What was announced
Google announced Gemini 4 Carbon on 28 October 2026 as its next frontier model, highlighting cybersecurity and long-running engineering work12. Rather than a general launch, Carbon is going first to a small group of cyber defenders, with trusted partners added gradually and no date yet for developers or businesses; the security benchmark results quoted at launch are Google's own3.
Why this changes the patching maths
The same week showed how quickly known flaws are used. The PHP2Shell vulnerabilities had fixes released on 21 October, were added to CISA's Known Exploited Vulnerabilities catalog on 26 October, and researchers were already recording successful exploitation45. Models that are good at finding and exploiting vulnerabilities compress that cycle further: more bugs found, and less time between disclosure and working exploits. Defender-first access buys time, but capabilities spread.
- DiscoverA flaw is found, increasingly with AI help
- DiscloseAdvisory and fixed versions published
- WeaponiseWorking exploits appear, sometimes within days
- Your windowTime between disclosure and your patch
- ExploitUnpatched, exposed systems are hit first
- DetectBehaviour monitoring catches what patching missed
Assume every service is vulnerable. The goal is not zero vulnerabilities; it is a short window and early detection when the window is missed.
Assume exploitation, and watch behaviour
Patching will sometimes be late. The Kubernetes community has long argued for treating every microservice as vulnerable and monitoring how it behaves, because an exploited service makes irregular requests, returns irregular responses and takes irregular time to respond6. Those signals do not depend on knowing the vulnerability in advance.
A vulnerability programme built for AI speed
| Metric | Why it matters now | Where to start |
|---|---|---|
| Time to know | You cannot patch what you cannot find | One inventory with owners, refreshed automatically |
| Time to patch known-exploited flaws | Exploits arrive faster | A days-not-weeks target for internet-facing systems |
| Share of fleet on golden images | Rebuilds beat manual patching | Start with the most exposed services |
| Detection of irregular behaviour | Some windows will be missed | Baselines for critical services and data stores |
For a worked example, see securing a legacy PHP estate after PHP2Shell.
CTO take
Do not wait for access to these models to act on what they imply. Set a short, explicit patch target for known-exploited vulnerabilities on internet-facing systems, make rebuilding from golden images the default fix, and fund behaviour monitoring for the services that hold sensitive data. If your security partners do get early access, agree the rules first: authorised scope, isolated environments and human review of every finding. Resilience rules such as DORA and NIS2 in the EU and CPS 230 in Australia already expect this kind of discipline; see by region.
Related reading: sandboxing AI agents, an AI copilot for the security operations centre and the tech news update for 29 October.
How I can help
I help leadership teams turn security from a scramble into a platform: inventory, rebuildable infrastructure and monitoring that hold up when the next advisory lands. See technical due diligence and fractional CTO, or analyse your challenge and bring the result to a call.
- 1Gemini 4 Carbon: our next frontier modelGoogle · 28 Oct 2026
- 2Google announces Gemini 4 Carbon with 'significant gains across coding and agentic tasks'9to5Google · 28 Oct 2026
- 3Staged rollout sends Google's Gemini 4 Carbon to cyber defenders firstUnite.AI · Oct 2026
- 4CISA confirms PHP2Shell under attack as researchers clock successful exploitsThe Register · 27 Oct 2026
- 5
- 6Consider All Microservices Vulnerable, And Monitor Their BehaviorKubernetes blog (David Hadas) · 20 Jan 2023