Google launches Gemini 4 Carbon: a new AI to defend software against hackers

Google DeepMind announced on Wednesday, October 28, 2026, a new AI model called Gemini 4 Carbon — which the company calls its strongest model yet for cybersecurity and long-horizon engineering work. It arrives just two weeks after Gemini 4 Argon, the previous model.

Carbon is built to run the full defence cycle: finding security flaws in software, verifying whether those flaws can actually be exploited by hackers, and fixing them at the root cause. According to Google, its internal teams have watched Carbon work for days without giving up — pushing through dead ends until it found and fixed subtle bugs buried in large codebases.

On external benchmarks, Google reports these results: 88.2% on SEC-bench Pro (finding real vulnerabilities), 54.8% on ExploitGym (validating risk through exploitation), and 71.0% on CWE-bench (patching at the root cause). On the independent Artificial Analysis Intelligence Index v5.0, Carbon ranks first with a score of 59 — ahead of Anthropic's Claude Opus 5.5 (58), OpenAI's GPT-6 Astra (57) and Argon itself (50).

Google also says Carbon generates secure code at more than twice the success rate of Argon, and its Chrome team reported that Carbon produced high-quality patches more than 10 times better than another lab's large frontier model. On internal safety, Google says high-severity misalignment alerts dropped by almost 80%, unsupported claims were cut by about half, and on Gray Swan's indirect prompt-injection benchmark, Carbon resisted every evaluated attack (0.0%, down from 0.7% for Argon).

But there are important caveats. First, most of these figures are Google's own — they have not yet been confirmed by independent testing, and rivals still lead on some other benchmarks. Second, Carbon is not available to the public yet. Starting this week, it goes to a small group of cyber defenders, then to trusted partners through Google's Fairwind Program, while the company also takes part in the US government's voluntary pre-release model testing process. Google has announced no date for giving it to developers, businesses and ordinary users — it says "as soon as possible" after feedback and safeguard improvements. The reason for the caution is clear: a tool that finds and exploits flaws can help defenders and attackers alike, so defenders get it first.

Introductory pricing is set at $2 per million input tokens and $10 per million output tokens — the same as Argon — with prices expected to rise later to $4 and $20.

Last week we reported that a criminal used AI agents to hack more than 100 websites for just $5,000. Carbon is the other side of that story: the same kind of AI capability that can attack is now being used to build defences. The question time will answer is whether defence moves faster than attack.

What does this mean for you?

Small business: Your website, your online shop and your payment systems are hackers' first targets. AI like Carbon means flaws in the software you use — such as Chrome and cloud systems — can be found and fixed faster. But don't wait: keep your software updated, use two-factor authentication, and don't click suspicious links. The best defence still starts with you.

Developers and tech students: Knowing how to write secure code is becoming more important than ever. AI can help you find flaws in your code, but the person who understands cybersecurity is the one who keeps the job. If you are studying technology, learn the basics of security — not just how to use AI.

Banks and mobile money services: Financial systems are the biggest targets. Tools like Carbon can help banks and mobile money providers spot weaknesses before hackers exploit them — protecting customers' money, including that of customers across East Africa who use these services every day. Customers should still stay alert to scam messages.

Parents and teachers: School systems hold children's data — names, photos and grades. As AI gets better at finding flaws, schools and learning platforms must keep their defences updated. Ask your child's school: how often are your systems updated, and who protects children's data?