Google’s latest frontier AI model combines advanced coding, long-running autonomous workflows and vulnerability detection, while its restricted rollout highlights the growing challenge of balancing AI innovation with cybersecurity risks.
Artificial intelligence is entering a phase in which writing better answers is no longer the only measure of progress. The bigger test is whether a model can solve difficult engineering problems, work through failures over several days, identify software vulnerabilities and help developers fix them without creating new risks.
Google is making a major push in that direction.
On October 28, 2026, Google DeepMind announced Gemini 4 Carbon, a new frontier AI model designed for demanding software engineering, complex agentic workflows and advanced cybersecurity tasks. The launch comes two weeks after the introduction of Gemini 4 Argon, underscoring the pace at which Google is expanding its AI model family.
According to Google, Carbon scored 59 on the Artificial Analysis Intelligence Index v5.0, taking the top position on that overall index at launch. It also reported strong results across three important cybersecurity benchmarks: SEC-bench Pro, ExploitGym and CWE-bench.
The release is significant for two reasons. First, it suggests that AI systems are becoming more capable of handling extended technical tasks rather than simply responding to individual prompts. Second, it highlights the dual-use nature of cybersecurity AI: the same capabilities that help defenders find and repair weaknesses could also be misused if access and safeguards are poorly managed.
Google is therefore pursuing a controlled rollout, beginning with selected cybersecurity defenders before expanding access to other trusted users.
Gemini 4 Carbon Takes the Top Position on the Intelligence Index
One of the headline figures from Google’s announcement is Carbon’s score of 59 on the Artificial Analysis Intelligence Index version 5.0.
The index combines results from multiple evaluations to compare the capabilities of advanced AI models. A score of 59 placed Gemini 4 Carbon at number one on the overall index when Artificial Analysis published its October 28 assessment. Artificial Analysis’s independent index announcement also notes that Carbon did not lead every individual category.
That distinction matters. A top overall score indicates broad strength across the index’s evaluations, but it does not mean a model is the best choice for every programming language, business workflow or scientific problem.
Google’s own published comparison also reports gains in coding, agentic tasks and knowledge work. On the WebDev Arena leaderboard, the company reported that Carbon rose by 89 Elo points to rank fourth, with a score of 1,769. This suggests substantial progress in web-development output, although leaderboard rankings can change as new models and evaluations become available.
For developers, the practical question is not simply which model holds the highest position on a chart. It is whether the system can produce reliable code, follow requirements, recognise mistakes and complete complex projects with less manual intervention.
That is where Carbon’s focus on long-horizon engineering becomes particularly relevant.
From Chatbots to AI Agents That Work for Longer Periods
Traditional chatbot interactions usually revolve around a question, an answer and perhaps a few follow-up prompts. Agentic AI systems are designed to do more: plan a sequence of actions, use tools, inspect results, recover from failures and continue towards a larger goal.
Gemini 4 Carbon is built around this more demanding approach.
Google says its internal teams have used the model for engineering tasks that can run for days, including diagnosing subtle bugs and patching problems across large codebases and low-level systems. Rather than stopping after suggesting a fix, the model is intended to work through successive stages of a technical problem.
Consider a software project with thousands of files. A difficult bug may not originate where it first appears. Developers might need to trace dependencies, reproduce the failure, inspect logs, test alternative explanations and make changes across several components.
An agentic model can potentially assist throughout that process.
However, a long-running workflow is not automatically a successful one. An AI agent can still misunderstand a requirement, make an incorrect change or spend time pursuing an unproductive approach. Reliable systems need appropriate permissions, testing, checkpoints and human review—especially when they can modify production code or access sensitive systems.
The important development is not that AI has eliminated software engineers. It is that increasingly capable models may take on larger portions of the work that engineers previously had to coordinate manually.
Gemini 4 Carbon’s Cybersecurity Benchmark Results
Cybersecurity is one of the central areas in Google’s announcement. The company says Carbon performs strongly across vulnerability discovery, exploitation testing and software remediation.
These are related but distinct tasks. Finding a possible vulnerability is not the same as proving that it can be exploited, and demonstrating exploitability is not the same as producing a reliable fix.
The three benchmark results highlighted by Google are:
| Cybersecurity task | Benchmark | Reported result |
|---|---|---|
| Vulnerability discovery | SEC-bench Pro | 88.2% |
| Exploitation testing | ExploitGym | 54.8% |
| Vulnerability remediation | CWE-bench | 71.0% |
These figures are the results reported in Google’s October 28 announcement. They should be interpreted within the methodology and conditions of each benchmark rather than treated as directly interchangeable percentages.
1. Vulnerability discovery: 88.2% on SEC-bench Pro
Software vulnerabilities can remain hidden in complex codebases for long periods. Some involve subtle interactions between components rather than an obvious coding mistake.
Google reports that Gemini 4 Carbon achieved 88.2% on SEC-bench Pro, a benchmark focused on identifying real software vulnerabilities.
For security teams, stronger automated discovery could help identify weaknesses earlier in the development cycle. It could also allow organisations to examine larger codebases and prioritise issues that deserve specialist attention.
Nevertheless, benchmark performance is not a guarantee that a model will find every critical flaw in a real system. Results depend on the benchmark’s test cases, evaluation rules and the environment in which the model operates.
2. Exploitation testing: 54.8% on ExploitGym
Finding a suspicious piece of code is only one step in vulnerability assessment. Security professionals often need to determine whether a weakness can actually be exploited and what impact it could have.
Google reports a 54.8% result for Carbon on ExploitGym, an evaluation associated with testing exploitability.
This capability could help authorised defenders distinguish theoretical concerns from vulnerabilities that present a practical risk. Better validation may improve prioritisation, helping security teams focus limited resources on the problems most likely to cause harm.
At the same time, exploit development is inherently dual-use. Tools that validate a weakness can potentially help an attacker exploit it. Access restrictions and responsible testing environments are therefore important parts of deployment.
3. Automated remediation: 71.0% on CWE-bench
Identifying a flaw does not secure a system. The underlying cause must be corrected, and the revised software must be tested to ensure that the fix does not introduce additional problems.
Google reports that Carbon achieved 71.0% on CWE-bench for software vulnerability remediation.
The result points to the potential for AI to help developers move from identifying a problem to producing a code-level correction. In a mature workflow, the model could suggest a patch, run tests and present the proposed change for review.
But automated patches still require validation. A change that removes one vulnerability could break a legitimate feature or leave a related weakness untouched. Human review, regression testing and security verification remain important.
Together, the three results suggest that Google is targeting a broader cybersecurity workflow: discover a weakness, assess its significance and help repair it.
Google Reports More Than Twice the Success Rate in Secure Code Generation
Google says Gemini 4 Carbon achieved more than twice the success rate of Gemini 4 Argon in generating secure code on the company’s internal benchmarks.
The comparison is notable because software developers do not need code that merely appears correct. They need code that meets functional requirements without introducing avoidable security problems.
AI-generated code can accelerate development, but it can also contain insecure dependencies, inadequate input validation, faulty authentication logic or other weaknesses. A model that more consistently produces secure code could reduce the amount of corrective work required after generation.
Google also reported that its Chrome engineering team found Carbon performed more than ten times better than a competing frontier model when generating high-quality software patches.
That is a striking comparison, but its scope needs to be understood correctly. It is a result reported by Google for a particular internal evaluation, not evidence that Carbon is ten times better than every competing model across all software engineering tasks.
Independent testing using clearly described methods would help establish how well these results generalise to different projects and development environments.
Google also said its cloud security platform, Wiz, observed leading results for Carbon on web penetration-testing benchmarks used in its Scan for Good initiative. This provides another indication of the model’s intended role in defensive security work, although specific benchmark conditions matter when comparing systems.
Why Google Is Limiting Initial Access
A model that can discover vulnerabilities, test exploitability and generate patches offers clear benefits to defenders. The same capabilities can also create risks if the model is used to target systems without authorisation.
Google is taking a gradual approach to deployment.
According to the company, Gemini 4 Carbon is being made available first to a subset of cybersecurity defenders through the Fairwind Program. Access is expected to expand to additional trusted partners before a wider release to developers, businesses and consumers.
Google also says it is participating in a voluntary US government process for pre-release model testing.
The approach reflects a wider challenge facing frontier AI developers: they need to assess not only what a model can accomplish under normal conditions, but also how it behaves when users attempt to misuse its capabilities or bypass its safeguards.
A controlled rollout gives the company an opportunity to gather feedback, assess risks and refine protections before making the model more widely available.
The exact timing and scope of broader access remain subject to Google’s rollout decisions.
Prompt-Injection Resistance and the Limits of Safety Benchmarks
One of the other headline safety results concerns indirect prompt injection.
Prompt injection occurs when an AI system encounters malicious instructions embedded in content it is asked to process. For example, an agent reading a document or web page might encounter instructions designed to override its intended task or persuade it to disclose information.
Indirect prompt injection is especially relevant to agentic systems because they may inspect external content and then use tools to take actions.
Google says Gemini 4 Carbon recorded a 0.0% attack success rate on Gray Swan’s Indirect Prompt Injection benchmark. In the company’s reported evaluation, this means none of the tested attacks succeeded.
That is a positive result, but it should not be interpreted as proof of perfect or universal protection. A zero success rate on a particular test set does not establish that every possible prompt-injection technique will fail in every deployment.
Security depends on the full system: the model, the tools it can access, the permissions it receives, the data it can see and the safeguards that govern its actions.
Google also reported improvements in model alignment and internal coding reliability. Its announcement says high-severity misalignment alerts dropped by almost 80% in its live coding environments, while unsupported claims fell by approximately half compared with Argon.
These are company-reported internal findings. They offer useful information about Google’s development goals, but the results should not be assumed to apply identically to every user or environment.
For businesses deploying AI agents, the lesson is straightforward: model-level protections should be combined with restricted permissions, careful monitoring, human approval for sensitive actions and regular security testing.
Gemini 4 Carbon Pricing: What Developers Need to Know
Cost is another important factor in the competition between frontier AI models.
Google announced the same introductory token pricing for Gemini 4 Carbon as for Gemini 4 Argon:
| Pricing component | Introductory price |
|---|---|
| Input tokens | $2 per million |
| Output tokens | $10 per million |
| Cached input tokens | 95% below the input-token price |
At the introductory rate, a 95% discount on cached input tokens works out to approximately $0.10 per million cached input tokens, assuming the discount applies to the stated $2 base input price.
Google says the introductory offer will eventually expire, after which the listed prices will rise to $4 per million input tokens and $20 per million output tokens. Developers should check the official pricing page for current terms and eligibility before committing to a production deployment.
The pricing structure could make a difference for applications that repeatedly process similar instructions, reference material or context. Cached inputs can reduce costs when eligible content is reused rather than processed as entirely new input each time.
However, token prices alone do not determine the total cost of an AI system. Developers also need to consider how many tokens their workflows consume, how long agents run, how often they retry tasks and whether the model can complete work reliably without excessive additional calls.
A more expensive model can sometimes be economical if it completes a difficult task with fewer retries. A cheaper model may be preferable for high-volume, simpler requests. The right choice depends on the workload and measured performance.
What Gemini 4 Carbon Means for OpenAI and Anthropic
Google’s announcement adds pressure to a competitive frontier AI market in which major companies are racing to improve reasoning, coding, autonomous task execution and safety.
OpenAI and Anthropic are both important competitors in advanced model development. Google’s emphasis on cybersecurity and extended engineering workflows suggests that the competition is increasingly about specialised capabilities and the ability to complete practical tasks reliably.
The Intelligence Index ranking gives Google a strong headline result. But rankings are only one part of the picture.
Businesses also care about latency, reliability, deployment options, integration with existing software, data governance, support and total operating costs. A model that leads one benchmark may not lead another.
Google has an additional advantage in the breadth of its technology ecosystem, including cloud infrastructure, developer tools and security products. How effectively it connects frontier models to those products could influence adoption.
For its competitors, the challenge is not simply to match one score. It is to build systems that offer a compelling combination of performance, price, security and practical usefulness.
How Businesses Can Prepare for More Capable AI Agents
As AI systems become more capable of carrying out multi-step work, organisations will need to consider how much authority they give them.
For software teams, a sensible starting point is to use AI in controlled development environments, review proposed code changes and run automated tests before deploying them. Access to production systems, credentials and sensitive information should be limited to what the task requires.
Security teams can evaluate AI tools for vulnerability discovery and remediation, but should do so with explicit authorisation and clear rules about which systems may be tested.
Organisations should also maintain a reliable patch-management process. AI-assisted discovery is most valuable when vulnerabilities can be triaged, assigned and corrected without unnecessary delay.
Finally, businesses should measure results against their own requirements rather than relying exclusively on vendor benchmarks. Relevant metrics might include the proportion of valid findings, the quality of patches, false-positive rates, completion time and the amount of human review required.
The aim should be to use AI to strengthen security and productivity—not to replace established controls with unverified automation.
The Bigger Picture: Frontier AI Is Becoming More Capable and More Consequential
Gemini 4 Carbon represents Google’s attempt to push frontier AI beyond conventional chatbot interactions and into sustained engineering and cybersecurity work.
Its reported score of 59 on the Artificial Analysis Intelligence Index, 88.2% on SEC-bench Pro, 54.8% on ExploitGym and 71.0% on CWE-bench provide concrete measures of the capabilities Google is highlighting. The company’s claims about secure-code generation, software patching and prompt-injection resistance add further detail to that picture.
Those results are significant, but they need to be understood in context. Benchmarks measure defined tasks under specific conditions; they do not guarantee flawless performance in the real world. Internal comparisons also require careful interpretation before they can be generalised to every competing system.
The next test will be practical adoption. Developers and security teams will need to determine whether Carbon can consistently improve their work, reduce risks and justify its operating costs.
Google’s decision to restrict initial access to selected defenders also highlights the responsibility that comes with more capable AI. Better vulnerability discovery can strengthen digital infrastructure, but only when the technology is deployed with appropriate controls.
The frontier AI race is no longer just about which company can build a more impressive model. It is about which systems can solve complex problems reliably, operate economically and remain secure as they take on greater responsibility.
For Google, Gemini 4 Carbon is a major step in that direction. Its long-term significance will depend not only on its benchmark position, but on how safely and effectively its capabilities translate into real-world results.
Sources
Google Official Announcement: Introducing Gemini 4 Carbon
Reuters News Report: Google Launches Gemini 4 Carbon AI Model With Cybersecurity Focus