Google has released Gemini 4 Carbon, an upgrade to its Argon model, and only security teams it has vetted can use it at first. On the standard test for finding flaws in real software it scores 88.2%, the best result of any model tested. Google plans to open it to developers and businesses later, after more feedback, and it is taking part in the US government's voluntary pre-release testing in the meantime.
The best bug-finder now goes to defenders first
Argon went to the same group of defenders first, through Google's Fairwind Program for vetted security teams. Anthropic did the same with Mythos Preview in April, and OpenAI released a cyber version of GPT-5.5 with relaxed safeguards to vetted defenders in May. The logic is a head start. A model that is good at finding flaws is equally useful to someone who wants to break in, so the people who protect software get a few weeks with it before everyone else does.
That head start is short, and it renews itself. Carbon arrived weeks after Argon, and each new model finds flaws the last one missed. For the people who run software, a new batch of fixes follows every release.
Finding got cheap, and fixing did not
Follow one flaw from start to finish. A model reads a program's code and flags a weakness. A person checks that it is real. The people who maintain the program write a fix and release it. Then everyone who uses the program has to install that fix. AI has made the first step far faster, but the other three still run at human speed.
The Mythos results show the gap. Ten thousand serious flaws turned up in a month, a fix took about two weeks on average, and the maintainers of open-source tools said they could not keep up. The slow part of security moved from finding to fixing.
Attackers watch the same gap from the other side. The average time between a serious flaw becoming public and being attacked is about three days, and 71% of attacks come in the first week. A fix that exists but is not installed protects nobody.
What it means for a small business
Take a shop owner with an online store, a booking plugin and a router in the stockroom. The plugin's maker releases a security fix on a Tuesday. If the owner installs updates on the first of each month, the fix waits about 15 days on average, which is five times longer than attackers need. If the plugin updates itself, the fix arrives without the owner doing anything.
That is the change for people who are not security experts. When flaws are found faster, fixes arrive more often, and how quickly you install them decides whether the better tools help you. Turn on automatic updates for phones, laptops, routers and anything else that offers them. For software you depend on, ask the supplier one question: how many days pass between releasing a security fix and having it installed for customers? A supplier that runs your software in the cloud installs fixes for you, and that is worth more now than it was a year ago.
People who build small tools with AI get something out of this too. Once Carbon reaches developers, the model that helped write a script can also be asked to look for weaknesses in it before anyone else uses it, and that check no longer needs a security team.