In an evaluation across six controlled web application labs, Google's Gemini 4 achieved the highest vulnerability discovery score among all tested models, including GLM5.3 and Opus 5. However, its recall dropped 9pp when producing reproducible exploits, compared with 1-2pp for the others, due to frequent "soft refusals" to exploit. Gemini 4 used fewer tokens per assessment and favored file read operations—roughly 40% of tool calls—over Bash, browser, and code executions.
No score is assigned. Sources and their independence are shown in the citation chain below.