Google says Gemini 4 Carbon beats its predecessors at finding and fixing security flaws
Google’s Gemini 4 Carbon is a frontier AI model designed for software engineering and cybersecurity tasks, with safeguards built on those of its predecessor, Argon.
SEC-bench Pro (Source: Google)
Google says its teams have seen Carbon spend days investigating and fixing bugs across large codebases and low-level systems. The model was also trained to handle complex tasks and high-pressure situations.
Finding and fixing security flaws
According to Google, Carbon improves on its predecessors at finding security flaws, assessing whether attackers could exploit them and writing fixes.
In internal tests, Carbon’s success rate at generating secure code was more than twice Argon’s. Google’s Chrome team reported that Carbon performed more than 10 times better at producing high-quality fixes than another lab’s large frontier model.
“On internal benchmarks, Carbon drives a strong uplift in generating secure code, and in live coding environments with our own teams it shows reduced misalignment and fabrication rates,” Koray Kavukcuoglu, SVP at Google DeepMind and Google’s chief AI architect, said.
Google’s cloud security platform Wiz reported that Carbon led benchmark tests for web penetration testing, which assesses websites and applications for exploitable weaknesses.
In external evaluations, Carbon scored 88.2% on SEC-bench Pro for finding vulnerabilities in real-world software, 54.8% on ExploitGym for determining whether vulnerabilities can be exploited, and 71.0% on Collinear’s CWE-bench for fixing security flaws.
Google says these evaluations were conducted without guardrails.
Improving safeguards and reliability
Carbon builds on Argon’s safety and security framework, combining model training, real-time misuse defenses, resistance to prompt injection and monitoring of the model’s reasoning.
Google says Carbon made roughly half as many unsupported claims as Argon in internal tests. The model also explains its limitations, identifies missing information and checks sources to flag discrepancies before acting on unclear instructions.
On Terminal-Bench 4.0, Carbon’s rate of successful cheating fell to 0%, and its rate of cheating attempts dropped to 0.4%. During coding work with Google’s teams, alerts about serious behavior that conflicted with intended instructions fell by almost 80%.
Google also reports a 26% reduction in actions beyond the task’s scope and a 29% reduction in what it calls “under-service.”
On Gray Swan’s Indirect Prompt Injection Benchmark, Carbon resisted every attack tested. Argon recorded an attack success rate of 0.7%. These attacks attempt to redirect an AI system through malicious instructions embedded in material it reads.
Availability and pricing
Google says access will initially be limited to a subset of cyber defenders, then gradually extended to additional trusted partners through its Fairwind Program.
The company will gather feedback and refine safeguards before making Carbon more widely available to developers, businesses and consumers.
The model will launch at an introductory price of $2 per million input tokens and $10 per million output tokens. Cached input tokens will receive a 95% discount on the input price. After the introductory period expires, prices of $4 per million input tokens and $20 per million output tokens will apply.
