Hidden software vulnerabilities can sit in complex systems for months or years. Finding them takes time and expertise, and fixing them takes careful testing. Security teams now have more code, dependencies and attack paths to cover than ever, and they cannot afford to break the systems they protect.
AI is starting to ease that load. Security teams can use AI models to investigate suspicious code, test whether a weakness is exploitable and draft repairs. Google’s Gemini 4 Carbon, announced on 28 October 2026, shows where this is heading. It also shows why human oversight still matters.
What is Gemini 4 Carbon?
Gemini 4 Carbon is Google’s latest frontier AI model. It is built for long, multi-step software engineering and cybersecurity work.
Google says Carbon builds on Gemini 4 Argon, which launched earlier in October 2026. The company reports gains in coding, agentic workflows, scientific tasks, web development and multimodal understanding. Its engineers also tested the model on subtle bugs in large codebases and low-level systems.
The difference from a typical coding assistant is endurance. A standard assistant suggests a function or explains an error. A long-horizon model keeps going. It follows evidence across components, tests a fix and tries again when the first idea fails.
That matters because a bug rarely lives where its symptoms show up. Tracing the real cause means working through dependencies, execution paths and component interactions.
Carbon’s capabilities still depend on testing, implementation limits and human review.
How Does AI Find Software Vulnerabilities?
AI vulnerability detection means using a model to examine code, spot suspicious patterns and point investigators to areas worth testing. It does not replace the investigator.
Complex systems hide flaws in odd places: unexpected component interactions, wrong assumptions about input data, or mishandled permissions and memory. When the evidence is scattered across a large codebase, routine reviews and automated checks can miss it. A model with strong coding and reasoning skills can connect those scattered clues.
Google reports that Carbon scored 88.2% on SEC-bench Pro, a benchmark for vulnerability discovery. That is a result on the benchmark’s test tasks. It does not mean the model finds 88.2% of real-world vulnerabilities.
In practice, AI works best as an extra investigator. Human specialists still need to check the findings, weed out false positives and decide what deserves action.
Can AI Tell Whether a Vulnerability is Exploitable?
Exploitability analysis is the process of checking whether a weakness can actually be used to cause harm under a system’s real configuration. It separates urgent problems from theoretical ones.
Not every defect carries the same risk. Some flaws sit harmlessly in code. Others expose sensitive data or allow unauthorised access once certain conditions are met. Knowing which is which helps teams prioritise.
Google reports that Carbon scored 54.8% on ExploitGym, a benchmark for exploitation-related capabilities. Again, that figure reflects the benchmark’s conditions, not how the model would perform against production software.
For defenders, this kind of analysis can show which findings need immediate attention and which need more evidence. Exploit testing, though, belongs in authorised, controlled environments only. Nobody should treat an AI-generated risk assessment as proof until someone validates it independently.
Can AI Fix Security Vulnerabilities Automatically?
AI-assisted remediation means a model proposes a code change that removes a vulnerability’s root cause. The change still needs human review and testing before it ships.
Finding a flaw is only half the job. A quick patch can hide a visible symptom while the weakness stays in place. A reliable fix requires understanding why the vulnerability existed and confirming the change resolves it.
Google reports that Carbon scored 71.0% on CWE-bench, a remediation-related benchmark. The company also says its internal testing showed more than double Argon’s success rate at generating secure code. These are company-reported results, and their meaning depends on how the tests were run.
The lesson is simple. Judge an AI repair by the quality of the final fix, not by how plausible the code looks. A sound workflow has four steps:
- Review the proposed change.
- Run the relevant tests.
- Check for regressions.
- Confirm the original vulnerability is gone.
Why Do Long-Running AI Workflows Matter for Software Engineering?
A long-running AI workflow is a task where the model works through many connected steps, with each step building on what earlier steps found. It suits problems that one prompt cannot solve.
Some defects demand exactly that. An engineer may need to examine several modules, trace a sequence of events, test competing explanations and rethink the answer after a failed test. Google says its internal teams used Carbon on problems like this and watched it work through dead ends while patching subtle bugs.
The real benefit is not faster code generation. It is less time spent on repetitive investigation, and a more systematic way to explore hard problems.
Picture a security team chasing an application that misbehaves only under certain conditions. An AI assistant could trace the relevant functions, compare likely causes, suggest tests and draft a patch for review. The engineer then decides whether the evidence holds up and whether the change is safe to deploy.
Long tasks carry their own risks. A model can carry a wrong assumption through several stages, misread a test result or keep chasing a bad solution. The longer the task runs, the more checkpoints, intermediate validation and tight permissions matter.
What Are the Security Risks of AI in Cybersecurity?
The main risk is dual use. The same skills that help a defender find flaws could help an attacker find flaws in systems they have no permission to test.
That is why deployment safeguards sit at the centre of AI security work. Google says Carbon includes measures to improve alignment, reliability and resistance to manipulation. It reports that successful cheating on Terminal-Bench 4.0 fell to 0.0%, with attempted cheating at 0.4%. It also reports roughly half the unsupported claims compared with Argon in internal testing.
Read those numbers within their test contexts. They do not guarantee that the model will never fabricate information, bypass a restriction or fail in a real environment.
Reliable security needs more than raw capability. A system has to recognise the limits of its evidence, stay within its permissions and say so when it cannot finish a task safely.
What is Indirect Prompt Injection, and Why Does It Matter?
Indirect prompt injection is an attack where malicious instructions hide inside content an AI agent reads, such as source code, documents or web pages. The goal is to pull the agent away from its assigned task.
AI agents process all of that material, so the risk is real. A poisoned file could quietly redirect a model that is supposed to be reviewing code.
Google reports a 0.0% attack success rate for Carbon on the Gray Swan Indirect Prompt Injection benchmark. In that evaluation, the model resisted every attempt. It is a benchmark result, not proof of immunity to every attack.
Model-level protection should therefore sit alongside conventional controls:
- Access restrictions
- Isolated testing environments
- Activity monitoring
- Human approval for consequential actions
What Should Businesses Check Before Adopting AI for Cybersecurity?
Before adopting AI for cybersecurity, a business should test how well the tool fits its own security processes. A strong benchmark score does not guarantee strong results on your infrastructure. Languages, legacy systems, internal dependencies and security requirements all change how hard a task is.
Check these five areas first:
|
Factor |
What to ask |
|
Accuracy and verification |
Does the model find real vulnerabilities without piling up false positives? Can you test its repairs independently? |
|
Data protection |
What source code and business data will it process, and what controls govern that data? |
|
Access and permissions |
Does it operate only in authorised environments, with clear limits on what it can read, change or run? |
|
Human oversight |
Do qualified engineers review significant findings, approve changes and validate fixes before deployment? |
|
Measurable outcomes |
Does it cut investigation time or improve fix quality under realistic conditions? |
These questions keep the decision grounded in operational value rather than promotional claims.
The NIST Secure Software Development Framework offers a useful reference for building security into the whole development lifecycle. AI tools should support those practices, not replace them.
Is Gemini 4 Carbon Available to Everyone?
No. As of 28 October 2026, Google says Gemini 4 Carbon is in a phased rollout to selected cybersecurity defenders through its Fairwind Program. The company plans to add trusted partners next, then open the model to developers, businesses and consumers through its products. The announcement did not confirm broad availability.
Google announced introductory API pricing of $2 per million input tokens and $10 per million output tokens. Cached input tokens get a 95% discount on the input price. The company says this matches Gemini 4 Argon’s pricing. Verify the terms and pricing once access opens up.
Availability is only one part of the decision. Data handling, deployment options, integration needs, security controls and performance on your own workloads should shape adoption too.
What Does the Future of AI-Assisted Cybersecurity Look Like?
AI-assisted cybersecurity is moving from short coding suggestions towards sustained engineering workflows. Models like Gemini 4 Carbon help teams investigate complex code, assess vulnerabilities and draft repairs.
The opportunity is real, especially for organisations that must review huge codebases and act on findings under time pressure. But value will depend on whether these tools hold up in the environments where businesses actually run.
Benchmarks measure progress. They do not replace independent testing, careful deployment or accountable engineering decisions. A generated patch also does not prove a system is secure.
The practical approach is to treat AI as one capability inside a disciplined security programme. Let models help with investigation and remediation. Verify what they find, limit what they can touch and keep people responsible for the consequential calls.
The long-term payoff will not come from how fast a model finds a weakness. It will come from whether your team turns that discovery into a verified, effective fix without creating new risks along the way.
