Gemini 4 Carbon begins limited cyber defender rollout
Gemini 4 Carbon entered a limited rollout on Wednesday after Google reported leading scores across tests of vulnerability discovery, exploitation and patching. The frontier model, meaning a highly capable general-purpose artificial intelligence system, is initially available only to a subset of cyber defenders. Google plans to extend access to other trusted partners through its Fairwind Program.
Google reported an 88.2% score on SEC-bench Pro for finding vulnerabilities, a 54.8% result on ExploitGym for exploiting them and 71.0% on CWE-bench for patching. The company also said the model improved across coding and agentic tasks, in which an AI system plans and carries out a sequence of actions rather than producing only a single response. These results cover three separate stages of security work: identifying a weakness, confirming that it can be exploited and producing a repair.
On the Artificial Analysis Intelligence Index, Gemini 4 Carbon received a score of 59. That placed it ahead of Anthropic's Claude Opus 5.5 at 58, OpenAI GPT-6 Astra at 57 and GPT-6.1 Sol at 55. Google further reported that Carbon was twice as likely as Gemini 4 Argon to generate secure code. This comparison concerns the probability of producing code judged secure in the evaluation, rather than a guarantee that every output will be safe to deploy.
Google also highlighted how the model behaves when instructions are unclear or place it under pressure. According to the company, Carbon is designed to ask for human input when faced with ambiguity instead of guessing or forcing a decision. Google said the model resisted every indirect prompt injection attempt included in its evaluation. Indirect prompt injection occurs when malicious instructions hidden inside content such as a document or web page try to redirect an AI system away from the user's intended task. The claim applies to the attacks Google evaluated and does not establish resistance to every possible technique.
The debut followed less than a week after Google introduced Gemini 4 Argon. Carbon is following a similar release plan, beginning with restricted access rather than immediate general availability. Google also said it is participating in the United States government's voluntary process for testing models before release. Limiting the initial rollout gives selected defenders access first, while website owners and general IT teams cannot yet treat Carbon as a broadly available security tool.
The announcement arrived alongside developments from competing AI providers. OpenAI released GPT-6.1 Terra, describing it as a fast and efficient model suited to communication and computer-based tasks. OpenAI said Terra reached the Critical threshold for cybersecurity under its Preparedness Framework and retained protections developed for GPT-6 Astra. In OpenAI's evaluations, Terra was more likely than GPT-5.6 Terra to remain within the assigned scope and to disclose limitations or obstacles honestly. The company also reported strong resistance to malicious prompt-injection instructions intended to divert the model from its task.
Anthropic separately disclosed results from an unreleased internal research model that found serious vulnerabilities in widely used software. The findings included one-click remote code execution in Google Chrome, which could allow code to run after a single user action, and a one-click exploit chain in Apple Safari that could expose browsing history, cookies and other sensitive information. The model also identified an Android lock-screen bypass and a denial-of-service flaw in the Windows HTTP.sys driver, tracked as CVE-2026-33096 with a Common Vulnerability Scoring System rating of 7.5. Google, Apple and Microsoft have fixed all of the identified issues.
Anthropic said its model could build sophisticated, multi-stage exploits for both open-source and proprietary software, then produce working demonstrations that others could verify. According to Anthropic, this kind of work previously required a small number of specialist teams, while the research model completed it with limited human involvement. Together with Google's benchmark results, the disclosure shows that current evaluations are measuring more than flaw detection: they also examine whether models can validate weaknesses, construct exploits and propose patches.
For hosting providers, website operators and development teams, the practical lesson is that AI-generated security findings and code changes still require human review, controlled testing and timely software updates. Benchmark performance does not prove that a model will understand every production environment or produce a safe repair for every application. AEU-I offers security-first IT, infrastructure and consulting for organisations assessing how security tools fit into their existing operations. Until these models are more widely available, site owners should continue relying on established update, testing and review processes rather than treating AI output as an automatic security decision.