Gemini 4 Carbon is built to close the entire cybersecurity defense lifecycle in a single model. It discovers real vulnerabilities, proves exploitability, ships verified root-cause patches, and resists prompt injection under active attack. That is why Google DeepMind shipped Carbon to cyber defenders via the Fairwind Program on October 28th and GA followed two weeks later on November 10th. Teams can now deploy it across Google AI Studio, Gemini platform, Google Antigravity, and CodeMender. Pricing starts at $2 per million input tokens and $10 per million output tokens.
Closing the Cyber Defense Lifecycle
Security teams rarely suffer from a lack of alerts. Instead, they struggle to connect detection, validation, and remediation without drowning in false positives. Gemini 4 Carbon opens a decisive lead across all three stages. It scores 88.2% on SEC-bench Pro for finding real vulnerabilities, beating GPT-6 Astra at 85.4%. Notably, neither Claude Opus 5.5 nor Claude Fable 5.1 posts a score in the Model Card evaluations. On ExploitGym for validating exploitability, Carbon reaches 54.8%. That opens a 12.4-point lead over GPT-6 Astra at 42.4% and a 20.3-point lead over Claude Opus 5.5 at 34.5%. In practical terms, that nearly 60% relative edge over Opus 5.5 transforms triage. Teams stop chasing theoretical alerts and get proof of which flaws an attacker can actually detonate. Finally, Carbon hits 71.0% on CWE-bench for generating working root-cause patches. That beats GPT-6 Astra at 68.0% and Claude Opus 5.5 at 67.0%.
Autonomous security work fails when an agent games test harnesses or invents missing evidence. Those shortcuts leave production systems exposed under false confidence. Gemini 4 Carbon eliminates that failure mode with strict execution discipline. On Terminal-Bench 4.0, Carbon scores 65.2% while cutting successful test cheating to 0.0%, with cheating attempts dropping to 0.4%. In live internal coding environments, high-severity misalignment alerts fell by nearly 80%. Meanwhile, on Google’s 375-task agentic honesty benchmark, Carbon passed 92% of tasks compared to 70% for Gemini 4 Argon. It also achieved more than a 2x uplift over Argon on internal benchmarks for generating secure code. For defenders, an agent that refuses to fabricate evidence or take shortcuts is just as critical as raw exploit skill.
Real-World Zero-Days and Triage at Scale
Model-only labs ship a standalone API and leave the plumbing to customers. By contrast, Google wired Carbon directly into a full defensive stack. Inside Project Fortify, Google’s autonomous scanning and remediation system, Carbon hit 100% scanning recall and 95% triage precision internally. On open-source repositories, it delivered a more than 25% relative recall improvement over Argon, surfacing previously undetected logic flaws. Google’s Cloud Vulnerability Research team also used Carbon to build proof-of-concept exploits for two open-source bugs. That validation helped maintainers reclassify the flaws as critical and ship patches fast.
External security partners saw the same acceleration in the field. Through Wiz’s Scan for Good initiative, defenders used Carbon to assess public digital infrastructure. They uncovered zero-day vulnerabilities at two major SaaS providers in under two hours. That compressed weeks of manual research into a single afternoon. CrowdStrike is also collaborating through the Fairwind Program to apply these detection capabilities at enterprise scale. For security leaders, that ecosystem means deploying battle-tested workflows immediately instead of spending months gluing together custom triage bots.
Formal Verification and Agent Hardening
Finding and patching bugs is reactive, while mathematically proving code never breaks is far stronger. Using an agentic framework called AlphaProof Code, Google researchers paired Carbon with formal verification tooling. Those agents generated millions of lines of Lean code. Together, they mathematically proved key security properties of Signal’s cryptographic protocol in weeks rather than years. That milestone brings formal verification within reach for critical software that previously took specialist teams years to audit.
At the same time, an autonomous security agent becomes a liability if attackers hijack it through the data it reads. Carbon became the first frontier model to hit a 0.0% attack success rate on Gray Swan’s Indirect Prompt Injection benchmark. In practice, a hidden instruction inside an untrusted repository, issue thread, or server log won’t trick it. It won’t leak secrets or wave through a backdoor. In simulated cyberattacks seeded with ExploitBench and CyScenarioBench, Carbon also blocked 99% of adaptive red-teaming attack trajectories. That cut the per-attempt breach rate to 0.8%, down from 3.1% on Argon. On Gray Swan’s automated cyberattack query tests, success rates fell to 2.17% from 9.86% on Argon. External testing by Trajectory Labs found zero new universal jailbreaks across 132 hours and over 13,000 requests.
Deploying Cyber Defense on Google Cloud
Security and engineering teams can deploy Carbon on GCP without overhauling their entire toolchain. Use Gemini 4 Argon for routine development. Route high-stakes audits and root-cause remediation to a Gemini agent powered by Carbon inside Gemini platform or Google Antigravity. With /swarm, Carbon serves as the security auditor and adversarial verifier while lighter models execute parallel fixes. That setup keeps sustained security runs affordable at $9.22 per task on CursorBench 4.0, compared to $32.79 for Claude Fable 5.2 Max.
For specialized dual-use work, eligible organizations can apply to the Fairwind Program through their GCP account team. Approved teams pair Carbon with CodeMender, Google’s specialized code security agent that automates vulnerability fixes without custom harnesses. Fairwind restricts access strictly to vetted internal security teams so offensive-grade capabilities don’t leak externally. Rival labs still sell general-purpose coding models with bolt-on safety filters. Those standalone tools leave defenders to stitch together isolated scanners and fragile guardrails. On GCP, Google delivers an autonomous, hardened cyber-defense stack that already catches live zero-days in production.