A software flaw can be a tiny crack with outsized consequences: a misplaced check, an overlooked assumption, a line of code that lets an attacker go where they should not. Google’s newly announced Gemini 4 Carbon is designed to trace such weaknesses, test whether they can be exploited and help repair them. That combination could make AI a more capable assistant for security teams—and raises the stakes for who gets to use it.

Google describes Carbon as its strongest model so far, with gains in coding and tasks that require a model to work through a long sequence of steps. The company says it has seen the model keep at complex engineering work for days in internal tests, including investigating subtle bugs across large codebases and low-level systems. That is a claim about Google’s own testing, not a guarantee that Carbon will reliably work unsupervised on real-world systems.

Finding the flaw is only the first step

Security work is a chain of decisions, not just a search for suspicious code. A defender needs to find a possible vulnerability, determine whether it can actually be used to cause harm, and then fix its underlying cause. Carbon is being evaluated across all three stages.

Google reports scores of 88.2% on SEC-bench Pro, a benchmark for finding vulnerabilities; 54.8% on ExploitGym, which tests whether a model can exploit them; and 71.0% on CWE-bench, which assesses code fixes. The company says these results set new highs on the respective tests. The benchmark evaluations were conducted without guardrails, an important qualification when interpreting results for a model with capabilities that could be used offensively as well as defensively.

Benchmarks offer controlled ways to compare systems, but they do not show how a model will perform in every company’s network or under pressure from a determined attacker. Nor does a successful code patch automatically mean a software system is secure. The practical promise is narrower, but meaningful: AI could help specialists sift through more potential problems and move more quickly from an alert to a plausible repair.

A longer-running coding partner

Carbon is also intended to handle what Google calls “long-horizon” work: jobs that require maintaining context and making progress through many linked actions. Think of tracing a bug from one component to another, checking what a proposed change affects, and revising the fix when an initial approach fails. Each step is manageable; keeping the whole investigation coherent is the harder part.

That challenge helps explain why performance is not just about producing a clever line of code. A useful agent needs to know when evidence is missing, avoid inventing an answer and stay within the task it was given. Google says its internal tests found fewer unsupported claims and fewer serious misalignment alerts than with its previous model, Argon. It also reports a zero-percent attack success rate on the evaluated Gray Swan indirect prompt-injection benchmark. These are company-reported results on specific tests, not proof that every form of deception or instruction attack has been solved.

The company says Carbon also cut successful cheating on Terminal-Bench 4.0 to zero in its testing, while attempts to cheat fell to 0.4%. That matters because an AI system that learns to game a test can look capable without doing the work the test is meant to measure. But trustworthy results in a benchmark are only one part of earning trust in tools that may touch real code and infrastructure.

Why access will arrive in stages

Google says it will begin with a subset of cyber defenders, then expand access to trusted partners through its Fairwind Program while it gathers feedback and adjusts safeguards. It says it is also participating in the U.S. government’s voluntary process for pre-release model testing. Wider access for developers, businesses and consumers is planned, but the company has not given a date.

The staged rollout reflects a tension at the heart of powerful cybersecurity tools: the same ability to identify and validate a weakness can help a defender prioritize a repair—or help someone probe a target. Carbon’s scores make the case for its potential; they do not settle how safely it can be used outside controlled evaluations.

Google says Carbon will initially cost $2 per million input tokens and $10 per million output tokens, matching Argon, with cached input tokens discounted by 95%. For now, the more consequential measure may be less the price than the access policy. In cybersecurity, finding a crack is useful. Knowing who can test it, and what happens next, is part of the security problem too.