Gemini 4 Carbon Cybersecurity Automation: Strong Scores at Each Stage

Finding a vulnerability, confirming it can be exploited and deploying a verified fix are distinct stages of security remediation — and they usually sit in three different queues. On October 28, Google announced Gemini 4 Carbon and reported leading scores on separate benchmarks for each of those stages, per Google's Gemini 4 Carbon Leads Benchmarks for Finding, Exploiting, and Patching Vulnerabilities. That is the honest version of the Gemini 4 Carbon cybersecurity automation story: strong results stage by stage, not a proven end-to-end workflow. Access, for now, covers a selected group of cyber defenders, with broader availability undated.

What Google announced on October 28

Google describes Carbon as its strongest model, citing state-of-the-art cybersecurity and long-horizon capabilities, per Google's Gemini 4 Carbon Leads Benchmarks for Finding, Exploiting, and Patching Vulnerabilities. It ranks first on version 5.0 of the Artificial Analysis Intelligence Index with a score of 59, ahead of Claude Opus 5.5 at 58 and GPT-6 Astra at 57, per the same report — a one-point margin that should not be read as a material operational advantage. Carbon led in 15 of the 17 benchmark rows in Google's comparison table; GPT-6 Astra led on FrontierSWE 2 and Claude Opus 5.5 led on the OSWorld offline evaluation, per Google unveils Gemini 4 Carbon, retaking the world's no. 1 spot on updated, harder benchmarks — but access is limited.

On duration, Google reports internal runs lasting days, with the model working through failed approaches while diagnosing bugs in large codebases, per the same VentureBeat report. Treat that as an internal observation, not a production completion rate: Google has not published how often such runs finish without human rescue.

Three scores, three different jobs

Read the security numbers as three separate stages, because they are not equally strong — and they are separate benchmark results, not the success rate of one integrated remediation workflow. Carbon scored 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on ExploitGym for exploitation, and 71.0% on CWE-bench for patching, per Google's Gemini 4 Carbon Leads Benchmarks for Finding, Exploiting, and Patching Vulnerabilities. Against its predecessor, the biggest gain was in exploitation testing, up from 42.0%, while patching rose from 68.0% and finding rose from 83.4%, per Google unveils Gemini 4 Carbon, retaking the world's no. 1 spot on updated, harder benchmarks — but access is limited.

That spread is the operational lesson. Finding suspicious code does not establish an exploitable defect, and demonstrating an exploit does not establish that a repair works, per the same VentureBeat analysis. Score each stage separately and you can see where a model helps; blend them and you hide the weak stage — exploitation validation, at 54.8%, is still close to a coin flip.

Google also reports more than twice its predecessor's success rate at generating secure code in internal testing, per Google unveils Gemini 4 Carbon, retaking the world's no. 1 spot on updated, harder benchmarks — but access is limited. On the Gray Swan indirect prompt-injection benchmark, its attack-success rate fell to 0%, down from 0.7% for the predecessor, per Google’s Gemini 4 Carbon leads updated benchmarks, but access remains limited. That is a benchmark result, not immunity to prompt injection.

The caveats are part of the story

Three limits should shape any buying decision. First, the external cybersecurity evaluations were run without guardrails, so the scores do not establish what customers will get under the restrictions that ship with a real deployment, per Google unveils Gemini 4 Carbon, retaking the world's no. 1 spot on updated, harder benchmarks — but access is limited. Second, the announcement provides benchmark results and descriptions of internal testing, but does not disclose a parameter count, a detailed architecture or a standalone technical report; the safety report linked from it covers the predecessor model, so it should not be read as an assessment of Carbon itself, per Google’s Gemini 4 Carbon leads updated benchmarks, but access remains limited. Third, the gains are uneven outside security: independent testing found Carbon trails several rivals on some professional tasks and records a higher hallucination rate than its predecessor on a factual-knowledge test, per Google unveils Gemini 4 Carbon, retaking the world's no. 1 spot on updated, harder benchmarks — but access is limited. Another summary makes the access point plainly: the model leads a leaderboard, but only vetted defenders can use it for now, per Gemini 4 Carbon: Google's cybersecurity-focused AI model.

Access and pricing: defenders first, no public date

Google is initially providing Carbon to a subset of cyber defenders and plans to expand access gradually to more trusted partners through the Fairwind Program, while taking part in a voluntary government pre-release testing process, per Google’s Gemini 4 Carbon leads updated benchmarks, but access remains limited. No general-availability date has been announced, per Gemini 4 Carbon: Google's cybersecurity-focused AI model. Until then, the predecessor model remains the one customers can actually evaluate through the existing public offering, per Google unveils Gemini 4 Carbon, retaking the world's no. 1 spot on updated, harder benchmarks — but access is limited. For most organisations, Carbon is currently a capability to evaluate, not a production deployment option.

Pricing is announced even though purchasing is not. Carbon launches at $2 per million input tokens and $10 per million output tokens, with cached input 95% cheaper, rising to $4 and $20 after the introductory period — and Google has not said when that period ends, per Google’s Gemini 4 Carbon leads updated benchmarks, but access remains limited. Identical unit prices do not prove identical cost per finished task: the release materials do not provide the token consumption, retries or execution time needed to compare cost per successful patch, per Google unveils Gemini 4 Carbon, retaking the world's no. 1 spot on updated, harder benchmarks — but access is limited.

What this means for your business

1. Pilot individual stages now; do not wait for Carbon. If you have access to a suitable current model, pilot one remediation stage at a time, keep the model selection configurable, and validate any replacement against the same security tests. A model swap does not guarantee equivalent tools, controls or pricing.

2. Measure each stage against your own baseline. For discovery, record validated findings and false positives. For exploitation, record confirmation success and analyst effort — and run validation only on systems authorised for testing. For remediation, measure accepted patches, regression failures and reviewer time. Without a baseline from your current process, a pilot cannot show incremental value.

3. Re-test under your own guardrails. The headline scores were produced without guardrails. Run the model on your own known vulnerabilities, with your production restrictions on, before trusting any number in a remediation plan.

4. Budget cost per accepted, regression-tested patch. Measure total cost per accepted patch — model usage at the post-introductory rates, validation retries, reviewer effort and fixing failed changes — rather than comparing token prices alone. That is the unit a finance review will ask for.

5. Govern it like a dual-use tool, because it is one. Use isolated test environments, least-privilege tool permissions and audit logs for every agent action, with mandatory human approval before any AI-generated patch is merged or deployed. A model that can find and exploit flaws is exactly why access is vetted first.

Carbon's real signal is not a leaderboard place. It is that finding, proving and fixing flaws is converging into one workflow — and teams with the stages, metrics and approval gates ready will move first when access widens.

Want your security and engineering workflows ready for models like this? Get a free AI audit — we'll map your highest-leverage automation opportunities in one session.