Google's Gemini 4 Carbon Leads Benchmarks for Finding, Exploiting, and Patching Vulnerabilities

Google has launched Gemini 4 Carbon, a new frontier AI model that it says sets new records for cybersecurity-related tasks. According to Google DeepMind's Koray Kavukcuoglu, the model leads rival systems on SEC-bench Pro (88.2%) for discovering vulnerabilities, ExploitGym (54.8%) for exploiting them, and CWE-bench (71.0%) for patching, while also topping the Artificial Analysis Intelligence Index with a score of 59, ahead of Anthropic's Claude Opus 5.5, OpenAI's GPT-6 Astra and GPT-6.1 Sol. Google notes Carbon is twice as likely as its predecessor, Gemini 4 Argon, to produce secure code, is designed to ask for human guidance under ambiguous or high-pressure conditions instead of improvising, and successfully blocked every tested indirect prompt-injection attack. The rollout mirrors Argon's staged release through Google's Fairwind Program, starting with select cyber defenders before wider access, and the company says it is participating in the U.S. government's voluntary pre-release model testing scheme. The news follows OpenAI's release of GPT-6.1 Terra, which it says meets the Critical threshold for cybersecurity under its Preparedness Framework and resists prompt-injection attempts, and comes days after Anthropic revealed that an unreleased internal model independently found critical flaws including a one-click Chrome remote code execution, a Safari exploit chain exposing browsing data, an Android lock-screen bypass, and a Windows HTTP.sys denial-of-service bug tracked as CVE-2026-33096 (CVSS 7.5) — all since patched by Google, Apple, and Microsoft.