Gemini 4 Carbon claims three leading cyber scores. They are not one autonomy score.

Gemini 4 Carbon arrived with benchmark numbers that are directly relevant to the future of cybersecurity agents. Google's 28 October announcement attributes an 88.2% result to SEC-bench Pro for vulnerability discovery, 54.8% to ExploitGym for exploitation and 71.0% to CWE-bench for patching.

These are not repeated measurements of the same task. The target datasets, success definitions and opportunities for human intervention differ. Treating the numbers as a single model-wide cyber capability score would be mathematically misleading. Google also reports a score of 59 on Artificial Analysis's updated Intelligence Index v5, which measures a broader set of model capabilities rather than enterprise cyber incident outcomes.

The company says early Carbon access will be restricted to selected cybersecurity defenders, with partner access expanding under the Fairwind program. Broad public deployment and independently evaluated real-world operation remain separate events.

The cybersecurity workflow has at least three distinct steps: discover a vulnerability, establish whether it is exploitable, and generate and review a safe fix. An AI system can perform well on one benchmark yet fail during the integrated process because of false positives, environment constraints, policy requirements, unreliable patches or unmodeled operational risk.

Google's announcement also reports days-long agentic engineering work and improved resistance to shortcuts, prompt injection and unsupported claims. These figures and descriptions are primarily company-run evaluations. A zero observed attack success rate in one prompt-injection test is not a guarantee that all future injections are impossible, just as a 0% observed cheating outcome on one benchmark is not a general safety certificate.

The potential benefit to defenders is substantial if these capabilities survive independent evaluation. Faster bug discovery and safer patch suggestions could compress remediation time. But the same underlying technical skills can be dual-use, making access governance, evaluation boundaries and intervention logs important parts of any public assessment.

Cortist's F-004 forecast asks whether autonomous agents can succeed in a strict, independently evaluated defended cyber-range by 2030. Carbon's benchmark scores are related capability signals but do not test the full F-004 outcome. Therefore they are not scored forecast results, and the existing provisional probability remains unchanged.

For evidence to materially update that picture, an outside evaluator should publish held-out task definitions, denominators, end-to-end success, validation of fixes, defense conditions, safety controls and intervention logs. We would also want repeated attempts and failure categories rather than only the best run.