Google launches Gemini 4 Carbon to find and fix software security flaws

A specialized tool for security

Google has introduced Gemini 4 Carbon, a new AI model built to address difficult coding challenges and cybersecurity needs. The company announced the model on October 28, 2026, just two weeks after releasing Gemini 4 Argon. This rapid succession highlights Google's current push to create more capable and specialized AI systems.

Unlike simpler models that might just answer a single question, Carbon is designed for long, complicated tasks. It is built to work through multiple steps to solve problems. This makes it suitable for full-stack web development and complex scientific work that requires deep reasoning.

The primary focus for this specific model is cybersecurity. Software flaws can leave organizations open to various attacks, making early detection vital. By helping developers find these weaknesses early, the model aims to help them strengthen their systems before any vulnerabilities are actually exploited.

Benchmark performance and scores

Google reports that Gemini 4 Carbon currently ranks first on the latest version of the Artificial Analysis Intelligence Index. It earned a score of 59 on that specific index. These results suggest the model is highly capable in the current landscape of AI coding tools.

The company also shared several specific cybersecurity scores to demonstrate its utility. Carbon achieved an 88.2% score on SEC-bench Pro, which measures the ability to identify software vulnerabilities. It also scored 54.8% on ExploitGym, a test used to assess whether those vulnerabilities can actually be exploited by an attacker.

Additionally, the model scored 71.0% on CWE-bench, which focuses on the development of fixes for security weaknesses. These three tests cover different stages of the cybersecurity process, from the initial discovery of a flaw to assessing the risk and finally patching the underlying problem. Google says these results show the model's ability to handle the full defense process.

Comparison with other models

In comparisons provided by Google, Gemini 4 Carbon outperformed other major models in selected coding and cybersecurity tests. Specifically, it showed better results than OpenAI's GPT-6 Astra and Anthropic's Claude Opus 5.5 in these specific categories.

However, Google notes that these benchmark scores do not guarantee that the AI will find every single vulnerability in a real-world system. The company emphasizes that performance in everyday use will be the ultimate measure of success. Benchmark results are useful indicators, but they are not a perfect substitute for live production environments.

The company also noted internal improvements in secure code generation when comparing Carbon to its predecessor, Argon. While these are the published results from Google, the company suggests that the practical impact will depend on how reliably the model works outside of a controlled testing environment.

Controlled rollout and access

Google is not making Gemini 4 Carbon available to the general public immediately. The company plans to take a controlled approach to the release to ensure the tool is used effectively. A limited group of cybersecurity defenders will receive access to the model first.

Following this initial group, Google intends to provide access to additional trusted partners through its Fairwind Program. This staged rollout allows the company to monitor how the model performs in real-world security scenarios. It ensures that the tool is being used by professionals who understand the nuances of cyber defense.

Wider access for general developers, businesses, and consumers is planned for a later stage. This timeline suggests that Google wants to refine the model's reliability with experts before it reaches a broader audience. The goal is to ensure that when it does launch widely, it provides a useful tool for software development and cyber defense.

The future of AI in defense

The release of Gemini 4 Carbon represents a significant step in the integration of AI into the software development lifecycle. By focusing on