Google's Gemini 4 Carbon Scores 88.2% on Vulnerability-Finding Benchmark, Access Remains Restricted

Google DeepMind has announced Gemini 4 Carbon, a new model it calls its most capable yet. The headline number of the announcement, 88.2%, comes from SEC-bench Pro. In that test, the model finds real vulnerabilities without human help, meaning flaws in real software that could be used to break into a system. Carbon arrives two weeks after Gemini 4 Argon. Google is putting the emphasis on cybersecurity and on long engineering tasks that an agent model works through in multiple steps, sometimes over several days. Access is limited for now: individual cyber defenders will get the model first. Almost all the figures below come from Google's own announcement.

Three tests covering the defender's whole workflow

Google says Carbon handles three stages of a defender's work: finding a vulnerability, assessing how dangerous it is, and fixing it. The company cites three external benchmarks for this. The model ran all three without safety restrictions.

• SEC-bench Pro. Tests the discovery of real vulnerabilities in real software. Carbon scores 88.2%, which Google says is the best result to date. • ExploitGym. Tests whether a discovered hole can be used for an attack. Defenders need this to decide what to patch first and what is not worth patching at all. Carbon scores 54.8%, also the best result. • CWE-bench from Collinear. Tests whether a model can identify the root cause of a bug and write a working fix. Carbon scores 71.0%.

Google also has internal measurements. In the company's tests, Carbon writes secure code more than twice as often as Argon. The Chrome team reported that Carbon performed more than 10 times better than a large model from another lab at producing high-quality patches. Google does not say which model. Wiz, the cloud security platform owned by Google, notes that Carbon leads in web application hacking tests. This is the basis for its Scan for Good initiative.

In the Artificial Analysis Intelligence Index version 5.0, a composite ranking, Carbon is first with 59 points. In WebDev Arena, which rates the quality of websites and web apps built by models, it gained 89 Elo rating points and is now fourth (1769). Google also reports improvements in programming, scientific tasks, web development and understanding of different data types.

It works for days and cheats less

Carbon is built for long tasks in which an agent acts on its own. Inside Google, it ran for several days and kept working when it hit a dead end. Typical tasks include finding the cause of a subtle bug and fixing it in a large codebase or a low-level system.

Carbon inherited its safeguards from Argon. These include model training, real-time protection against misuse, resistance to prompt injection, and monitoring of the model's chain of reasoning. Prompt injection is an attack in which malicious commands are hidden in data the model processes. Google also trained Carbon separately to behave correctly on hard tasks and under pressure. Figures from the announcement:

• Cheating in tests. In Terminal-Bench 4.0, a test of agent work in the command line, successful attempts to bypass the task through a loophole fell to 0.

0%, and the attempts themselves fell to 0.4%. Overall accuracy rose at the same time.

• Warning signals. In live work sessions with Google teams, serious warnings that the model was not acting as it should dropped by almost 80%. • Fabrication.

Claims without source support are about half as frequent as with Argon. When data is insufficient, Carbon writes caveats directly into the output or lists what else is needed to continue, and does not make anything up. • Ambiguous tasks.

Instead of guessing, the model gathers sources and shows the user discrepancies before starting work. • Task boundaries. Unrequested extra actions fell by 26% and unfinished work by 29%.

A multi-step plan is executed more reliably and stays within the scope of the project. • Prompt injection. In the Gray Swan Indirect Prompt Injection test, Argon let through 0.

7% of attacks. Carbon did not let through any of the attacks tested.

Zero percent does not mean the model cannot be hacked: the attack set in the test is limited, and real attackers are more inventive. But for an agent trusted with a repository for several days, this behavior matters.

Who gets access and how much it costs

Google is releasing the model cautiously. The company takes part in the voluntary pre-release model testing run by the US government. This week, individual cyber defenders get Carbon. Access will then open gradually to other trusted partners through the Fairwind program. Developers, companies and ordinary users are promised the model as soon as possible, but there is no timeline. For now, Google is collecting feedback and refining the safeguards.

Pricing is the same as Argon's. For the introductory period, it is $2 per million input tokens and $10 per million output tokens. A token is a small chunk of text into which the model splits a request and a response. Cached input tokens, meaning reused context, cost 95% less. After the introductory period, prices will double: $4 and $20.

If independent measurements confirm Google's figures, vulnerability discovery and patch preparation could be handed almost entirely to a model. Security teams stand to benefit. But a model that is good at finding and exploiting holes can also be useful to attackers, so a closed launch looks sensible. Anyone planning to build Carbon into products should account for the doubling of rates in advance.