In the last week of October, three of the biggest AI labs made the same pitch from different directions. Their newest models are now good enough at security work that access needs to be managed.

Google's Gemini 4 Carbon is the clearest example. It's a frontier model whose launch post leads with vulnerability discovery, exploitation and patching, and it's going to cyber defenders first, before anyone else.

What Google announced

On 28 October 2026, Google DeepMind introduced Gemini 4 Carbon as its new frontier model. The post describes it as the company's strongest model, with state-of-the-art cybersecurity and long-horizon capabilities. It arrives shortly after Gemini 4 Argon.

Google's reported security results:

Benchmark What it measures Carbon (Google-reported)
SEC-bench Pro Finding vulnerabilities 88.2%
ExploitGym Turning flaws into working exploits 54.8%
CWE-bench Patching vulnerable code 71.0%

Google also says Carbon:

  • ranks first on the Artificial Analysis Intelligence Index (score 59)
  • is more than twice as likely as Argon to write secure code on an internal benchmark
  • generated much better patches than an unnamed rival frontier model in tests by the Chrome team.

One caveat matters: these numbers are self-reported. No independent evaluation had been published when the model was announced.

Who can use it

Carbon is not generally available. Google is rolling it out:

  1. first to a subset of cyber defenders, starting the week of the announcement
  2. then gradually to more trusted partners through its Fairwind Program
  3. and later to developers, businesses and consumers, with no date given.

Google lists introductory API pricing of $2 per million input tokens and $10 per million output tokens, rising to $4 and $20 afterwards. It also says Carbon is part of the US government's voluntary pre-release model testing.

The same week, everywhere else

Gemini 4 Carbon wasn't an outlier:

  • OpenAI released GPT-6.1 Terra and said it meets the "Critical" cybersecurity threshold in its Preparedness Framework, the highest level, according to Help Net Security and The Hacker News. OpenAI says it keeps the safeguards it built for GPT-6 Astra.
  • Anthropic said an unreleased internal model found critical vulnerabilities, including a one-click remote code execution bug in Chrome, a Safari exploit chain, an Android lock-screen bypass and a Windows HTTP.sys denial-of-service flaw (CVE-2026-33096). The Hacker News reports all of them have been fixed.
  • Mistral released open weights for a trillion-parameter model aimed at cybersecurity, TechCrunch reported on 29 October.

Three closed labs are limiting who gets access to their best security models. Meanwhile, an open-weights lab released a big security-focused model that anyone can download. That tension will shape the next year.

Why "find, exploit, patch" is the important phrase

For decades, the slowest part of security has been the human work in the middle: understanding a bug well enough to know whether it's exploitable, and writing a fix that doesn't break anything. These benchmarks measure exactly those three steps:

find the flaw → prove it's exploitable → write a patch (SEC-bench) (ExploitGym) (CWE-bench)

A model that does all three changes the economics on both sides:

  • For defenders, it means auditing code at a scale no team can staff, and proposing fixes along with the findings.
  • For attackers, it means turning a fresh patch into a working exploit faster, because the gap between "fix published" and "exploit in the wild" gets shorter.

We've already seen how short that gap can be. This month, PHP2Shell was being probed before its patch shipped, and Node2Shell was added to CISA's known-exploited list within a week of its fix. Neither case has been publicly linked to AI, but they show how little time defenders get.

The safety claims, and how to read them

Google reports large improvements in Carbon's behaviour. Among them: 0% success for attacks on the Gray Swan indirect prompt-injection benchmark (down from 0.7% for Argon), almost 80% fewer high-severity misalignment alerts in internal live coding, and the model asking for human input when a task is ambiguous instead of guessing.

These matter because a security model that can be manipulated through prompt injection, or that overreaches on an ambiguous instruction, is dangerous in an agent setting. But they're the vendor's own evaluations. The useful habit is the same one you'd apply to any security product: trust, then verify on your own workloads.

What it means for developers

1. Expect more CVEs, faster. If defenders are scanning more code with better tools, more bugs will be found in the libraries you depend on. Your dependency-update process becomes part of your security posture.

2. Patch speed is now the main control. When exploits can follow patches within days, "we update monthly" is a real risk. Automate dependency PRs, keep your test suites trustworthy, and rehearse emergency upgrades.

3. AI review will become a normal part of CI. Running an AI security reviewer on pull requests is likely to become as ordinary as running a linter. It won't replace human review. Model-written patches still need someone who understands the code to read them.

4. Your code may be audited by someone else's model. Open-source maintainers in particular should expect more reports, including low-quality AI-generated ones, and will need a triage process that can keep up.

What might happen next (analysis)

This section is analysis, not reporting.

Staged, defenders-first releases look set to become the norm for frontier models with strong security skills. Expect the gated programmes to expand gradually, and independent benchmark results to appear in the coming weeks, which may or may not match the vendors' numbers. Expect open-weights security models to trigger a policy debate about whether "release to defenders first" means anything when comparable weights are freely downloadable. And expect a rise in vulnerability reports from AI-assisted research across major open-source projects.

Conclusion

The question used to be whether AI could do real security work. In October 2026 the labs answered yes, then made it a question of who gets access first. For developers, the practical response doesn't depend on which model wins: shorten the time between a fix being published and that fix running in production.

Your turn: would you let an AI model open security patch PRs against your codebase? Where would you draw the line?

References

Part of The Wire, a daily brief on the tech and security news that matters to developers. Benchmark figures are as reported by the vendors and haven't been independently verified.