Google's Gemini 4 Carbon hunts software bugs⁠.

Google has announced Gemini 4 Carbon, which it calls its strongest model, and says it leads the field in cybersecurity and in long tasks¹. It builds on Gemini 4 Argon, which Google launched two weeks ago¹. The Verge reports that Carbon has taken the top spot on the Artificial Analysis Intelligence Index, ahead of Claude Opus 5.5 and GPT-6 Astra².

Google puts security at the centre of the launch¹. It says Carbon scores 88.2% on SEC-bench Pro, a test of finding real vulnerabilities, 54.8% on ExploitGym, which tests turning a flaw into a working exploit, and 71.0% on CWE-bench, which tests fixing the root cause¹. On its own internal tests, Google says Carbon more than doubles Argon's success rate at writing secure code¹. It adds that its Chrome team found Carbon more than ten times better than another lab's large frontier model at producing high quality patches¹.

Google says the model is built for long tasks, and that its own teams have seen it run for days on hard engineering problems such as tracing and patching subtle bugs across large codebases¹. It also claims Carbon cuts unsupported claims by about half compared with Argon, and resisted every attack in Gray Swan's indirect prompt injection benchmark, where Argon let 0.7% through¹. Those figures come from Google, and it says the external benchmarks were run without guardrails¹.

Nobody outside a small circle can use it yet¹. Google is giving Carbon first to a subset of cyber defenders, then to more trusted partners through a partner scheme it calls Fairwind, and says it is taking part in the US government's voluntary process for testing models before release¹. It promises Carbon to developers, businesses and consumers as soon as possible, without naming a date¹. The introductory price matches Argon, at $2 per million input tokens and $10 per million output tokens, rising to $4 and $20 when the introductory period ends¹.

A sharper bug hunter, not yet yours

Take away the leaderboard and the story is plain. A model that is good at finding holes in software is going first to the people whose job is closing them, and only later to everyone else. That is the sensible order. For a company in Leeds or Bristol, nothing changes this week. The benchmark scores are Google's own choice of tests, reported by Google. There is no British angle in the announcement: it names no UK regulator, partner or launch date.

Where it will matter is the software you already run. The same skill that finds a flaw for a defender can find it for an attacker, which is presumably why access is being rationed. If you pay a supplier to build or look after your systems, the useful question is not which model they use. It is how they find flaws in what they ship you, and how long they take to patch them.

Also today

• Microsoft beats forecasts days after offering mass buyouts

  Microsoft reported $92.3bn of quarterly revenue and $36.6bn of profit, with its Azure cloud division up 48%, two days after offering voluntary buyouts to about 60,000 staff³.

• Ofcom sets out how to prove you are over 16

  Ofcom has recommended photo ID matching, banking checks, face age estimation and digital ID to enforce the UK's social media ban for under 16s, which is due in March⁴.

• Government pilot offers 200 scale-ups a year of support

  A new government pilot, Scale UK Connect, will give 200 high growth UK firms a year of expert advice, investor connections and international opportunities, and businesses can apply now⁵.

• Leak exposes details of 41,000 US homeland security staff

  Names, work addresses and phone numbers of more than 41,000 people at the US Department of Homeland Security have been leaked, including thousands of immigration agents, the BBC reports⁶.

• Microsoft opens its Copilot agent harness to customers

  Microsoft is making the harness behind GitHub Copilot and Copilot Studio available through Microsoft Foundry, so firms can build agents that change AI model without changing the rest of their stack⁷.