Google unveils Gemini 4 Carbon: 88% on vulnerability discovery and first place in the ranking

Google has introduced Gemini 4 Carbon, a new flagship language model. It was tuned for three jobs: cybersecurity, programming, and multi-day autonomous work by AI agents. On the Artificial Analysis Intelligence Index v5.0, which combines the results of several tests into one overall score, Carbon scored 59 and took first place. The most striking figure in the release concerns security: 88.2% on SEC-bench Pro, a test in which the model has to find genuine vulnerabilities in software. For now, only cybersecurity specialists will get access. Google promises a wider launch later.

What the tests measured and how the model scored

Google showed four benchmarks, and each one covers a different stage of working with vulnerable code: finding a flaw, proving it can be exploited, fixing it, and building a decent interface.

• SEC-bench Pro: 88.2%. The model looks for real vulnerabilities in software.

This is the highest result of the four. • ExploitGym: 54.8%.

Tests whether a discovered vulnerability can be exploited, that is, turned from a theoretical problem into a working attack. This test shows how dangerous a model could be in the wrong hands and how useful it could be to defenders who need to check their own systems. • CWE-bench: 71%.

The model automatically fixes vulnerable code. CWE here stands for the widely used catalog of software weakness types. • WebDev Arena: 1769 Elo, fourth place.

This is a ranking of web interface development built on pairwise comparisons of model outputs. It is the only test where Carbon does not lead.

Google published all the figures itself. Only the overall Artificial Analysis score has been independently confirmed.

Several days of work without a human

For engineers, the most interesting claim is about autonomy. According to Google, Carbon worked inside the company on complex engineering tasks in large codebases for several days in a row, tracing the causes of bugs and fixing them itself. Previously, AI agents typically lost their way on long tasks, got lost in context, or repeated the same actions.

The company also offers comparisons with other models:

• On Google's internal tests, the model writes secure code twice as well as Gemini 4 Argon. • It is 10 times more effective than another frontier model (Google does not say which) at producing quality patches for the Chrome browser. That is the Chrome team's own assessment, not an independent measurement. • 80% fewer serious instruction violations when working with code. These are cases where the agent does something other than what was asked or goes beyond the scope of the task. • Half as many unsupported claims compared with Argon. Put simply, the model presents unverified information as fact half as often.

Google also addresses prompt injection separately. This is an attack in which a command for an AI agent is hidden in the text of a web page or document, and the agent follows it instead of the user's task. According to the company, Carbon repelled all the attacks tested in one of the benchmarks. An important caveat: this is one set of tests, not complete protection. For agents that are given access to email, code, and servers, this risk remains one of the main ones.

Who gets access and how much it will cost

Cybersecurity specialists will get the model first. The logic is clear: a tool that is good at finding and exploiting vulnerabilities is useful to defenders but dangerous if it leaks to attackers. A phased launch gives Google time to check how the model behaves in real-world use. The company has not given a date for the wider release.

API pricing after launch, on the introductory tier:

• $2 per million input tokens (a token is roughly a syllable or a short word, so this is the text you send to the model); • $10 per million output tokens (the text the model generates in response).

For a flagship model, the price is moderate. Agentic tasks that run for several days consume a great many tokens, so the final bill will depend on how economically the model behaves in long sessions. The word "introductory" hints that the pricing may change over time.

What security and development teams should do

While Carbon is available only to a narrow group, the practical takeaway is this. If you are responsible for security, it is worth preparing test repositories and a process for human review of discovered vulnerabilities in advance: even 88% on a benchmark means some of the findings will be false, and the model will miss some real flaws. If you are building products with AI agents, it is better to re-check the figures on instruction violations and unsupported claims against your own tasks as soon as you get access. A developer's claims about its own model are useful as a guide, but they do not replace independent measurements.