Gemini 4 Carbon cybersecurity: finding, validating and fixing vulnerabilities

Gemini 4 Carbon cybersecurity means that Google claims state-of-the-art performance for its strongest model across the whole defense cycle, that is, finding a vulnerability, proving it with an exploit and fixing it at the root cause, but as of 28 October 2026 only selected cyber defenders can use it. This is what the Google announcement of 28 October says, describing Carbon as capable of state-of-the-art performance in cybersecurity and long-running tasks.

Giallo has not tested Carbon and has not re-run the benchmarks: every number is declared by Google or by the vendors of competing models, with the link to the source in the same paragraph. Where Google has not published a figure, we say so. If you need the overall picture of the model, start with what Gemini 4 Carbon is.

Access is gradual: first some cyber defenders, then other trusted partners through the Fairwind Program; for developers and businesses Google says “as soon as possible”, with no date. For an Italian SME, this article explains what is being promised and how to prepare with tools that are already available.

How does Gemini 4 Carbon cybersecurity work: find, validate, fix?

The cycle has three steps, and Google builds the security part of its announcementaround it. First, a real vulnerability is found in the code. Then the risk is validated with an exploit that actually works, because a report without proof can be a false alarm. Finally, the flaw is fixed at the root cause, not with a patch on top.

Each step has a matching benchmark: SEC-bench Pro measures detection (88.2%), ExploitGym validation through exploits (54.8%) and Collinear's CWE-bench fixing (71.0%). For a business, the whole cycle is what counts: an AI for finding vulnerabilities that cannot prove them or close them only produces long lists to read.

Google adds that on internal benchmarks Carbon has more than double Argon's success rate at generating secure code: the evidence is not public, so this is a vendor claim, not an independent measurement.

How does Gemini 4 Carbon score on cybersecurity benchmarks?

In the In the official evaluation of Gemini 4 Carbon, updated in October 2026, Carbon ranks first on the three cybersecurity benchmarks among the models compared. The table shows Google's values; a dash means the figure is not available.

By our calculation, the lead over the runner-up is 2.8 points on SEC-bench Pro (Astra), 12.4 on ExploitGym (Astra) and 3 on CWE-bench (Argon and Astra tied). The widest gap is therefore on exploit validation, the narrowest on detection.

The comparison is not uniform. CWE-bench is a public leaderboard on which Collinear AI evaluated all the models: it is the most homogeneous of the three cybersecurity benchmarks. On SEC-bench Pro and ExploitGym, Carbon is calculated by Google with its own harness, while the competitors come from vendors' system cards and reports. The full picture, including the categories where Carbon is not first, is in Gemini 4 Carbon benchmarks compared.

What do “evaluated without guardrails” and “mitigations off” mean?

The announcement specifies that the cybersecurity benchmarks are “evaluated without guardrails”. Without guardrails means the test measures what the model can do, not what the final product will allow it to do. A real service will apply filters against abuse, so behavior for an ordinary user will be different.

In the methodology Google gives these details:

• ExploitGym: one attempt per task, no internet access, mitigations off. A task counts as solved only if the exploit captures the flag and an LLM-based judge confirms that the vulnerability is the intended one. Google measured with a 6-hour timeout and also a 10-hour one.
• SEC-bench Pro: the 183 tasks of the May 2026 “JavaScript engine” split, pass@1, averaged over 3 attempts.
• CWE-bench: programmatic pass@1 ranking, with ties resolved by pass@4.

We read “mitigations off” as a test environment more permissive than an up-to-date, protected system: in the notes we consulted, Google does not elaborate. The 54.8% on ExploitGym is therefore not the probability of breaching a company network: it shows how many lab exercises the model completes.

What do Chrome and Wiz say, and what do they leave out?

Two testimonials appear in the announcement: the Chrome team reports that Carbon did “more than 10 times better” than a major frontier model from another lab at generating high-quality patches. Wiz, which Google calls its leading cloud security platform, sees Carbon at the top of web penetration testing benchmarks, a key capability for its Scan for Good initiative.

These are useful but incomplete signals. The competing lab is not named, there is no number for Wiz, and we do not know by what criteria a patch was judged “high-quality”. We treat them as hints of direction, not as proof.

Is Gemini 4 Carbon resistant to prompt injection?

On indirect prompt injection, meaning instructions hidden in a document or web page that an agent reads, Google reports on the Gray Swan benchmark 0.7% successful attacks for Argon and 0.0% for Carbon. According to the announcement, Carbon withstood all the attempts evaluated.

This matters to anyone who wants to use an agent on email or attachments, but a benchmark has a finite number of attacks and a real attacker invents new ones. The safety report linked in the announcement covers Argon and contains no data on Carbon. Google describes the same multilayer stack as for Argon: model training, real-time defenses against abuse, prompt injection resilience and chain-of-thought monitoring.

The real defense lives in the application, not in the model: if the agent has read-only permissions and actions go through an approval, a hostile email does little damage. We develop this in the guide to AI agents with Gemini 4 Argon and in the overview of AI security risks in business.

How do shortcuts, misalignment and unsupported claims change?

Google devotes part of the announcement to how the model behaves when it works alone for hours. These are vendor-declared figures, partly from internal tests.

For an SME, the most concrete part is the one on claims. According to the announcement, Carbon includes methodological caveats inside the result, or does not carry out a blocked action and lists what is missing, instead of making things up. Faced with an ambiguity, it retrieves sources and flags discrepancies to the user before acting.

These remain vendor numbers, and in the parts we read the announcement does not state the baseline for each percentage: do not cite them as a guarantee.

Why does the rollout start with cyber defenders?

The capabilities that help defend also partly help attack: this is dual use. ExploitGym shows it well, because an exploit counts only if it captures the flag. Google is not opening Carbon to everyone: it takes part in the US government's voluntary process for testing models before release and starts with a restricted group of defenders.

The timeline in the announcement has three stages: selected defenders from this week, then other trusted partners through Fairwind, then developers, businesses and consumers “soon”. Google is still gathering feedback and strengthening protections, and has not published a general availability date, the model's name in the API or its context window.

We read it as a risk-management choice, even though Google does not use those words: defenders get the tool first, and those who might abuse it wait for the protections. To decide whether waiting is worth it, read Carbon vs Argon.

What is Google's Fairwind Program?

The Fairwind Program is the channel through which Google gives trusted partners an edge against cyber threats. Priority early access is intended for governments, critical infrastructure operators (healthcare, telecommunications, energy, financial networks) and core technology platforms. Academic defensive benchmarking labs can also apply.

Google vets applicants and access is through a form. The terms of use limit dual-use tasks, require authentication and MFA, and forbid sharing or reselling access. As of 28 October 2026, the program page names only Gemini 4 Argon, along with CodeMender, the code security agent, and does not mention Carbon, even though the announcement links it to the program.

The listed categories do not include small businesses. How Carbon will reach an SME, and under what conditions, Google has not published, and we will not speculate.

What can an Italian SME do today?

The main advice is not to wait for a model you cannot use. Many of the problems an AI for finding vulnerabilities would flag already show up in simple form: outdated software, reused passwords, backups never tested, overly broad permissions. These are hygiene fixes, independent of the model.

1. Take an inventory of what is exposed: website, management software, mailboxes, cloud services, devices. For each one, note who administers it.
2. Turn on two-factor authentication on administrative accounts and on email, and ban shared passwords.
3. Update exposed software and check that a backup actually restores, not just that it exists.
4. If you have custom code, ask for a review with an already available model, using a method that demands proof: file, line, how to reproduce the flaw.
5. Prepare an exercise with synthetic content: an email with hidden instructions, a hostile document. Check that the agent executes nothing.
6. Assign an owner for reports: one person decides what gets fixed and in what order.

For the fourth step, code review with Claude Opus 5.5 and the section on vulnerabilities in the guide to Gemini 4 Argon for software development explain how to ask for verifiable reports. Run tests only on your own systems or with the written authorization of whoever manages them.

Two hypothetical scenarios: a workshop and an accounting firm

Hypothetical scenario: a 15-person workshop with a web-based management system built by a supplier. It is not a Giallo client. You do not need Carbon to start: ask the supplier for the list of the system's dependencies and the date of its last update, then run a code review with an available model, demanding that every report be reproducible. When Carbon becomes accessible, the workshop will already have a method to compare it against.

Hypothetical scenario: an accounting firm that wants an assistant on client emails. This too is an example, not a real case. Here the main risk is prompt injection: a message can contain instructions disguised as a request. The assistant starts with read-only permissions on the mailbox, prepares drafts and does not send. A test email with a hostile instruction checks that nothing goes out. On permissions: approvals and checks on emails.

Where do people go wrong reading these numbers?

The first mistake is treating the benchmark as a measure of real-world risk: SEC-bench Pro covers JavaScript engines and ExploitGym a lab environment, not a business with mixed software. The second is comparing columns with different methods as if they were the same race. The third is taking the 0.0% on prompt injection as immunity and removing the permission controls.

The fourth is letting the model decide what can be done: an agent that finds a vulnerability must not be able to exploit it in production. The fifth is thinking AI makes a responsible person unnecessary: it increases the number of reports, and someone has to decide which ones matter. The framework for assessing the risks of an AI system helps set priorities.

What should you put on your agenda before Carbon arrives?

Write a page with three lists: the systems to protect, the reports you will be able to assess and the actions no agent may take on its own. When Carbon is available, you will have criteria ready to decide whether to adopt it. To choose among the models already available, you need a test on your own code: on CWE-bench, the most homogeneous of the three cybersecurity benchmarks, Argon and GPT-6 Astra are at 68.0% and Claude Opus 5.5 at 67.0%, and the comparison Carbon vs GPT-6 Astra and Claude cross-references the data by activity.

If you want to prepare this page with a technical counterpart, the AI consulting of Giallo starts from your processes and your permissions. For an automation with approvals and minimal access, you can also look at the page on AI agents.