Gemini 4 Carbon and Anthropic's Chrome Exploit: the Same Capability, Opposite Disclosure - and Auditability Is Now the Bottleneck

One week, two announcements, one capability: Google shipped Gemini 4 Carbon behind a Fairwind-only gate with no public date, and Anthropic published five exploit chains in the open while letting Chrome and Apple take the credit. The bottleneck on AI security claims is now auditability, not capability.

Two Announcements, One Capability, Opposite Disclosure

In the same week, two labs claimed a model can find and exploit real bugs in real software. Google unveiled Gemini 4 Carbon on October 28 and put it behind a gate with no public date. Anthropic published five working exploit chains against Chrome, Safari, Android, Windows and Linux on October 27, then let the vendors take the credit. One announcement is a capability claim nobody can check because there is no access. The other is a capability claim nobody can fully check because the model is unreleased and the human contribution is undisclosed. That is the shape of AI security news this week, and the word holding it together is auditability.

The timing is not coordinated. Two labs independently reached the same frontier, then made opposite bets about who gets to see the work.

On the numbers, the gap is thinner than a launch post suggests. Google says Gemini 4 Carbon ranks first on the Artificial Analysis Intelligence Index v5 with 59 points in “High” mode. Claude Opus 5.5 shows 58 in “Max” and 57 in “Xhigh” — a one-point margin. Index v5 aggregates nine evaluations, including Terminal-Bench 4.0, FrontierCode 2.0 and HLE-Diamond, across four categories weighted 25% each: agents, coding, general capabilities and scientific reasoning.

One point deserves its own caveat. The Artificial Analysis page does not explain what changed between v4 and v5, and a reshuffled index can move rankings even when no new model has shipped. And the lead does not repeat everywhere: on WebDev Arena, the user-voted leaderboard for building websites and applications, Google reports a jump of 89 Elo points for Carbon, landing it fourth at 1768.

Gemini 4 Carbon: The Numbers and the Gate

Google’s launch post is specific, and every number in it is Google’s own measurement rather than independent verification.

In cybersecurity tests, Google reports Gemini 4 Carbon at 88.2% on SEC-bench Pro, which measures finding vulnerabilities, and 54.8% on ExploitGym, which measures actually exploiting flaws. Google lists both as new state of the art. On CWE-bench, which measures fixing vulnerable code, it reports 71.0%. The first two were measured without guardrails — without the protections active in production.

Those are the closest thing to a direct measurement of what the model does to real code. Two caveats travel with them: they are Google’s own runs, and two carry the “without guardrails” qualifier, so production behaviour may look different. Google also reports that Carbon’s success rate at generating secure code is more than double Argon’s on its internal tests, and that the Chrome team finds its high-quality patches more than 10 times better than another major frontier model — one Google does not name.

Then comes the access policy, and it is the actual announcement. Starting the week of October 28, only a subset of cyber defenders can use Carbon, through the Fairwind Program, which channels Google’s defence tools to governments, critical infrastructure operators and vetted security companies. For developers, businesses and consumers, Google says access will come “as soon as possible.” No date is attached.

This repeats the pattern we covered on October 2: Argon was announced September 30 for Fairwind participants only, then opened to the public on October 13 in the Gemini app for Pro and Ultra subscribers and in the paid API. Gated first, opened later — and “as soon as possible” is doing more work here than any benchmark does.

What Anthropic Published: Five Chains, No Model

Anthropic’s research post makes the bolder claim. It used an unreleased internal research model to find critical vulnerabilities in browsers and operating systems, then published five attack chains leading to remote code execution and other critical impacts with little to no user interaction, in software used by billions.

The Chrome chain is one click, or one page load. Claude found a V8 heap-corruption vulnerability, then a second flaw to escape V8’s memory-region sandbox and defeat ASLR via a return-oriented programming chain, then a race condition in CacheStorage to read memory outside the sandbox and learn the privileged browser process layout, then a use-after-free in FedCM, Chrome’s federated sign-in, to execute code outside the sandbox. Anthropic’s proof of concept launches Calculator from a stock, default-configuration Chrome on macOS within seconds of the page loading.

The scale behind that one click is bigger than the demo. Anthropic reports 62 CVEs assigned and patched as of Chrome 156, all rated critical or high, including 13 sandbox escapes and 21 vulnerabilities that could have compromised the renderer. Chrome 156’s stable channel update shipped October 20, and Google’s release notes credit “Xinyang Ge of Anthropic, assisted by Claude” for specific fixes — not for all 62.

The Safari chain is the elegant one and the easiest to misread: it is data-only and never executes code. A use-after-free in JavaScriptCore, where TypedArray operations write through stale pointers and overwrite TypedArray metadata. A Gigacage bypass, where certain variables in the isolated region index into other regions, yielding an arbitrary read/write primitive. A WebContent sandbox IPC flaw to read history, cookies and session databases from disk. And a memory overwrite that disables the same-origin policy. With the policy off, a malicious page can read a signed-in user’s email or bank balances and send authenticated requests to other domains. Apple acknowledged the report the same day and shipped a fix, in iOS and iPadOS 26.5.2, crediting “Milad Nasr and Nicholas Carlini with Claude, Anthropic.”

The Android chain pulled photos and other personal information off a stolen, locked phone over USB without unlocking it. Anthropic’s method was source-code analysis of open-source Android, reverse engineering and deobfuscation of Google Play services binaries, and live testing on a physical Google Pixel 9 — then chaining three of the vulnerabilities it found. Each protection fell in turn: the locked-device USB data-transfer block, the transfer protocol’s peer authorization check, the authenticated key agreement’s six-digit code verification, and a hardcoded check that USB transfers do not carry file contents, which missed a fallback that sent raw bytes. Anthropic says Google has fixed it; no public record of that fix was found.

The Windows chain is the narrowest, and it is a denial of service rather than code execution: network packets crash the machine over HTTP/3, and repeating them keeps it down. The Linux chain is the opposite — commands run as root over the network, with no login and no user action, against a server running a multipath TCP listener. It is tracked as CVE-2026-98432, patched October 15. Anthropic also launched an opt-in vulnerability-finding service for open-source projects alongside the research.

The Part Nobody Can Check

First, there is no live exposure. Anthropic followed its coordinated vulnerability disclosure policy — 90 days for vendors to patch, plus a further 45 days before discussing details beyond the public advisory — and says every flaw was reported to the vendor first, so all of them are already patched. The exploits were built in the lab after prompting, and Anthropic says they were not seen in any real attack. As of late October, U.S. government vulnerability enrichment marked the Windows flaw as not exploited, and it was not in the CISA catalog of known exploited bugs.

Second, the vendor credit verifies only part of the claim. Chrome’s release notes naming an Anthropic researcher confirm the bugs were real. They do not confirm how much of each chain the model built on its own.

And that is the gap. Anthropic says the work needed only “initial prompting” and “little human involvement,” but does not break down what a person did at each step, and does not name the model beyond calling it an unreleased internal research model. The capability claim rests on Anthropic’s own account. The Hacker News write-up of the same research is the sceptical counterweight to that account, and is worth reading beside Anthropic’s post rather than folded into it.

One mismatch is worth stating, not resolving. Anthropic describes an out-of-bounds read in the Windows kernel’s QUIC handling. The public record for the bug it points to, CVE-2026-33096, names HTTP.sys, the built-in Windows web request handler, rates it 7.5 out of 10, and credits no finder — and no open source ties the two descriptions to the same component. Either the public record and Anthropic’s description cover different bugs, or one of them is imprecise. Nothing in the sources settles it.

Auditability Is the Bottleneck Now

Google published a capability claim nobody can check, because there is no access — Fairwind only, and “as soon as possible” with no date. Anthropic published a claim nobody can fully check, because the model is unreleased and the human contribution is undisclosed. Different failure modes, same bottleneck: in 2026, the constraint on AI security claims has moved from capability to auditability.

That shift matters for anyone deciding what to believe: “A model can find vulnerabilities” is no longer a falsifiable claim, it is a direction of travel. Both labs demonstrated something real this week, and neither handed you the artifact that would let you say how much was the model and how much was the person holding the prompt.

So what would an evidence standard look like? Four things, all currently missing:

  • Reproducible artifacts. A vendor-accepted CVE chain, or a proof of concept a third party can run.
  • Per-step provenance. How much of each link came from the model, and how much from the human.
  • Named systems that match the records. When the narrative and the CVE record disagree about the component, a reader cannot adjudicate.
  • Guardrail state stated with the number. “88.2% without guardrails” is useful; without the qualifier it is marketing.

None of this is an accusation: Google shipped a security model to defenders rather than to everyone, and Anthropic worked under disclosure rules and handed credit to the vendors whose software it broke. Both are defensible. But a reader deciding whether to fund, trust, or redraw an assumption about how much of this work is now machine needs evidence neither announcement provides.

The practical takeaway: treat both announcements as directional. The ranking tells you where the capability sits. It does not tell you who did the work, under what constraints, or whether the number holds with the guardrails on.

Sources