On October 28 Google announced Gemini 4 Carbon, initially offering access to selected cyber defenders through Fairwind. For a team responsible for an internal application, the interesting unit of work is a closed security ticket. A plausible diagnosis earns attention. Closing the ticket requires a reproducible failure, a change and a test someone else can run.
1. Establish who can run the pilot
Google describes a phased rollout. Check eligibility, which repositories the team may submit and who will review output. While waiting for access, select a previously fixed defect and prepare a sanitized snapshot from before the fix. Remove the answer from issue descriptions and commit history so that the exercise tests investigation. (Fairwind) 🔗 deployment location
2. Read discovery and repair scores separately
Google reports 88.2% on SEC-bench Pro for vulnerability discovery and 71.0% on CWE-bench for patching. Different tasks and scoring rules make subtraction meaningless. These are vendor-reported results. On your own code, track which findings a second engineer can reproduce and how much review time false alarms consume. (Google DeepMind) 🔗 platform integration
3. Ask for three pieces of evidence
Consider an authorization defect in an internal service. Ask for the request path and missing check, then reproduce it in isolation. If reproduction fails, keep the finding open as a hypothesis. For a proposed fix, keep a regression test that fails on the old revision and passes on the new one. A different reviewer should inspect the diff. 🔗 model operations
| Stage | Evidence | Acceptance |
|---|---|---|
| Discovery | Location and trigger | Another engineer reproduces it |
| Repair | Minimal diff and regression test | Original failure disappears |
| Release | Compatibility result and reviewer | Authorized requests still work |
4. Give long-running tasks a stopping point
An agent can spend several rounds producing plausible alternatives that each require a fresh human review. Use a read-only snapshot, a disposable branch and a time and spend limit. Stop when a candidate patch is ready. Let independent tests decide whether it deserves a reviewer. Keep failed runs in the log so the slowest tickets remain visible. 🔗 testing services
5. Price an accepted fix
Add inference, test infrastructure and reviewer time, then divide by independently verified fixes. Compare similar tickets and measure false alarms and missed defects alongside cost. If localization gets faster but review time increases more, use the model to triage leads before expanding its remit. 🔗 GPU management
Subscribe to AI-Stack for enterprise deployment notes.