Google Unveils Gemini 4 Carbon for Vulnerability Discovery, Exploitation and Patching

Google announced Gemini 4 Carbon, an AI model designed to discover and validate software vulnerabilities, develop exploits and generate security patches. Google reports scores of 88.2% on SEC-bench Pro, 54.8% on ExploitGym and 71.0% on CWE-bench, alongside more than twice Gemini 4 Argon's success rate in generating secure code. These are vendor-reported results, rather than evidence of performance in enterprise deployments.

Access is initially restricted to selected cybersecurity defenders, with expansion to additional trusted partners through the Fairwind Program as Google gathers feedback and refines safeguards. Google says Carbon resisted all prompt-injection attempts in its tests, compared with Argon following malicious instructions in 0.7% of cases; that finding does not establish immunity to other attacks. The developers are also participating in the U.S. government's voluntary pre-release model testing process. For security teams, the announcement introduces a potential vulnerability-research and remediation tool under controlled access, not a disclosure of an active attack or breach.