditions, not necessarily what customers will receive.
Security teams often spend hours investigating whether a reported vulnerability can be exploited. Carbon’s ability to demonstrate exploitation could help them prioritize urgent fixes, though attackers could use the same capability to identify weaknesses worth targeting.
Since the benchmarks evaluate separate capabilities, their scores do not establish how Carbon completes an entire security workflow. For example, successful vulnerability discovery doesn't guarantee the proposed patch will work across every affected configuration.
Why Google is giving cybersecurity defenders early access
Google’s Fairwind Program, launched in September, gives cybersecurity organizations early access to advanced AI models. Participants must restrict employee access and use multifactor authentication, while Google aims to give defenders time to repair weaknesses before comparable capabilities become widely available.
Google cites an earlier example involving Wiz, which used Carbon’s predecessor, Gemini 4 Argon, to identify a critical vulnerability in hospital software that previous models had missed. The Neuron’s coverage of Argon examined that finding alongside the model’s autonomous capabilities and reliability limits.
Early access could help participating defenders identify vulnerabilities and prepare patches before similar tools become widely available. Organizations outside Fairwind, however, would depend on those discoveries reaching software vendors and the resulting fixes being distributed to customers.
The program’s effectiveness would be better measured by how quickly affected systems receive repairs than by the number of vulnerabilities Carbon discovers. Finding a weakness is only the first step; researchers must verify it, coordinate disclosure, develop a patch, and ensure organizations install the update.
Google is also participating in voluntary pre-release testing with the U.S. government. The company has not confirmed when Carbon will become generally available, leaving broader access dependent on its rollout.
Carbon’s reliability improved on some tests but declined on others
Artificial Analysis ranked Carbon first on its Intelligence Index v5 with a score of 59 and placed second behind Claude Opus 5.5 on the Coding Agent Index. The rankings measure different capabilities and do not establish which model is more effective at finding and fixing vulnerabilities.
In Google’s evaluations, Carbon recorded a 0.0% attack success rate on the tested Gray Swan indirect prompt-injection benchmark. These attacks embed malicious instructions in external material that attempt to redirect an AI agent. Google also reports roughly half as many unsupported claims as Argon and nearly 80% fewer high-severity misalignment alerts during internal coding tasks.
Independent testing produced a more complicated picture. Artificial Analysis found that Carbon improved on its AA-Omniscience accuracy measure, but its hallucination rate rose from 4% for Argon to 11% for Carbon.
The evaluations measure different aspects of factual reliability, so improvement on one metric does not guarantee fewer errors across all tasks. Similarly, Carbon’s performance against the tested prompt-injection attacks does not establish how it would respond to unfamiliar techniques or deployment conditions.
Can Carbon handle multi-day security work?
Google reports that Carbon can work on engineering assignments lasting several days and achieved more than twice Argon’s success rate in internal secure-code generation tests.
An agent that investigates a vulnerability over several days could reduce the need for analysts to repeatedly gather logs, inspect code, and reproduce failures. However, prolonged work also makes it harder to identify when the model started following an incorrect assumption, potentially increasing the effort required to review its findings.
Security teams should require evidence that reproduces a reported vulnerability and independently test any AI-generated patch. The review should confirm that the fix closes the weakness without disrupting existing application functions, with deployment remaining subject to human approval.
Longer autonomous assignments also bring operating costs into the calculation. Google’s introductory pricing is $2 per million input tokens and $10 per million output tokens, rising to $4 and $20 after the introductory period, with a 95% discount on cached inputs. These rates give customers a starting point for estimating costs, though access remains restricted.
Google’s controlled rollout allows selected defenders to identify and repair vulnerabilities before comparable capabilities become more widely available. Whether that approach improves cybersecurity will depend on how quickly organizations validate Carbon’s findings, deploy reliable fixes, and prevent the model from being misused.
Before expanding access, Google will need evidence that Carbon performs reliably across different software environments and that its safeguards remain effective when agents encounter unfamiliar threats. Benchmark scores establish what the model accomplished in testing; successful deployments will show whether those capabilities translate into better security.
