Evergreen Tools
|
← Back to AI Tools

Gemini 4 Carbon: 88.2% on Finding Vulnerabilities, 71.0% on Patching, Handed to Defenders First

Google DeepMind announced Gemini 4 Carbon on 28 October 2026 as its strongest model for cybersecurity and long-horizon work. It ranks #1 on Artificial Analysis Intelligence Index v5.0 at 59, scores 88.2% on SEC-bench Pro for vulnerability discovery, 54.8% on ExploitGym and 71.0% on CWE-bench for patching, and is being rolled out to defenders first through the Fairwind Program

Tool Interface

Interactive tool will be available soon

Features

  • ✓ Google reports #1 on Artificial Analysis Intelligence Index v5.0 with a score of 59, on the newest version of the index as of launch
  • ✓ Three separate security numbers instead of a vague claim: SEC-bench Pro 88.2% for finding vulnerabilities, ExploitGym 54.8% for exploitation, CWE-bench 71.0% for patching
  • ✓ On internal benchmarks Google says secure-code generation more than doubles the success rate over Argon, and the Chrome team reports patches more than 10x better than another lab's large frontier model
  • ✓ Long-horizon work is the point: Google says internal teams have watched it run for days to root-cause and patch subtle bugs across large codebases and low-level systems
  • ✓ It gains 89 elo to 1768 and #4 on WebDev Arena, and launches at Argon's introductory price: $2 per million input tokens, $10 per million output, with cached input 95% off

How to Use

  1. Check eligibility first: access currently goes through the vetted Fairwind Program, with developers, businesses and consumers to follow
  2. Once you have it, start on bounded defensive work: a real but contained code-audit or patch task, with every suggested change independently verified
  3. Never treat 'it says it is fixed' as a result: security work needs human review and tests, and Google itself says guardrails are still being iterated
  4. Estimate tokens before estimating cost: $2/$10 per million is introductory pricing and long-horizon tasks are context hungry, so size the bill from your own repository

FAQ

When did it ship?

28 October 2026. Official post: https://deepmind.google/blog/gemini-4-carbon-our-next-frontier-model .

Can I use it today?

Per Google, access starts with a subset of cyber defenders this week and expands gradually to trusted partners through the Fairwind Program. Product surfaces for developers, businesses and consumers follow once guardrails are iterated.

What are 88.2%, 54.8% and 71.0%?

SEC-bench Pro 88.2% is finding vulnerabilities, ExploitGym 54.8% is exploitation and CWE-bench 71.0% is patching. They are three separate official benchmarks, not one capability score.

How does it relate to Gemini 4 Argon?

Google says Carbon builds on Argon, released two weeks earlier, with large gains in cybersecurity and long-horizon tasks, and it keeps Argon's introductory pricing.

Is it safe to release something this capable?

Google frames the defenders-first rollout as deliberate: run it inside vetted groups under guardrails, collect feedback, then broaden. That is a process constraint rather than a technical guarantee, so threat models should still assume worst-case capability.