Google unveils Gemini 4 Carbon, an AI that can find and fix security flaws
- ID
- 40695
- Status
- summarized
- Published
- 29 Oct 2026, 5:08 PM
- Fetched
- 29 Oct 2026, 6:04 PM
- Provider
- SoyaCincau
- Category
- malaysia-tech
- Original URL
- https://soyacincau.com/2026/10/29/google-unveils-gemini-4-carbon-an-ai-that-can-find-and-fix-security-flaws/
- Source URL
- https://soyacincau.com/feed/
Summary
- Score
- 6.0
- Created
- 29 Oct 2026, 6:05 PM
- Tags
- Audience
- developersvibe_codersai_ml_learnerssaas_foundersai_agent_users
What happened
Google DeepMind's Gemini 4 Carbon, released two weeks after Gemini 4 Argon, is a model tuned for multi-day autonomous loops covering vulnerability discovery, exploitability validation and patch generation rather than general chat. It tops the Artificial Analysis Intelligence Index v5.0 at 59, just ahead of Claude Opus 5.5 at 58, and launches on the Gemini API at an introductory USD2.00 per million input tokens and USD10.00 per million output (~RM8.13/RM40.64), later rising to USD4.00/USD20.00, with cached input at a 95% discount (USD0.10 then USD0.20 per million). Google's own numbers show 88.2% on SEC-bench Pro for flaw detection but only 54.8% on ExploitGym for judging exploitability and 71.0% on CWE-bench for generating patches; it trailed competitors on FrontierSWE 2 and OSWorld-2.1, leading 15 of 17 other benchmarks.
Why it matters
The cached-input discount is the number that decides whether continuous multi-repo security scanning is affordable for you: USD0.10 per million tokens during the intro period, USD0.20 at standard rates, versus USD2-4 uncached. But Carbon's 54.8% ExploitGym score means it misjudges whether a finding is actually exploitable roughly four times in ten, so treat its patches as PRs needing review, not auto-merges. Also budget for the 2x price step from introductory to standard rates before committing scan volume.
Discussion angle
Would you let Carbon open patch PRs unattended in your repo? Given 54.8% on ExploitGym, where exactly do you put the human gate, and does the 95% cached-input discount actually change how often you run scans?