Google has unveiled Gemini 4 Carbon, a new frontier artificial intelligence model that it says can outperform rival systems in finding software vulnerabilities, testing whether they can be exploited and generating patches to fix them.
The model is not being released broadly for now. Google is initially giving access to a select group of vetted cyber defenders before expanding availability to more approved partners through its Fairwind Program.
The launch reflects a growing race among major AI companies to build models capable of performing increasingly advanced cybersecurity work, including tasks that previously required experienced security researchers.
Google Reports Strong Vulnerability Discovery Scores
Google said Gemini 4 Carbon scored 88.2% on SEC-bench Pro, a benchmark designed to test whether AI models can identify vulnerabilities in real-world software.
The company also reported a score of 54.8% on ExploitGym, which evaluates a model’s ability to determine whether software weaknesses can actually be exploited.
On Collinear’s CWE-bench, which tests patch-generation capability, Carbon scored 71%.
Google said the results placed Carbon ahead of rival frontier models in its comparison.
The company also reported that Carbon was more than twice as successful as its earlier Gemini 4 Argon model at writing secure code.
Google’s Chrome team further found that Carbon generated high-quality patches at a substantially higher rate than a large rival frontier model during internal testing.
The performance figures are based on benchmarks and internal evaluations, meaning they should not automatically be treated as a measure of how well the system will perform across every real-world security environment.
Exploit Generation Is Being Framed As A Defensive Tool
One of the more sensitive capabilities highlighted by Google is Carbon’s ability to test whether vulnerabilities can be exploited.
That capability has obvious defensive value.
Security teams often discover large numbers of vulnerabilities but lack the resources to patch all of them immediately. Determining whether a flaw is realistically exploitable can help defenders decide which weaknesses require the fastest response.
Google says this is the reason its models are being trained to perform exploitation tasks.
Rather than treating exploit generation purely as an offensive capability, the company argues that defenders need the ability to reproduce attacks in controlled environments so they can understand whether a vulnerability presents a genuine risk.
That approach is becoming increasingly common in AI-assisted security research.
However, it also creates a dual-use challenge. A system capable of discovering weaknesses and producing working exploits could become dangerous if powerful capabilities were released without sufficient safeguards or access controls.
That helps explain why Carbon is initially being restricted to approved security organisations.
Access Limited To Vetted Cyber Defenders
Google is rolling out Gemini 4 Carbon through its Fairwind Program.
The programme gives governments, critical-infrastructure operators and major technology companies early access to advanced AI models intended for defensive cybersecurity work.
More than 650 organisations currently participate in Fairwind, according to Google.
The company says Carbon will first be provided to a smaller group of cyber defenders before access expands in stages.
Google is also continuing to evaluate the model’s safeguards before making it broadly available to developers, businesses and consumers.
The rollout follows Gemini 4 Argon, another security-focused model released earlier this month to selected Fairwind partners.
The progression suggests Google is increasingly treating advanced cybersecurity reasoning as a specialised capability that may require tighter access controls than general-purpose AI functions.
Safety Tests Focus On Prompt Injection And Misalignment
Google also released results from internal and external safety testing.
According to the company, no attacks succeeded against Carbon in Gray Swan’s indirect prompt-injection benchmark. Gemini 4 Argon, by comparison, recorded a 0.7% success rate for attacks in the same testing framework.
Google also said unsuccessful cheating attempts on Terminal-Bench fell to 0.4%.
Compared with Argon, Carbon reportedly produced roughly half as many unsupported claims.
Internal Google teams using the model in real coding environments also reported nearly an 80% reduction in high-severity misalignment alerts.
These measurements are significant because autonomous cybersecurity systems may interact with code repositories, terminals and sensitive infrastructure.
A model that misunderstands its instructions or follows malicious content embedded inside a target system could create additional security problems rather than solving them.
Indirect prompt injection is particularly relevant because an AI agent examining external files, websites or repositories could encounter hidden instructions designed to manipulate its behaviour.
AI Cybersecurity Race Is Accelerating
Large AI companies are increasingly positioning frontier models as tools for vulnerability discovery and software security.
AI systems can already scan large codebases, identify suspicious patterns and suggest patches faster than human teams working manually.
More advanced models are now moving further into tasks such as exploit validation and autonomous security testing.
That progression could help defenders identify weaknesses before attackers find them.
It could also narrow the time between vulnerability discovery and exploitation.
Once AI models become capable of reliably finding a flaw, testing an exploit and generating the corresponding fix, the vulnerability-management process could accelerate considerably.
But the same capability creates pressure for companies to control access and ensure offensive functions are not easily misused.
Google’s decision to limit Carbon initially to vetted defenders reflects that tension.
The model may demonstrate how AI can compress several traditionally separate cybersecurity tasks — discovery, exploitation testing and patch generation — into a single workflow.
For defenders, that could significantly reduce the time required to move from identifying a weakness to understanding its practical risk and deploying a fix.
