The same week one AI model proved it could chain working exploits across five operating systems, another AI model arrived claiming it can find, exploit and patch vulnerabilities better than anything before it. That is not a coincidence. That is the new baseline.
On Wednesday, Google DeepMind unveiled Gemini 4 Carbon. Koray Kavukcuoglu, SVP at Google DeepMind, put the numbers plainly: Carbon lands 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on ExploitGym for exploitation, and 71.0% on CWE-bench for patching. It also leads the Artificial Analysis Intelligence Index at 59, edging past Anthropic's Claude Opus 5.5 at 58 and OpenAI's GPT-6 Astra at 57. And according to Google, it is twice as likely to generate secure code as the model it replaces, Gemini 4 Argon.
Sit with that for a second. One model. The same model. Finding the bug, weaponizing the bug, and fixing the bug. Three benchmark categories that used to describe three completely different job titles.
What the three numbers actually mean
Most security benchmark stories blur together. These three do not, because each one maps to a distinct stage of the incident lifecycle.
SEC-bench Pro measures vulnerability discovery in real-world software. That is your scanner, your pentester, your threat research team.
ExploitGym measures exploitation. That is the part that has historically required patience, creativity and a specialist who understands memory layout, mitigations and target quirks. 54.8% is not a perfect score, but it is a score.
CWE-bench measures patching. That is your remediation backlog, the thing every engineering team swears it will get to next sprint.
When a single model shows strength across all three, the practical consequence is not "AI is good at security now." The consequence is that the distance between disclosure and weaponization collapses, and the distance between disclosure and patch has no reason to. Attackers need one skill: point the model at a target. Defenders need the unglamorous half: decide what to fix, prove it is fixed, and keep the evidence.
The architectural detail worth more than the benchmarks
Buried below the headline scores is a line that matters more for anyone running agents in production: Carbon reportedly responds to ambiguous, high-pressure tasks by asking for human input instead of guessing, and it resisted every evaluated attempt at indirect prompt injection.
Read that twice. Prompt injection resistance is the single most requested property from every enterprise deploying an agent anywhere near untrusted content, whether that content is a webpage, a support ticket, an email thread or a PDF a customer uploaded. If a frontier model holds up under evaluated injection attempts, that is a bigger deal for your architecture than a benchmark point.
The catch is access. Carbon's rollout mirrors Argon's: a limited set of cyber defenders first, then expansion through Google's Fairwind Program. Google also confirmed it participates in the U.S. government's voluntary pre-release testing process. GPT-6.1 Terra, released by OpenAI the same week, meets the Critical threshold under its Preparedness Framework. Which means the most capable security models are currently gated to a small group, and everyone else inherits the downstream effects.
The vulnerability window is now a scheduling problem
Here is the shift that should change how you plan next quarter. For twenty years, security teams have been optimizing mean time to patch against an assumed attacker dawdle. A researcher reports, a vendor writes a fix, an attacker gets around to it eventually. That slack was the entire premise of the vulnerability management industry.
That premise is gone. In the same cycle we saw Anthropic's Frontier Red Team publish exploit chains for Chrome, Safari, Android, Windows and a zero-click Linux kernel path, and we saw a production model optimized for exactly that workflow open up to defenders. The window between a public fix and a working exploit is now measured in hours on the worst days. If your patch SLA is still expressed in days and severity scores, you are tuning a dial for a machine that has already moved on.
Practical translation: prioritization has to be driven by exploitability and reachability, not CVSS alone. A 9.8 on a service nobody can reach loses to a 6.4 on the thing every customer hits.
What aratech clients should do this quarter
Five moves, in order of leverage:
-
Re-baseline your patch SLA by exploitability, not severity. Pair every finding with a reachability check. Downgrade what is not exposed, and escalate what sits on the perimeter path.
-
Inventory everything AI has written. With models twice as likely to generate secure code, the quality curve is improving, but the code volume curve is worse. You cannot secure what you have never counted.
-
Treat prompt injection as a testable control, not a design footnote. Build an adversarial suite for every agent that touches untrusted content, and run it on every model upgrade.
-
Benchmark your own defenses against a frontier model. Run your scanner, your SAST, your dependency tooling against a target where you already know every answer. If a model finds more than your stack, you know which one to buy next.
-
Keep the evidence trail. Regulators and insurers are no longer asking whether you had a policy. They are asking what you did, when, and on what grounds. Automated remediation is only defensible if it is also automatically logged.
The uncomfortable part
Every one of those numbers is self-reported. Google tested its own model on benchmarks it selected. Gemini 4 Carbon may genuinely be the strongest security model on the market, or it may be the strongest at the specific tests a vendor chose to publish. Both can be true.
That is not a reason to ignore it. It is a reason to instrument your own reality. The organizations that will come out of 2027 intact are not the ones that pick the winning model vendor early. They are the ones that can answer, on a normal Tuesday with no warning, exactly which of their systems were exploitable yesterday and which of them are fixed today.
Model speed changed what is possible. Governance speed is still on you.
At aratech, we build the boring half: the context, the inventory, the audit trail, the loop that keeps running after the source code is compiled. Because in a world where one model finds, exploits and fixes, the only durable advantage left is knowing precisely where you stand.