Google says its new Gemini 4 Carbon model leads published benchmarks for finding, exploiting and fixing software vulnerabilities. For now only vetted defenders can use it, which tells UK security teams something about how quickly the attacker’s toolkit is changing.
What happened
On 28 October 2026 Google unveiled Gemini 4 Carbon, its newest frontier model. It arrived two weeks after Gemini 4 Argon. The announcement went out under Koray Kavukcuoglu’s byline and presents Carbon as a model built for long-running engineering and coding work. Its headline claims, though, are about cyber security.
Google has not put Carbon on general release. From launch week it is available only to a subset of cyber defenders, with access widening gradually to trusted partners through the Fairwind Program, Google DeepMind’s early-access scheme for defensive security work. Google says it is still gathering feedback and refining guardrails before any broader rollout, and gives no date for developers, businesses or consumers. The only external oversight it mentions is its participation in the US government’s voluntary pre-release model testing.
The launch continues a pattern seen across the major labs this autumn: each new model is pitched on its offensive security ability, and the most capable tier is held back for defenders first. OpenAI’s GPT-6.1 Terra, which OpenAI says meets the ‘Critical’ cyber threshold in its own Preparedness Framework, was the latest example before this one.
The technical picture
Google reports three benchmark results, all run without guardrails, which is how you measure what a model can do rather than what it is allowed to do:
- Discovery: 88.2% on SEC-bench Pro, which Google describes as state of the art for finding vulnerabilities.
- Exploitation: 54.8% on ExploitGym, which Google says is a new state of the art for turning a bug into a working exploit.
- Patching: 71.0% on CWE-bench, which tests whether validated findings become working code fixes.
Google also says Carbon is more than twice as successful as Argon at producing secure code in its internal tests. According to Google, the Chrome team judged Carbon’s patches more than ten times better than those from another lab’s large frontier model, and Wiz reported that it leads web penetration testing benchmarks. These are vendor-reported and partner-reported figures, not independent evaluations.
On safety, Google says Carbon uses the same layered controls as Argon: model training, real-time misuse defences, prompt-injection resilience and monitoring of the model’s chain of thought. On top of that it has additional alignment training for high-pressure tasks. On Gray Swan’s indirect prompt injection benchmark, Argon had a 0.7% attack success rate; Google puts Carbon at 0.0%, meaning no evaluated attack succeeded. Google also reports that high-severity misalignment alerts in its internal coding environments fell by almost 80%, and that the model’s attempts to cheat on Terminal-Bench 4.0 dropped to 0.4%, with none succeeding.
The Fairwind Program, according to its DeepMind page, prioritises governments and national cyber authorities, critical infrastructure operators in healthcare, telecoms, energy and finance, core technology platforms and academic labs doing defensive benchmarking. Applicants are vetted and must accept conditions that include phishing-resistant MFA and use for defensive purposes only. Google says the scheme has more than 650 partners worldwide, but it names no countries or government partners.
Why it matters for UK organisations
The first point is simple. If Google’s figures hold, a model that converts more than half of benchmark bugs into working exploits shortens the time between disclosure and exploitation. Google itself describes the defender-only phase as temporary. Comparable capability will reach general availability, competing labs and, eventually, open-weight models. UK organisations that still measure critical patching in weeks rather than days are working to a timetable that no longer fits.
The second point concerns access. Fairwind’s priority categories match the UK’s operators of essential services and the bodies that will fall under the Cyber Security and Resilience Bill. Large UK utilities, NHS suppliers, telecoms providers and banks may well qualify. Smaller firms in their supply chains will not, so they face the same attackers with a smaller share of the defensive benefit. That gap is part of the backdrop to the government’s newly announced National Cyber Shield and NERV centre, which are intended to use AI to find vulnerabilities across critical infrastructure and the wider economy.
The third point is oversight. Google cites only US pre-release testing. The announcement does not mention the UK AI Security Institute, which has tested other frontier models before release, or the NCSC. UK buyers and regulators should ask rather than assume.
Expert view
Benchmarks are not breaches, and I would treat vendor numbers with the usual caution until independent testers have had their turn. SEC-bench and ExploitGym results describe performance on curated tasks with known answers. Real estates are messier, with legacy authentication and undocumented dependencies. Even so, the direction is clear, and it matches what we see on engagements. Machine-assisted discovery is already cheap, and exploitation is catching up.
The patching score interests me more than the exploitation one. Most organisations I work with have no shortage of findings; what they lack is the engineering capacity to fix them. If Google’s 71.0% CWE-bench score carries over to real code, a model that turns validated bugs into usable patches could shrink backlogs, as long as the fixes are reviewed and tested like any other change. The risk is teams accepting machine-written patches without review because they look plausible.
The 0.0% prompt injection figure deserves care too. A clean score on one benchmark is encouraging, but it is not a guarantee in your environment. When we test agent deployments, the weak point is usually the permissions the agent holds and the content it is allowed to read, not the model on its own. Restricting access to vetted defenders is a sensible interim control. It is also a reminder that the vendor itself regards the capability as dual-use.
What to do now
- Tighten patch timelines. Cyber Essentials already requires high and critical fixes within 14 days. Aim to beat that for internet-facing systems (firewalls, VPNs, web applications), where AI-accelerated exploitation will show up first.
- Know your exposed estate. Keep an accurate inventory of internet-facing assets and software versions. Fast exploitation punishes organisations that do not know what they run.
- Consider defensive access. Critical infrastructure operators and large technology suppliers should judge whether programmes such as Fairwind fit their vulnerability management, and check the conditions, including phishing-resistant MFA, before applying.
- Govern AI-written fixes. Put any AI-generated patch through normal code review, testing and change control. Record which fixes were machine-written.
- Lock down agents. Where AI agents touch code or infrastructure, apply least privilege, separate credentials and log every tool action, whatever prompt injection score the vendor reports.
- Ask about testing. In procurement, ask AI vendors which government bodies, including the UK AI Security Institute, evaluated the model before release.
Bottom line
Gemini 4 Carbon is Google’s claim to the lead in AI vulnerability research, resting for now on its own and partners’ figures, and the defender-first release is the right call. UK organisations should not read the restriction as breathing space. They should treat it as notice that exploitation is getting faster, and tighten their patching, asset visibility and agent controls before equivalent capability is widely available.
Sources
- Google: Gemini 4 Carbon, our next frontier model
- The Hacker News: Google’s Gemini 4 Carbon Leads Benchmarks for Finding, Exploiting, and Patching Vulnerabilities
- Reuters via Khaleej Times: Google launches Gemini 4 Carbon AI model with cybersecurity focus
- Google DeepMind: Fairwind Program
- The Next Web: UK puts £130m into AI cyber defence
