Summary
- Google reports 88.2% on SEC-bench Pro for vulnerability discovery.
- The company also reports 54.8% on ExploitGym and 71% on CWE-bench.
- Initial access is limited to selected cybersecurity partners rather than a general release.
Google has introduced Gemini 4 Carbon, a frontier AI model that the company says substantially improves its performance in finding software vulnerabilities, assessing whether flaws can be exploited and producing corrective patches. The model is being made available first to selected cybersecurity defenders, with broader access to follow after testing and guardrail development.
Google reports a score of 88.2% on SEC-bench Pro for vulnerability discovery, 54.8% on ExploitGym for exploitation assessment and 71% on CWE-bench for patching. These results were measured on the respective evaluation tasks and should not be read as a general probability that the model will find a flaw in any production codebase. The company also reports improvements in generating secure code and completing long-running engineering tasks within its internal workflows.
The new release follows the earlier Gemini 4 Argon model, which Google likewise restricted initially to trusted cyber defenders. Carbon expands the company’s stated capabilities across stages of the vulnerability-management cycle. A finding first has to be identified, its exploitability assessed and the affected code corrected. These are related but distinct technical steps, and errors at any point can create misleading priorities or ineffective changes.
Automated vulnerability discovery can expose complex interactions buried in large software projects, including cases where a weakness is not obvious from a single function. Yet a benchmark result is sensitive to the test set, the surrounding tools and whether the model works within a sandbox or has access to repositories and execution environments. Google’s published figures describe its selected tests; they do not replace external assessments across specific enterprise applications, programming languages and deployment constraints.
Google also says its Chrome team has found Carbon substantially more effective at generating patches than a comparator frontier model in internal evaluations. That is a reported result from its own engineering processes, not an independently verified measure across the wider software industry. A generated patch still needs to preserve functionality, address the root cause and avoid introducing unrelated defects. Teams integrating such models into development workflows must account for those requirements regardless of how quickly the first change is suggested.
The capability has a dual-use dimension. Techniques that make it easier to locate genuine vulnerabilities can assist defenders who can report and patch them, but can also reduce the effort involved in discovering weaknesses that remain uncorrected elsewhere. Google says Carbon is being offered through a controlled programme for selected partners and is participating in a US government pre-release testing process. Those access arrangements are part of how the company is managing a model with advanced cyber capabilities.
European software buyers are likely to encounter the model’s effects first through vendors, maintainers and security researchers granted controlled access, rather than through direct deployment into their own workflows. Faster discovery is useful only when verified findings reach the relevant maintainers and fixes reach deployed systems. An increase in AI-generated candidate reports could also increase triage costs if each submission still needs reproduction and assessment.
Carbon’s published benchmark results cover more than one problem type, so comparing a single percentage across all three would be misleading. SEC-bench Pro measures vulnerability discovery tasks, ExploitGym addresses validating exploitation, and CWE-bench evaluates patch construction. They have different datasets, scoring methods and success conditions. Google says some external benchmarks were evaluated without model guardrails, meaning the reported raw capability does not necessarily describe the behaviour available to an ordinary customer using a restricted deployment. The planned gradual rollout will supply a separate view of practical usefulness.
Google has presented benchmark results and a restricted partner-access model, but the company has not shown that Carbon can independently secure production infrastructure or substitute for accountable code review. Its reported capability will be tested further through partner use, the handling of disclosed vulnerabilities and decisions about the model’s broader availability. The three benchmark figures remain results on different tasks, not one combined security-performance score.
