Google's Gemini 4 Carbon Leads Benchmarks for Finding, Exploiting, and Patching Vulnerabilities - The Hacker News
Google has unveiled Gemini 4 Carbon, its latest AI model that outperforms competitors in cybersecurity vulnerability detection, exploitation, and patching benchmarks.
Google on Wednesday introduced Gemini 4 Carbon, its latest frontier model with advanced cybersecurity capabilities. The model demonstrates significant improvements across coding and agentic tasks, particularly in cybersecurity defense.
Carbon leads the SEC-bench Pro with a score of 88.2% for finding vulnerabilities, ExploitGym at 54.8% for exploitation, and CWE-bench at 71.0% for patching. On the Artificial Analysis Intelligence Index benchmark, Carbon scores 59, surpassing Anthropic's Claude Opus 5.5 (58) and OpenAI's GPT-6 models.
Cybersecurity Focus
A core focus area for Gemini 4 Carbon is cybersecurity, delivering significant performance improvements in vulnerability detection, validation, and remediation. The model is twice as likely to generate secure code compared to its predecessor Argon.
Carbon attempts to respond to complex or high-pressure tasks by seeking human input in the face of ambiguity rather than 'guessing or forcing a path forward,' as well as resisting every evaluated attack attempt at indirect prompt injection.
Competitive Landscape
The release of Gemini 4 Carbon follows last week's unveiling of Gemini 4 Argon, with a similar rollout plan limited to cyber defenders before expanding to trusted partners through Google's Fairwind Program. Google is also participating in the U.S. government's pre-release model testing process.
OpenAI recently released GPT-6.1 Terra, described as a fast, efficient model that excels at communication and computer-based tasks. The company claims it meets the Critical threshold in cybersecurity under their Preparedness Framework and shows strong resistance to prompt injection attacks.
Meanwhile, Anthropic's unreleased research model discovered critical vulnerabilities in widely used software, including one-click exploits in Google Chrome and Apple Safari, an Android lock screen bypass, and a Windows driver flaw. All identified issues have been patched by the respective companies.
Related
