Google gives its strongest AI, one that can write attack code, to defenders first. Why Gemini 4 Carbon isn't public yet

Find a hole in software. Write the code that attacks it. Then fix it. Gemini 4 Carbon, the AI Google announced on October 28, set the world's top score on all three.

Yet Google isn't letting just anyone use it. According to the announcement, the first users are "a subset of cyber defenders": vetted organizations such as governments and operators of critical infrastructure like power, telecoms and finance. Developers, businesses and the public will get it "as soon as possible." There is no date.

Why hold back your best model? Google describes its program for defenders, the Fairwind Program, as one that gives trusted partners a critical head start against cyber threats. Two things explain why that head start matters.

First, the skill that finds a hole is the same skill that breaks in through it. Carbon can write working attack code for the flaws it finds. In the wrong hands, it is a hacking tool.

Second, attackers are currently faster. Mandiant, the security firm owned by Google, estimates that flaws are now exploited on average 7 days before a patch is released. The people fixing software are already behind.

So Google chose an order: defenders get it first, so they can find and close the holes before hackers do.

WHAT IS

Gemini 4 CarbonGemini 4 Carbon

Google's most capable AI, strongest in cybersecurity and in long tasks that run for days

1. 2025.10An AI that fixesGoogle unveils CodeMender, which fixes software flaws automatically. It sent 72 fixes to open-source projects
2. 2026.07Governments onlyGemini 3.5 Flash Cyber is announced for governments and trusted partners only
3. 2026.09Argon, defenders firstThe previous model, Gemini 4 Argon, goes to vetted defenders first, then to everyone about two weeks later on October 13
4. NOWCarbon to defendersOn October 28, 2026, Google starts handing its strongest model to a subset of vetted defenders

Gemini 4 Carbon is the newest model in Google's Gemini family. Google calls it state of the art in cybersecurity and long-horizon tasks. Koray Kavukcuoglu, who leads the work, says the team has watched Carbon keep working on a task for days at a time.

It also ranks first, with 59 points, on the Artificial Analysis Intelligence Index, an independent measure of overall capability. Anthropic's Claude Opus 5.5 is second with 58 and OpenAI's GPT-6 Astra third with 57.

Introductory pricing is $2 per million input tokens and $10 per million output tokens. Vetted organizations get access through the Fairwind Program, which already has more than 650 partners worldwide.

In October, DATA TIMES counted 280 personal-data leaks disclosed in Japan over 47 days. One thing stood out: attackers had already started using AI.

So when will defenders get AI of their own? Carbon is part of the answer. We went through Google's announcement and evaluation report, threat research on how fast attacks now move, how other AI companies hand out their models, and the situation in Japan, all from primary sources.

Google showed Carbon's ability with three scores that follow a defender's workflow. Think of a house before a break-in:

• Find: look for the weak lock. On SEC-bench Pro, a test of finding software holes (vulnerabilities), Carbon scored 88.2%
• Attack: check whether you can really get in through it. On ExploitGym, a test of writing attack code (exploits), it scored 54.8%
• Fix: change the lock. On CWE-bench, a test of writing code that fixes the hole, it scored 71.0%

All three were state of the art at the time of the announcement.

Google measured and published its AI's ability to write attacks

What surprised us most was the middle one, "attack." Google measured its own model's ability to write attack code and published it side by side with other AIs.

According to Google's evaluation report, the test runs offline and gives the model one attempt per task. A task only counts as a success if the attack code is confirmed to hit the intended flaw.

In other words, roughly every other time, Carbon wrote attack code that actually worked. The open-weight models on the right of the chart, whose internals anyone can download, scored 15–18%. That is a gap of more than three times.

It keeps hunting for holes for days

The scores are only part of the pitch. Carbon's other selling point is long tasks. Without someone guiding it step by step, it can keep investigating, testing and fixing for days.

Seen from the attacker's side, that is a frightening ability. A hunt for holes that takes human experts weeks, an AI can run without a break. That is exactly why Google designed the rollout so that defenders hold this power first.

There are numbers to watch, too. VentureBeat reports that the rate of confident wrong answers rose from 4% in the previous model to 11%. No detailed technical report is out yet. The scores are Google's own, and outside testing has yet to come.

So who gets Carbon first? Google's Fairwind Program page lists three priority groups:

• Governments and national cyber authorities
• Critical infrastructure operators in health, telecoms, energy, finance and similar fields
• Companies that run core technology platforms used by many people

Google vets every applicant, including background checks. Access is limited to in-house security, incident-response and penetration-testing teams. Malicious uses such as creating malware are banned, and access cannot be resold or shared.

The previous model went public in about two weeks

"Defenders first" is not new for Google. The previous model, Gemini 4 Argon, was rolled out first to vetted defenders on September 30, then released to everyone on October 13, about two weeks later.

With Argon, Google said defenders would get a version without cyber guardrails. The public version is built to refuse requests that look like attacks. Vetted defenders can use the model's full power without those limits. Google has not said when Carbon will go public.

Anthropic won't release its model; OpenAI followed

Other AI companies are moving the same way.

Anthropic went first. In April 2026 it decided not to release its cyber-capable model, Claude Mythos, to the public. It created Project Glasswing, a program open only to 12 companies, including Anthropic itself, AWS, Apple, Microsoft and Google, plus more than 40 other organizations. The group has found thousands of serious holes hidden in old software.

OpenAI CEO Sam Altman at first criticized this approach as fear-based marketing by people who want to keep AI in a few hands. Nine days later, OpenAI restricted its own cyber model to vetted defenders. For GPT-6.1 Terra, released October 26, OpenAI's internal safety framework treats the model's cyber capability as the highest level, "Critical".

Even the company that criticized the idea adopted it within months. Cyber AI that is too strong gets handed out only after vetting. That has become the industry's playbook in 2026.

Why rush the model to defenders? Because of how fast attacks now move.

In its March 2026 annual report, Mandiant estimated the average time to exploit at minus 7 days. On average, attacks begin a week before a patch is out. For the sixth year running, exploiting a vulnerability was also the most common way in (32% of intrusions).

Waiting for a patch and then applying it no longer works. You have to find and fix the holes yourself, before the attackers do. That is why an AI that finds and fixes, like Carbon, is in demand.

Attackers are already using AI

In May 2026, the Google Threat Intelligence Group (GTIG) reported that it had found, for the first time, a zero-day exploit that appears to have been built with AI. A criminal group had planned to use it in a mass attack. Google says catching it early may have prevented that. The code even contained the polite explanatory comments AI tends to write, along with made-up numbers.

A GTIG report on October 1 puts numbers on the trend.

Disclosed holes doubled in a little over half a year. Holes actually exploited rose from 10.5 a month in 2025 to 18 a month in January–August 2026. Most of the growth came from turning newly disclosed holes into weapons right away. In one case, attacks began four days after disclosure, and five more groups joined within seven days.

Still, the same report says defenders have a "window of opportunity" before attackers scale up. Handing Carbon to defenders first reads as a way to close holes before that window shuts.

Anthropic's unreleased AI chained attacks in five environments

A sign of how short the window is came the day before Carbon's launch. On October 27, Anthropic's research team said an unreleased internal model had chained together full attacks in five environments. In Chrome, it built a one-click attack that could run code on the victim's computer. It also worked out how to pull photos off a locked smartphone over USB. It found 62 vulnerabilities in Chrome, all now fixed.

The team's advice was short: checking your own code matters more than ever.

So are Japanese companies in this line of defenders?

Neither the Fairwind Program page nor the Carbon announcement mentions Japan or any Japanese organization. Anthropic's Project Glasswing, however, added Hitachi in June. In May, Reuters reported that Japan's three megabanks were set to get access to Mythos, the first Japanese companies to do so. Only a handful of large organizations have joined the line so far.

Damage in Japan is on a record pace

Meanwhile, the damage keeps growing.

According to the National Police Agency, about half of ransomware intrusions came in through VPN devices, the equipment that connects outside workers to a company network. Six in ten victims spent ¥10 million (roughly $67,000 at ¥150 to the dollar) or more to recover. Security company Macnica counts about 329 million records leaked in disclosed incidents in Japan from January to October 27, roughly 100 times the figure two years earlier.

Attackers' use of AI is showing up in Japanese records too. The same police report describes a 19-year-old arrested in June for building ransomware by combining AI-written programs, and a 15-year-old arrested in July for using generative AI to refine an attack program that cancelled about 46,800 accounts on a video streaming service. You no longer need advanced skills to attack.

Japan's "active cyber defense" began on October 1

The defenders' side is moving too. On October 1, 2026, part of Japan's new "active cyber defense" system took effect. It covers 258 operators in 15 sectors, including power, telecoms and finance. It requires them to report cyberattacks to the government and lets the government get into servers used for attacks and neutralize them.

The government will match the equipment that operators register against information on vulnerabilities that are not yet public, then warn only the operators affected. Its explanatory document says plainly that the system is meant to counter vulnerability exploitation that AI is speeding up. A separate scheme that uses communications data to detect attack traffic is due to start in autumn 2027.

Reading the Carbon announcement, the biggest change we saw was not the scores. It was how the model is handed out.

The power to find holes and the power to attack are two sides of the same skill. So the stronger the models get, the more the outcome depends on who gets them first. Google, Anthropic and OpenAI compete hard, yet all three have settled on the same approach: vetted, defenders first. We read that as a sign of just how strong these models have become.

The AI race is moving from a fight for first place to the design of who goes first. Every time a new model comes out, "who can use it first?" is worth asking.

This approach has a problem nobody has solved yet. The organizations that pass vetting are governments, critical infrastructure and big tech companies. But about 60% of Japan's ransomware victims were small and mid-sized companies.

The UK AI Security Institute measured open-weight models, the ones anyone can download, at 4–7 months behind the frontier in cyber capability. So defenders' head start is half a year at most. Companies outside the line may see attack tools spread before defensive tools reach them.

There is also a view from the field. An early user told Reuters they had been finding more holes with AI than they could handle for months. The bottleneck, in other words, is people to fix them, more than tools to find them.

Even without Carbon, there is work to do. If attacks really arrive before patches, as M-Trends shows, the best defense is knowing in advance where your own company might have holes. As the police report showed, about half of ransomware intrusions came through VPN devices. The likely targets are fairly predictable.

Japan's active cyber defense also sends warnings based on registered equipment. Companies that know exactly what they run will benefit sooner, from both the government and AI.

Google hasn't given a public release date, so Carbon is still a while away for most companies. Until then, keep a list of your own holes. In an era when the order of access decides the game, that is the best preparation for anyone at the back of the line.