"It shows significant gains across coding and agentic tasks as well as across key capabilities critical for cybersecurity defense, landing a firm lead in SEC-bench Pro (88.2%) for finding vulnerabilities, ExploitGym (54.8%) for exploitation, and CWE-bench (71.0%) for patching," Koray Kavukcuoglu, senior vice president of Google DeepMind and chief AI architect at Google, said.
Gemini 4 Carbon's benchmark performance
Google's Gemini 4 Carbon is presented as a frontier model with focused cybersecurity and long-horizon capabilities. According to Google's announcement, Carbon leads SEC-bench Pro at 88.2% for finding vulnerabilities, scores 54.8% on ExploitGym for exploitation, and achieves 71.0% on CWE-bench for patching. On the Artificial Analysis Intelligence Index benchmark, Carbon leads with a score of 59, ahead of Anthropic's Claude Opus 5.5 (58), OpenAI GPT-6 Astra (57), and GPT-6.1 Sol (55).
Google also reported that Carbon delivers "significant performance improvements across the board" for vulnerability detection, validation, and remediation, and that it is twice as likely to generate secure code versus Argon, the closely related model Google released earlier this week.
Behavior under pressure and prompt-injection resistance
Google emphasized behavioral safeguards in Carbon's design. The company said Carbon "attempts to respond to complex or high-pressure tasks by seeking human input in the face of ambiguity rather than 'guessing or forcing a path forward'." In evaluated tests, Google reports that Carbon resisted every evaluated attack attempt at indirect prompt injection, a form of adversarial instruction that seeks to redirect a model away from its intended task.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadRollout strategy: Fairwind Program and government testing
The debut of Gemini 4 Carbon follows the release of Gemini 4 Argon less than a week earlier. Google described a rollout strategy similar to Argon's: initial access limited to a subset of cyber defenders, then expanding access to other trusted partners under what Google calls its Fairwind Program. Google also said it is "actively engaged in the U.S. government's voluntary process for pre-release model testing," placing Carbon inside an official voluntary testing channel prior to wider distribution.
How OpenAI and Anthropic's recent disclosures intersect with Carbon
OpenAI this week released GPT‑6.1 Terra, calling it a fast, efficient model that "excels at communication and computer-based tasks." OpenAI said "GPT‑6.1 Terra meets the Critical threshold in cybersecurity under our Preparedness Framework, and maintains the protections developed for GPT‑6 Astra." The company further stated that GPT‑6.1 Terra is more likely to stay within scope and honestly disclose limitations, and that it showed "strong resistance to malicious instructions designed to divert it from the user's task" in prompt-injection tests.
Anthropic disclosed that an unreleased internal research model had uncovered critical vulnerabilities across widely used software. Anthropic's findings, it said, included a one-click remote code execution in Google Chrome; a one-click exploit chain in Apple Safari that could access browsing history, cookies, and other sensitive data; an Android lock screen bypass; and a denial-of-service bug in the Windows HTTP.sys driver identified as CVE-2026-33096 with a CVSS score of 7.5. Anthropic said all of the identified issues have been fixed by Google, Apple, and Microsoft.
Anthropic framed those disclosures as demonstrating that models can create "sophisticated, multi-step exploits" and, in some cases, produce working exploits with little human involvement that "anyone can run and verify."
What this means for technologists, policymakers, and procurement leaders
- Technologists and security teams: The benchmark claims for Carbon — and Anthropic's demonstration that models can produce working exploits — suggest teams will need to evaluate both defensive uses (vulnerability finding and patch generation) and new risks from automated exploit generation. Carbon's asserted prompt-injection resistance and human-in-the-loop behavior will be operational touchpoints teams test in real environments.
- Policymakers and regulators: Google’s participation in the U.S. government's voluntary pre-release testing and the limited Fairwind Program rollout indicate ongoing engagement with voluntary oversight channels. Regulators will see comparative claims from multiple vendors — Google, OpenAI, Anthropic — about both protections and high-risk model capabilities.
- Affected enterprises and procurement leaders: Buyers will need to reconcile vendor benchmark claims (SEC-bench Pro, ExploitGym, CWE-bench, the Artificial Analysis Intelligence Index) with internal threat models. The competing announcements — Carbon, GPT‑6.1 Terra, and Anthropic’s internal findings — mean procurement decisions will weigh both defensive utility and the controls vendors put in place before broader deployment.
Google's announcement positions Gemini 4 Carbon as both a defensive asset and a test case for pre-release controls: high benchmark marks for vulnerability finding, exploitation, and patching are coupled with claims of safer behavior under ambiguity and resistance to indirect prompt injection. At the same time, Anthropic's disclosure that models can produce verified, working exploits — now patched in Chrome, Safari, Android, and Windows HTTP.sys — underscores a central tension in modern model capabilities: the same techniques that accelerate defense can be repurposed to discover and demonstrate attack chains. Which testing regimes, access controls, and vendor practices will best contain that dual-use dynamic is the central question left by these announcements.
