Google Says Its Cyber Models Patch 2.6x More Reliably

Google said on 28 October 2026 that its Gemini Flash cyber models patch software vulnerabilities 2.6 times more reliably than other models. Google Cloud chief executive Thomas Kurian made the claim on Alphabet’s third-quarter earnings call, and added that more than 95% of Wiz customers are adopting AI-powered features.

On the same call, Sundar Pichai said Gemini 4 Carbon is going “first to a subset of trusted cyber defenders before we expand access, and it’s being tested by the US government.” By our count from Google’s own posts, Carbon is the third Google model in 56 days to reach vetted cyber defenders first, after Gemini 3.8 Flash Cyber on 2 September and Gemini 4 Argon on 30 September.

What Google Said on the Call

According to a speech-to-text transcript of the webcast, Kurian said: “The growing risk of cybersecurity threats is also driving strong demand for our AI-powered security platform. Our Gemini Flash cyber models are frontier models that automate vulnerability discovery across twenty programming languages and patch two point six times more reliably than other models.”

He said “Gemini and Google Threat Intelligence autonomously analyzes millions of external events every day with ninety-eight percent accuracy”, and that “more than ninety-five percent of Wiz customers are adopting AI-powered features, and growth continues.” He named Banorte, Jack Henry and AT&T among the organisations these tools protect.

Answering an analyst’s question on Cloud growth later in the call, Kurian said: “given all the cybersecurity threats, we are seeing strong growth in our cybersecurity portfolio.” Alphabet did not give a security revenue figure.

Business Pill · Least Privilege

An evergreen Business Engineer explainer on least privilege, giving each user or system only the access it needs. It explains the general idea only and does not discuss Google’s programme.

Where the 2.6x Comes From

Google’s 2 September post introducing Gemini 3.8 Flash Cyber says: “The Chrome Security team found that 3.8 Flash Cyber produced 2.6 times more correct patches to vulnerabilities in Chrome than the best commercial models that are much larger.” That is Google’s own internal finding; the post does not name the models it was compared with.

On Collinear’s external CWE-bench, the same post reports 3.8 Flash Cyber at “a pass@1 of 47.2% compared to a leading frontier model at 47.8%, yet offered at a significantly lower cost.” Google’s 30 September post says Argon “ties for first place with a top score of 68%” on CWE-bench v1, and its 28 October post puts Carbon at 71.0% on CWE-bench. These scores are as reported by Google.

Gated Access, Model by Model

Google’s 2 September post says 3.8 Flash Cyber is “available to trusted defenders through our new Fairwind Program”, which gives “trusted government authorities, as well as critical infrastructure operators and software maintainers” prioritised access. Its 30 September post says “Argon is currently rolling out to trusted cyber defenders through the Fairwind Program.”

The 28 October Carbon post says Google is “actively engaged in the U.S. government’s voluntary process for pre-release model testing”. It adds: “Starting this week, we will make Carbon available to a subset of cyber defenders and will gradually phase access to additional trusted partners through our Fairwind Program.”

By our arithmetic, 2 September to 28 October is 56 days, or one gated cyber-capable release roughly every four weeks. Earlier, in Alphabet’s 22 July results release, Pichai said “our new Gemini 3.5 Flash Cyber delivers highly cost-efficient performance at the frontier.”

Wiz Inside Google Cloud

Google announced on 18 March 2025 that it had agreed to buy Wiz for $32 billion, “subject to closing adjustments, in an all-cash transaction.” Alphabet’s first-quarter 2026 10-Q says: “On March 11, 2026, we completed our acquisition of Wiz for $29.5 billion, after purchase price adjustments and excluding post combination compensation arrangements.”

The 10-Q says the deal “represents an investment by Google Cloud to accelerate our capabilities in multicloud and artificial intelligence (AI)-driven security”, and that Wiz’s results are reported within the Google Cloud segment. Alphabet does not report Wiz’s revenue separately.

What Microsoft and Anthropic Released

Microsoft AI announced MAI-Cyber-1-Flash inside its MDASH harness on 13 August, saying the pair deliver “world-class performance at 50% of the cost of leading models”. Its 27 October post on MAI Cyber 1.1 Flash says the update delivers comparable performance while “costing 18% less per scan” on an internal evaluation suite. Microsoft says its cyber model now handles about half of MDASH scans.

Anthropic launched its Cyber Mission on 8 October, which it called “a long-term commitment to securing the systems everyone depends on”, and on 27 October published research on an unreleased internal model that found 62 Chrome CVEs and wrote five exploit chains.

Each company’s figures are its own claims. Microsoft’s 13 August post says its system ranks ahead of “Mythos, Gemini and GPT on CyberGym”, while Google’s 2 September post says 3.8 Flash Cyber “surpasses both 3.5 Flash Cyber as well as significantly larger frontier models” on CyberGym.

Connecting the Coverage

Carbon’s benchmark and price launch is in Gemini 4 Carbon Leads AI Index at 59, Priced at Half of Opus, and every Gemini release since July is in the Gemini catalogue. For the full Business Engineer read of both 28 October prints, see the premium analysis Alphabet & Microsoft on the Map of AI.

The Structural Read

As we read the call, Google presented security as a demand driver inside Cloud: Kurian tied “strong demand for our AI-powered security platform” to the growing risk of cyber threats, and later cited “strong growth in our cybersecurity portfolio”.

The headline figure, patching 2.6 times more reliably, traces to Google’s own Chrome Security team in the 2 September post; on Collinear’s external CWE-bench, Google reports 3.8 Flash Cyber at 47.2% against a leading frontier model at 47.8%.

Access is the other half of the pitch: each of the three models was routed through the Fairwind Program to trusted defenders before wider release, and Google says Carbon is in the U.S. government’s voluntary pre-release testing process.

Three Implications

FOR GOOGLE CLOUD Wiz’s results sit inside the Google Cloud segment since the 11 March 2026 close, per Alphabet’s 10-Q, so security growth is reported only as part of Cloud.

FOR BUYERS Google’s cyber models reach customers first through the Fairwind Program, which its 2 September post says gives prioritised access to trusted government authorities, critical infrastructure operators and software maintainers.

FOR RIVALS Microsoft AI and Anthropic each published their own cyber releases in the same weeks, each citing its own benchmarks, so the companies’ claims are not measured on one shared test in these posts.

The Business Engineer Lens

This story maps onto the Business Engineer framework Inside Anthropic’s Permission Layer.

The framework describes the governance layer this way: “It is where decisions are made about who gets access to frontier intelligence, under what conditions, and for which purposes.”

Google’s Fairwind Program is one such access rule in practice, as we read it: Flash Cyber, Argon and Carbon each went to trusted defenders first. The framework is written about Anthropic and does not discuss Google.

What Is Not Established

Alphabet does not report security or Wiz revenue, so the size of the business Kurian described is not disclosed. The 2.6x figure traces to Google’s own Chrome Security team, and the models it was compared with are not named. The size of the Fairwind Program and the number of defenders with access to each model are not given in these sources.

The call quotations come from a speech-to-text transcript of the webcast, not from an official Alphabet transcript.

The Bottom Line

Google said on 28 October that its cyber models patch 2.6 times more reliably than other models and that more than 95% of Wiz customers are adopting AI features, while it rolled out Carbon to a subset of cyber defenders. By our count, that makes three Google models released to vetted defenders first in 56 days, alongside Microsoft’s and Anthropic’s own cyber releases in the same weeks.