On October 28, 2026, Google announced Gemini 4 Carbon, a frontier model (a model at the outer edge of what a lab can currently build, not a small autocomplete helper) for long engineering jobs and for cybersecurity (protecting software from people who want to break it). Koray Kavukcuoglu, who leads this work at Google DeepMind, called it their strongest model yet. You still cannot open a chat window and use it. That lock is the story, not a footnote.
Checked in October 2026 against Google’s launch post, the SEC-bench Pro, ExploitGym and CWE-bench project pages, the BenchLM and Artificial Analysis tables, and Reuters. Gemini 4 Carbon itself was not available to test: access is limited to selected cyber defenders.
Start with a program, not with a score
A program is a list of exact steps a computer will follow. It does not understand what you meant. It does the steps. A bug (a place where those steps do something the author did not intend) is not a ghost in the machine. It is a wrong step, or a missing one. The text on a screen is just those steps, written so a person can read them.
A box that is too small
Picture a program that sets aside a box for 20 letters of a name. Someone types 28. The extra 8 do not politely stop. They spill into the next box in memory (the computer’s scratchpad, where the current name, the next instruction, and other values sit side by side). That spill is a buffer overflow (writing past the end of a reserved box). The author did not intend the neighboring values to change. That unintended change is a bug. For a real-world walk-through of a bug like this reaching a live website, see PHP2Shell, explained from zero.
A bug is a vulnerability only if a stranger can reach it
A button painted the wrong blue is a bug. It is not a vulnerability (a bug an outsider can reach and use to do something they should not). The difference is reach. If only the person at the keyboard can trip it, you have a quality problem. If someone on the internet can send those 28 letters, you have a security problem.
Defense is three jobs, in this order
People say “the AI found a vulnerability” as if that were one action. It is three. First, find the weak spot. Second, prove it with a proof of concept, or PoC (a small input that makes the bug happen on purpose, so you know it is real and not a guess). Third, patch it. A patch (a change to the code that closes the bad path) only counts if ordinary use still works. Turning the feature off is not a fix. It is a shutdown.
The same three jobs are how an attack is built
An exploit (a recipe that turns a bug into an action the computer was not supposed to allow, such as running a program the attacker chose) is the second job taken further. Defenders want that recipe so they know which bugs are emergencies. A crash that cannot be steered is less urgent than a crash that can be steered into taking control. Attackers want the same recipe so they can walk through the door. A benchmark (a fixed exam used to compare models) that grades this skill does not know which hat you are wearing. The ExploitGym write-up from UC Berkeley says this outright: the work is dual-use (useful for defense and, in the same motion, useful for offense).
Do not add the three headline scores together
Google says Carbon scored 88.2 percent on SEC-bench Pro, 54.8 percent on ExploitGym, and 71.0 percent on CWE-bench. Those are three different exams. Said in one breath, 54.8 looks like a failure and 88.2 looks like mastery. They are not grades on the same test. Google also says all three were measured without guardrails (the safety filters that make a model refuse a dangerous request). A score with the filters off is not the score a normal product chat will show you.
What 88.2 percent is actually counting
SEC-bench Pro is an exam in bug hunting. The public project describes 344 tasks on real, hard software: V8 (the JavaScript engine inside Chrome, the program that runs the code of a web page), Firefox, and Linux (the operating system, the master program, behind most servers). The model must find a security bug and hand back a proof of concept. A harness (an automated referee that starts the software, runs the model, and checks the files it produced) accepts or rejects that proof, on a time limit. 88.2 percent means about 88 of 100 of those tasks. It does not mean 88 percent of the bugs in your company, or on the internet.
On that same exam, and only that exam, the bars below are allowed to sit next to each other. BenchLM’s October 29 table is built from provider self-reports (the lab’s own published number, not a referee re-running the test in public). It puts GPT-6 Astra at 85.4 percent and the previous Gemini, called Argon, at 83.4 percent. Carbon’s lead on this one test is real and small: a few tasks, not a new era.
What 54.8 percent is actually counting
ExploitGym starts one step later. You are handed the vulnerability and an input that already triggers it. Your job is to stretch that into code execution (making the computer run instructions the attacker chose). The project site lists 869 real cases across ordinary programs, V8, and the Linux kernel (the core of Linux, where a mistake can control the whole machine). An earlier write-up from the same group said 898. Those are not the same integer, and this explainer does not merge them. Success means a hidden flag (a secret string planted in the test, reachable only if the attack really ran) comes back, and a check tries to confirm you used the intended bug rather than a lucky shortcut.
Carbon’s 54.8 percent is Google’s number on that exam. No public, independent replay of it existed when this was checked on October 29, 2026. Earlier public results, from before Carbon, were lower in raw counts: Claude Mythos Preview worked on 157 cases and GPT-5.5 on 120, and some of those still worked with defenses on. One of those defenses is ASLR (address space layout randomization: shuffling where a program sits in memory so an attacker cannot guess the address). Read 54.8 as the lab’s claim about a hard exam. Do not read it as “Carbon hacks half the world.”
What 71 percent is actually counting
CWE-bench, from Collinear, is the repair exam. CWE means Common Weakness Enumeration (a catalog of bug types, such as “forgetting to check who is allowed to do this”). The version Collinear described in late September has 120 held-out tasks (tasks the model was not supposed to have practiced), covering 73 weakness types. The agent must find the weakness and patch it. Memorizing the public fix scores zero, because each task adds a fresh instance of the same weakness that the published patch never covered, and the sandbox (an isolated copy of the system, with no path to the real one) has no internet.
A pass is strict. The old attack must fail. A variant (a cousin of that attack, not the exact sample input) must fail too. Ordinary behavior must still work. Google’s 71.0 percent is Google’s report. On a related independent table, Artificial Analysis’s CWE-Bench-AA, Carbon was not listed in an October 29, 2026 check, while other strong models sat near 68 to 69 percent. Missing from that table is not a failure. It does mean 71 percent is not yet a referee’s number.
The other numbers, and the discount each one deserves
Carbon is also number one on the Artificial Analysis Intelligence Index, version 5, at 59. An index (a blended score of many different tests, like a report-card average) moves in small steps. A public note the next morning said Claude Opus 5.5 had been at 58 the day before. One point on a blend is a lead. It is not “twice as intelligent.” On internal tests, Google says Carbon is more than twice as successful as Argon at writing secure code, and that high-severity misalignment alerts (warnings that the model is doing something badly off, such as cheating the task) dropped by almost 80 percent inside their own coding tools. The Chrome team reported more than 10 times better high-quality patches than “another lab’s large frontier model.” Google does not name that model. On Gray Swan’s indirect prompt-injection test, attack success was 0.0 percent, versus 0.7 percent for Argon. Prompt injection (hiding new instructions inside a web page, email, or file so the model obeys the attacker instead of you) is a note in a document that says “ignore your boss.” Zero on one test set means every attack in that set failed. It does not mean every future attack will fail. Google also says successful cheating on Terminal-Bench 4.0 fell to 0.0 percent, with attempts at 0.4 percent. That last one matters: a model that cheats an exam is a bad author of a security patch.
Why the door is shut, and what it will cost when it opens
Google is giving Carbon first to a small set of cyber defenders, then to more trusted partners through the Fairwind Program (a staged access list, not a public signup). The company says it is in the US government’s voluntary pre-release testing. Developers, businesses, and consumers come after the guardrails have been tried on that smaller group. When it is sold, the introductory price matches Argon: 2 dollars per million input tokens and 10 dollars per million output tokens. A token (a small chunk of text, often about three quarters of a word) is how these models are billed. Cached input (a repeated chunk the system has already seen) is 95 percent off during that intro, Google says. WebProNews, citing Google, says the later price rises to 4 and 20 dollars per million. Reuters confirmed the introductory price and did not restate the later one, so those two sources stay separate here.
The same week, another lab said a model built five real attack chains
This is context, not a Carbon score. On October 27, Anthropic’s Frontier Red Team (the internal group whose job is to see what a model can do before the public does) said an unreleased research model built five working attack chains, against Chrome, Safari, a locked Pixel 9, Windows, and Linux. A chain (several bugs used in a row, because one bug is often not enough) is harder than a single crash. Write-ups that trace back to Anthropic’s own post agree on the shape. The Chrome chain needed one click and led to 62 critical or high Chrome fixes, patched by Chrome 156. The Linux case is CVE-2026-98432. A CVE (a public ID number for one vulnerability, so two people can be sure they mean the same bug) is how the industry names it. It is scored CVSS 9.8. CVSS (Common Vulnerability Scoring System, a 0 to 10 severity scale) puts 9.8 in critical. Reports describe it as zero-click (the victim does not have to tap or open anything) and as reaching root (the all-powerful account on a Linux machine). The Windows case, CVE-2026-33096, is a remote crash scored 7.5, not a takeover. Anthropic says the flaws were reported and fixed. The same lab has also tightened how its own tests reach the internet, covered in Anthropic cut the internet off its own tests.
Audit Commons read that post and flagged the hole: no count of attempts, no count of failures, no name for the model. Partial corroboration does exist. Vendor notes for the Windows bug, an Apple WebKit fix, the Linux kernel fix, and a run of Chrome credits name Anthropic researchers, several of them “with Claude.” So “a model helped find and chain serious bugs” has public credits behind it. “Here is the exact unattended success rate” does not, because the lab did not publish the denominator (how many tries it took).
What to do on Monday if you defend software
Do not wait for a login. The exams already describe the job. Run any agent only on code you own, and only inside a sandbox, so a wild patch or a wild test cannot touch customers. Do not paste secrets (passwords, keys, customer data) into a model whose exploit score was measured with the filters off. Judge a patch the way CWE-bench does: cousin attacks have to die, and the feature customers use has to live. If you already review code with an agent, compare that bar with what Claude Code /security-review covers. Assume a capable model will not stay only in defenders’ hands. The advantage is the time between finding the bug and shipping the fix, not the secrecy of the model.
Four Gemini 4 Carbon headlines to reject
Do not publish, or believe, any of these. “Carbon now finds 88 percent of vulnerabilities” is false: it cleared about 88 percent of one lab’s tasks, on a reported score, with filters off. “It cannot be prompt-injected” is false: it resisted one published test set. “The Chrome team proved it is 10 times better than the next lab” is unfinished: the other lab is unnamed. “Let it patch production because the benchmark passed” reverses the lesson: a benchmark pass is a reason to test in a sandbox, not a reason to skip review.
Common questions about Gemini 4 Carbon
Can I use Gemini 4 Carbon today?
No. Google is giving it first to a small set of cyber defenders, then to trusted partners through the Fairwind Program. Developers, businesses and consumers come later, after the guardrails have been tried on that smaller group.
How much will Gemini 4 Carbon cost?
The introductory price matches Gemini 4 Argon: 2 dollars per million input tokens and 10 dollars per million output tokens, with cached input 95 percent off during the intro. WebProNews, citing Google, reports a later rise to 4 and 20 dollars per million.
Is Gemini 4 Carbon better at security than GPT-6 Astra?
On SEC-bench Pro only, and only on provider-reported numbers: 88.2 percent against 85.4 percent. That is a lead of a few tasks on one exam, not a referee’s result across all security work.
Were the Gemini 4 Carbon scores measured with safety filters on?
No. Google says the three cybersecurity scores were measured without guardrails, so a normal product chat with the filters on may not match them.
