Google just dropped Gemini 4 Carbon, an AI model that posts top scores for finding and exploiting vulnerabilities in software — and the same company that silences populist voices and feeds the surveillance machine is giving it to "cyber defenders" before anyone else.
This matters because an AI that leads the field in exploitation isn't just a defensive tool. It's an offensive weapon. According to 9to5Google, Carbon claims a "firm lead" in ExploitGym at 54.8% — that's the benchmark for exploitation, not defense. The model also scores 88.2% on SEC-bench Pro for finding vulnerabilities and 71.0% on CWE-bench for patching. Finding holes and exploiting them at machine scale is a capability that cuts both ways, and the institution deciding who gets it first is Google — a company with the deepest data footprint in American life and a documented history of bending that power against disfavored speech.
The technical picture is clear. The Verge reports Carbon is outperforming top models from OpenAI and Anthropic on some benchmarks. 9to5Google notes it ranks #1 on the Artificial Analysis Intelligence Index v5.0 at 59. On WebDev Arena, it jumped +89 elo points to #4. Google credits the fast release — just two weeks after Argon — to researchers and models "working hand in hand to advance capabilities faster." Translation: the safety guardrails are being built at shipping speed.
On alignment, Google claims Carbon "cuts unsupported claims by approximately 2x over Argon" and reduced "overreach by 26% and under-service by 29%." The company says it trained Carbon to "respond to complex or high-pressure tasks in the right way." But Google's definition of "the right way" is the problem. This is the company whose Gemini image generator refused to render white historical figures, whose YouTube demonetizes conservative creators en masse, and whose search product routinely buries populist outlets. When Google says "alignment," Americans who've been shadowbanned should hear "compliance."
The rollout order tells you who Google serves. Carbon goes to "cyber defenders" this week — a category Google leaves undefined, but which in practice means government agencies, intelligence contractors, and corporate security operations. The same ecosystem that has abused Section 702, FISA, and the Patriot Act year after year. Everyday developers, businesses, and consumers get it "soon." Introductory pricing is aggressive — $2 per million input tokens — doubling after the promo period. Google is subsidizing fast adoption.
The Verge framed this as a benchmark beat — "significant leap in cybersecurity" — with no mention of dual-use risk. 9to5Google listed the ExploitGym score alongside defensive metrics without flagging that exploitation capability is the offensive side of the house. Neither outlet asked who counts as a "cyber defender" or what guardrails exist when an exploitation-grade AI meets the surveillance state.
An AI best-in-class at breaking into systems, deployed first to the security-intelligence crowd, by the company that already tracks what you search, email, watch, and where you walk. The question isn't whether Google can defend your digital life. It's whether anyone can defend it from them.
