Google Debuts Gemini 4 Carbon With Strong Vulnerability-Finding and Patching Benchmark Scores
Summary
Google says Gemini 4 Carbon scored 88.2% on SEC-bench Pro, 54.8% on ExploitGym and 71.0% on CWE-bench. Its limited rollout is for cyber defenders, while Google reports resistance to evaluated indirect prompt-injection attempts.
Key points
- Google says Gemini 4 Carbon scored 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on ExploitGym for exploitation and 71.0% on CWE-bench for patching.
- Google says Carbon is twice as likely as Gemini 4 Argon to generate secure code and resisted every indirect prompt-injection attempt in its evaluations.
- Google says Carbon seeks human input when complex tasks are ambiguous; access is initially limited to some cyber defenders before a planned expansion through the Fairwind Program.
- OpenAI says GPT-6.1 Terra meets its Preparedness Framework's Critical threshold for cybersecurity and showed resistance to malicious prompt injections in its tests.
- Anthropic said an unreleased internal model found vulnerabilities including browser exploit chains, an Android lock-screen bypass and a Windows HTTP.sys denial-of-service flaw, CVE-2026-33096; Google, Apple and Microsoft have fixed the reported issues.
Article Details
- Event Type
- Google launched Gemini 4 Carbon, a frontier AI model with reported cybersecurity capabilities.
- Impact
- Google reported benchmark scores of 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on ExploitGym for exploitation, and 71.0% on CWE-bench for patching. It also said Carbon was twice as likely to generate secure code as Gemini 4 Argon and resisted every evaluated indirect prompt-injection attempt. The release is currently limited to a subset of cyber defenders, with planned expansion to trusted partners through the Fairwind Program. Separately, Anthropic reported that an unreleased internal model found vulnerabilities in widely used software, including a one-click Chrome remote-code-execution flaw, a Safari exploit chain, an Android lock-screen bypass, and CVE-2026-33096 in the Windows HTTP.sys driver; Google, Apple, and Microsoft fixed the identified issues.
CVE
People
Vendors
AnthropicOn the Artificial Analysis Intelligence Index benchmark, Carbon leads with a score of 59, surpassing Anthropic's Claude Opus 5.5 (58), OpenAI GPT-6 Astra (57), GPT-6.1 Sol (55).AppleThis included a one-click remote code execution in Google Chrome, a one-click exploit chain in Apple Safari that could be used to access a user's browsing history, cookies, and other sensitive data, an Android lockGoogleGoogle on Wednesday took the wraps off Gemini 4 Carbon, its latest frontier model with state-of-the-art cybersecurity and long-horizon capabilities.Microsoft(CVE-2026-33096, CVSS score: 7.5). All the identified issues have been fixed by Google, Apple, and Microsoft.OpenAIOn the Artificial Analysis Intelligence Index benchmark, Carbon leads with a score of 59, surpassing Anthropic's Claude Opus 5.5 (58), OpenAI GPT-6 Astra (57), GPT-6.1 Sol (55).
Products
AndroidSafari that could be used to access a user's browsing history, cookies, and other sensitive data, an Android lock screen bypass, and a denial-of-service (DoS) flaw in the Windows HTTP.sys driver (CVE-2026-33096,Apple SafariThis included a one-click remote code execution in Google Chrome, a one-click exploit chain in Apple Safari that could be used to access a user's browsing history, cookies, and other sensitive data, an Android lockGemini 4 ArgonThe debut of Gemini 4 Carbon comes less than a week after the tech giant unveiled Gemini 4 Argon. The release plan is similar to that of its predecessor, with the rollout currently limited to a subset of cyber defendersGemini 4 CarbonGoogle on Wednesday took the wraps off Gemini 4 Carbon, its latest frontier model with state-of-the-art cybersecurity and long-horizon capabilities.Google ChromeThis included a one-click remote code execution in Google Chrome, a one-click exploit chain in Apple Safari that could be used to access a user's browsing history, cookies, and other sensitive data, an Android lockGPT-6.1 TerraThe development comes as OpenAI released GPT-6.1 Terra, which it described as a fast, efficient model that "excels at communication and computer-based tasks."Windows HTTP.sysand other sensitive data, an Android lock screen bypass, and a denial-of-service (DoS) flaw in the Windows HTTP.sys driver (CVE-2026-33096, CVSS score: 7.5). All the identified issues have been fixed by Google,