Every superhero origin story eventually hits the same awkward question: who gets the suit? Google's newest model is pitched as an elite bug hunter, and Google's answer, for now, is that the defenders go first and everyone else waits in line.

A Model Built to Find and Fix Flaws

Google announced Gemini 4 Carbon on October 28, calling it its strongest AI model yet. It builds on Gemini 4 Argon, which launched two weeks earlier, and is designed to identify software vulnerabilities, assess security risk, and write fixes — including long-running engineering work like tracing a bug's root cause across large codebases and low-level systems.

The numbers Google shared: 88.2% on SEC-bench Pro for finding real-world vulnerabilities, 54.8% on ExploitGym for exploitation, and 71.0% on CWE-bench for fixing weaknesses, with those external security evaluations run without guardrails. Google also says Carbon is more than twice as successful as Argon at generating secure code, and Artificial Analysis ranked it first on its Intelligence Index v5.0. Pricing starts at an introductory $2 per million input tokens and $10 per million output tokens, rising to $4 and $20 afterward.

Defenders First, Everyone Else Eventually

Carbon is initially going only to selected cybersecurity defenders, then to trusted partners through Google's Fairwind Program, with no public access date announced. Google says it's taking part in the US government's voluntary pre-release model testing and will keep refining safeguards before a wider release. A model that clears more than half of an exploitation benchmark is not something you hand out like free samples at Costco.

The bigger picture is that the same capabilities that help defenders will eventually help attackers. Just last week, Wiz credited frontier models, including Gemini 4 Argon, with helping it discover and build working exploits for the PHP2Shell flaws in PHP itself. The gap between "a vulnerability exists" and "someone found it" is shrinking fast, which makes unglamorous habits — patching promptly, trimming dependencies, reviewing what you ship — more valuable, not less.

The robots are getting very good at reading your code. Make sure there's less in it worth finding.

Before AI bug hunters on either side of the fence take a pass at your codebase, our free developer security checklist covers the dependency and supply-chain hygiene that closes the easy doors first.

Source: Analytics India Magazine