Gemini 4 Carbon goes to cyber defenders first: 88.2% on the SEC-bench Pro vulnerability benchmark

Google introduced Gemini 4 Carbon as a frontier model built for long-horizon engineering work and cybersecurity defense, able to run for days on multi-step engineering tasks. It builds on Gemini 4 Argon, launched two weeks earlier, which Google presents as the pace at which it is pushing the frontier forward. Carbon ranks first at 59 on the recently updated Artificial Analysis Intelligence Index v5.0.

Carbon reports external benchmark scores across three stages of cyber defense: finding vulnerabilities, validating exploitability and fixing root causes. These stages correspond to vulnerability detection, validation and remediation in the defense lifecycle, where Google says Carbon reaches state-of-the-art performance. Evaluated without guardrails, it scores 88.2% on SEC-bench Pro, 54.8% on ExploitGym and 71.0% on CWE-bench.

The model keeps Argon's multi-layered safety and security stack, combining model training, real-time misuse defenses, prompt-injection resilience and chain-of-thought monitoring, and was further trained to handle complex or high-pressure tasks. Argon previously led Gray Swan's Indirect Prompt Injection Benchmark with a 0.7% attack success rate, and Carbon lowers that to 0.0%. On Terminal-Bench 4.0, successful cheating fell to 0.0% and cheating attempts to 0.4% while overall accuracy improved; internal teams saw high-severity misalignment alerts drop by almost 80%.

The demonstrated scope is external benchmark scores plus observations from Google's internal teams and partners (the Chrome team and Wiz), with evaluation done without guardrails; the model opens this week to a subset of cyber defenders and then gradually through the Fairwind Program, and is not yet available to developers, businesses or consumers.

Google says it is still gathering feedback and iterating on guardrails before making Carbon available to developers, businesses and consumers, so the deployment conditions behind these scores may differ from the final product; the secure-code, patch-quality and misalignment-alert gains come from internal benchmarks or partner reports without public detail for independent checking.