AI Security Review: Terra and Carbon

OpenAI has a model it rates Critical for cybersecurity, and it is already available to developers. Google has a model that posts strong vulnerability-finding and patching scores, but it was initially limited to vetted cyber defenders. In my view, those two release decisions say more about the next phase of AI security than the benchmark tables do.

Key Takeaways:

Fact: OpenAI treats GPT-6.1 Terra as Critical in cybersecurity under its Preparedness Framework, and the model is listed for ChatGPT Work, Codex and the API.

Fact: Google’s Gemini 4 Carbon posts strong vulnerability-discovery and patching benchmarks, but access is gated to a subset of cyber defenders first.

Opinion: AI security review becomes cheap enough to run on every change, with a human still accountable for the result.

Opinion: Hard-coded secrets, missing authorization checks and weak input validation remain the highest-return fixes, whether the scanner is human or a model.

How to read this: Sections marked Fact are sourced to OpenAI or Google. Sections marked Analysis are interpretation and opinion. The Recommendation section is advice, not a factual claim.

Fact: what shipped

OpenAI published the GPT-6.1 Terra system-card addendum on October 26, 2026. The addendum states that OpenAI is treating the model as Critical in cybersecurity and High for Biological and Chemical capability. It also says GPT-6.1 Terra uses the same safeguards stack as GPT-6.1 Sol and GPT-6 Astra, with probes updated for the new model.

OpenAI’s release notes list GPT-6.1 Terra for ChatGPT Work, Codex and the API. That is the important contrast: the model with the Critical cybersecurity rating sits in the general product line, behind the same safeguards stack as its siblings.

Google announced Gemini 4 Carbon on October 28, 2026. At launch, Google described it as its strongest model, citing benchmark results for cybersecurity and long-horizon work. The company reports 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on ExploitGym for exploitation, and 71.0% on CWE-bench for patching.

Model	What the vendor says	Who can use it
GPT-6.1 Terra	Critical in cybersecurity; High for biological and chemical capability; same safeguards stack as GPT-6.1 Sol and GPT-6 Astra	Listed in ChatGPT Work, Codex and the API
Gemini 4 Carbon	Cybersecurity benchmark results and long-horizon work; 88.2% SEC-bench Pro, 54.8% ExploitGym, 71.0% CWE-bench	Subset of cyber defenders first, then trusted partners through the Fairwind Program; broader access later

Fact: OpenAI’s cybersecurity rating

Fact: “Critical in cybersecurity” is a Preparedness Framework classification. It means OpenAI assessed the model as crossing a capability threshold that requires its strongest safeguards. Analysis: The label does not imply unrestricted access, and it does not turn every response into an exploit recipe. It means the capability is high enough that the deployment decision matters.

Analysis: The benchmark context is real, but it is also narrow. Google’s Carbon numbers come from external benchmarks, evaluated without guardrails, and published by the model’s developer. They are a useful signal that vulnerability discovery and patch generation have improved. They are not an independent audit of how the model behaves inside a messy production repository with years of history, generated code and incomplete tests.

Analysis: The social-media version of this story compresses two different claims into one: “the model is dangerous” and “the model is useful.” The same capability that finds a missing authorization check can help an attacker find it. The deployment controls, not the benchmark number, decide who gets the capability first.

Fact: Carbon’s benchmarks and access

Google’s rollout came with a narrower access gate. Google said at launch that it would make Gemini 4 Carbon available to a subset of cyber defenders first, then phase access to additional trusted partners through its Fairwind Program. Developers, businesses and consumers were described at the time as “as soon as possible,” not at launch.

Analysis: That is a safety choice, and it is also a market choice. A model that can find and patch vulnerabilities is valuable to defenders, but the same model can be used to validate an exploit. Limiting early access lets Google gather feedback and tune guardrails before opening the API to developers broadly. It also means the claim that “attackers will have the same tools” is too simple: one model is broadly available, the other is gated.

Analysis: The benchmark caveat is worth repeating. SEC-bench Pro, ExploitGym and CWE-bench measure specific tasks in controlled settings. A high score does not guarantee that the model will understand your service’s trust boundaries, your deployment topology or the one legacy endpoint nobody wants to touch. It does mean the model is better at reading code and proposing changes than the previous generation.

Analysis: review moves into the pipeline

The realistic near-term change: a second reviewer that never gets tired, can read the entire diff and can suggest a patch in the same pass. That is already how code review assistants are being used; the new capability raises the ceiling on what they can catch.

Security review has always competed for attention with feature work. Static analysis and secret scanners run in CI, but they are rule-based and often noisy. A model can connect a changed function to an authorization check three files away, explain why a request path bypasses it, and propose a test. That is the useful part: not a magic vulnerability detector, but a reviewer that can hold more context than a human reviewer has time to load.

The bottleneck moves from “can we afford to scan this?” to “can we trust the findings?” False positives still cost engineer time. A patch suggested by a model can be wrong in subtle ways. Sending source code to a third-party API creates a data-handling question. Those are integration and policy problems, and they are solvable; they are not reasons to ignore the capability.

Analysis: the attacker side is asymmetric

Attackers do not need the same product access as a security team. They can use jailbreaks, stolen API keys, open-weight models or a legitimate account with weak monitoring. The defensive assumption should be that a motivated adversary can rent a capable model, not that the vendor’s access gate makes the threat disappear.

What changes is the cost of finding obvious flaws. Hard-coded credentials, missing input validation, permissive CORS, weak session handling and over-broad CI tokens are exactly the kinds of patterns a model can spot quickly. Those issues are also the ones that are cheapest to fix before an incident. The attacker’s advantage is speed; the defender’s advantage is knowing the codebase and owning the remediation.

That is why the “fix them before an AI finds them” line is the practical takeaway, even if the social post frames it as a race. The goal is to remove the findings that should never have shipped.

Recommendation: what to fix first

Start with the issues that are both common and unambiguous:

Secrets: run secret scanning on every commit, rotate anything that has ever been committed, and keep production credentials out of model prompts.
Authorization: test object-level access, not just authentication. A logged-in user is not the same as an authorized user.
Input validation: validate at the trust boundary, and test the paths that skip the UI.
Dependencies: pin and verify sources; a model can spot a suspicious package name, but provenance checks catch the supply-chain cases it misses.
CI permissions: give review jobs read-only tokens and no deployment credentials. A security scanner should not be able to publish your release.
Human sign-off: let AI review propose patches, but require tests and a human decision for risk acceptance.

If you add AI review to the pipeline, treat it like any other privileged tool: scope its repository access, redact secrets, log its findings, and measure false positives before you make it blocking. A scanner that cries wolf on every pull request will be disabled within a week.

Analysis: bottom line

The headline: security review is becoming cheap enough to run continuously. OpenAI’s Critical rating says the capability is now high enough to demand strong safeguards; Google’s gated rollout says the industry has not settled on how to hand that capability out. Developers should assume both trends continue.

That means AI-assisted review will become a baseline expectation, not a differentiator. The teams that benefit most will be the ones that fix the boring hygiene issues now, give the reviewer the context it needs, and keep a human accountable for the final call.

More in-depth coverage from this blog on closely related topics:

Sources and References

Sources cited while researching and writing this article: