Google's Gemini 4 Carbon Leads Benchmarks for Finding, Exploiting, and Patching Vulnerabilities Ravie LakshmananOct 29, 2026Artificial Intelligence / Cybersecurity Google on Wednesday took the wraps off Gemini 4 Carbon, its latest frontier model with state-of-the-art cybersecurity and long-horizon capabilities. "It shows significant gains across coding and agentic tasks as well as across key capabilities critical for cybersecurity defense, landing a firm lead in SEC-bench Pro (88.2%) for finding vulnerabilities, ExploitGym (54.8%) for exploitation, and CWE-bench (71.0%) for patching," Koray Kavukcuoglu, senior vice president of Google DeepMind and chief AI architect at Google, said. On the Artificial Analysis Intelligence Index benchmark, Carbon leads with a score of 59, surpassing Anthropic's Claude Opus 5.5 (58), OpenAI GPT-6 Astra (57), GPT-6.1 Sol (55). One of the core focus areas is cybersecurity, where the latest iteration reportedly delivers significant performance improvements across the board, including vulnerability detection, validation, and remediation. Carbon is also twice as likely to generate secure code versus Argon. Google also emphasized that Carbon attempts to respond to complex or high-pressure tasks by seeking human input in the face of ambiguity rather than "guessing or forcing a path forward," as well as resisting every evaluated attack attempt at indirect prompt injection. The debut of Gemini 4 Carbon comes less than a week after the tech giant unveiled Gemini 4 Argon. The release plan is similar to that of its predecessor, with the rollout currently limited to a subset of cyber defenders before expanding access to other trusted partners as part of its Fairwind Program. Google also said it's actively engaged in the U.S. government's voluntary process for pre-release model testing. The development comes as OpenAI released GPT-6.1 Terra, which it described as a fast, efficient model that "excels at communication and computer-based tasks." "GPT‑6.1 Terra meets the Critical threshold in cybersecurity under our Preparedness Framework, and maintains the protections developed for GPT‑6 Astra," OpenAI said. "GPT-6.1 Terra brings with it the alignment improvements of the GPT-6 series. According to our evaluations, GPT-6.1 Terra is more likely to stay within scope and honestly disclose limitations and potential blockers to the user compared to GPT-5.6 Terra. In our prompt-injection tests, GPT-6.1 Terra also showed strong resistance to malicious instructions designed to divert it from the user's task." Earlier this week, rival Anthropic also disclosed that an unreleased, internal research model uncovered critical vulnerabilities in some of the world's most widely used software. This included a one-click remote code execution in Google Chrome, a one-click exploit chain in Apple Safari that could be used to access a user's browsing history, cookies, and other sensitive data, an Android lock screen bypass, and a denial-of-service (DoS) flaw in the Windows HTTP.sys driver (CVE-2026-33096, CVSS score: 7.5). All the identified issues have been fixed by Google, Apple, and Microsoft. "These attack chains demonstrate the model's ability to create sophisticated, multi-step exploits in both open-source and proprietary software," Anthropic said. "These skills have historically been the domain of few specialist teams with expertise in these targets. Now, it’s something models can do with little human involvement, and then prove by producing a working exploit that anyone can run and verify." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. artificial intelligence, cybersecurity, exploit, Software Security, Vulnerability Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security Concerns Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution Two CVSS 9.0 Linux KSMBD RCE Flaws Disclosed on Public Mailing Lists Before Kernel Fixes Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers Ruby Fixes Three Regex Engine Bugs Responsible for Four Critical GitLab RCE Flaws Generative AI Is Erasing Behavioral Tells, Weakening Behavior-Only Detection, Proofpoint Reports Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert ThreatsDay: AI Secrets Leak, PingCAP Source Theft, Signal Hang-Up Flaw, Laravel Auth Bypass + 21 More New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites Critical Flaw in Python’s Popular Pillow Image Library Allows Code Execution via a Crafted Image ⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software WhatsApp Hid Instructions in Help Pages Telling Its AI Chatbot Not to Recommend Privacy Regulators Researchers Demonstrate Node2Shell RCE Exploit on Node.js Build Using Crafted Brotli Data OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell Patches Get the Five-Stage Identity Maturity Roadmap for Governing AI Agents Benchmark Your AI Risk Priorities Against 1,600 CISOs—Download the 2026 Report No Exploit Yet? Preview the Summit Demo on Validating CVE Exposure Download the 2026 Agent Security Report for a Five-Step Risk Reduction Framework Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Secure My Spot Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. The 2026 Identity Crisis: Why Your IAM is Only Half the Story Stop driving blind. See the identity blind spots traditional IAM misses. Watch now. FBI Cyber Division's Brett Leatherman Keynotes SANS CDI 2026, Dec 15 Join SANS CEO James Lyne and the FBI on ransomware disruption and intel sharing, during SANS training in D.C. Why Root and Jailbreak Detection Alone Cannot Guarantee Mobile App Security Your Backup Isn't Ransomware-Proof Just Because It Exists The Least Trusted Author Sets the AI Agent's Privilege Security Rests on Hard Math Problems. Quantum and AI Are Both Coming for Them