Google Says AI Could Help Make Software “Unhackable”, But Is That Realistic?

The idea of software that simply cannot be hacked sounds rather wonderful. That means no stolen passwords, no ransomware attacks, no data breaches and, perhaps most importantly, no more frantic emails telling customers that their personal information has ended up somewhere it really shouldn’t be. Arguably, one of the worst feelings for companies holding clients’ confidential information.

Of course, this makes the idea of “unhackable” software a huge promise. And as such, a promise that deserves a healthy dose of scepticism, much like anything else that sounds almost too good to be true.

Google’s Gemini 4 Carbon is being positioned as a powerful AI model with capabilities that could help improve software security, including identifying vulnerabilities and helping developers build more secure systems. The underlying idea is that if AI can examine enormous amounts of code, identify weaknesses and help fix them before criminals get the chance to exploit them, perhaps software could become significantly harder to hack. But not just a whole lot harder: impossible.

Of course, there’s a big difference between making software more secure (even if we’re talking about it being way more secure than ever before) as opposed to making it unhackable. Given the number of significant cybersecurity incidents we’ve seen recently, even just in Cybersecurity Month 2026 (ironically) specifically, it’s not unsurprising that this claim is being met with a little bit of trepidation. As it should be, in my opinion.

AI Could Very Well Change The Way We Find Software Vulnerabilities

One of the biggest challenges in cybersecurity is that software vulnerabilities aren’t always obvious. Modern applications are built using enormous amounts of interconnected code, often relying on third-party libraries, external services and infrastructure that developers don’t necessarily control themselves. As a result, even experienced security teams can struggle to identify every single potential weakness.

So this is where models like Gemini 4 Carbon could make a drastic difference, at least in theory. With advanced reasoning and long-context capabilities, AI can analyse substantial amounts of code, follow relationships between different components and help identify vulnerabilities that might otherwise go unnoticed. More than that, it can do these things really quickly, especially when compared to how long it would take humans to conduct the same kind of evaluations. Indeed, rather than relying entirely on teams of developers to spot problems during testing or security specialists to investigate systems after something has gone wrong, AI could make vulnerability detection a much more continuous process than it’s ever been before.

It could also help developers understand why a vulnerability exists and from there, suggest ways to fix it, potentially reducing the time between discovering a weakness and deploying a patch. And this would be a really big advantage, because the window between a vulnerability becoming known and attackers attempting to exploit it can be frighteningly short.

The Problem? Hackers Have AI Too

Of course, there’s another side to this story, and that’s the fact that it’s not just “the good guys” who have access to this advanced technology. Indeed, AI isn’t exclusively being used by cybersecurity teams trying to protect software; the same technology can help malicious actors identify weaknesses, automate attacks and find opportunities to access systems, and in many cases, it’s being used by nefarious actors to do just that.

October’s so-called ‘Black October’ cybersecurity period showed us exactly how this can, does and will happen. Critical PHP vulnerabilities were identified with the help of AI tools, exposing weaknesses in widely used infrastructure and triggering urgent patching efforts. According to reporting by Fortune, the vulnerabilities affected a programming language used across a substantial proportion of the internet (up to 70% of websites, according to many reports). Cloudflare also reportedly observed tens of thousands of exploitation attempts within 45 minutes of news of the vulnerabilities emerging.

In other words, finding vulnerabilities faster is only half the battle, because organisations then still need to fix them before somebody else takes advantage. The task isn’t just identifying weaknesses, but identifying and solving them.

And the problem doesn’t stop with the code itself. Recent breaches involving AI developer platforms have also highlighted how attackers can target stolen credentials, exposed API keys, cloud infrastructure and third-party dependencies. Even perfectly written software isn’t necessarily safe if somebody can steal an employee’s login details or compromise the systems used to deploy it. Unfortunately, there are several ways in which these systems can be exploited, and that’s the problem.

Can Software Ever Really Be Unhackable?

The language around AI-powered cybersecurity is really important, because “unhackable” is a very definitive word. It suggests that there’s no possible way for an attacker to gain unauthorised access, regardless of their resources, methods or ingenuity, and that’s a much bigger claim than saying software simply has fewer vulnerabilities or is more resistant to attacks.

After all, security isn’t just about finding mistakes in code; it’s about the entire environment in which software operates, including people, passwords, permissions, hardware, networks, cloud services and supply chains. A company might have exceptionally secure software and still suffer a breach because an employee falls for a convincing phishing email. For instance, a developer might introduce a vulnerability in a routine update, or a third-party provider might be compromised, giving attackers an indirect route into otherwise protected systems.

There are simply too many moving parts to assume that one AI model, however capable, can eliminate every possible route into a system. In many ways, I’d go as far as saying that it’s a little arrogant and is almost asking for trouble.

A More Secure Internet, Perhaps, Rather Than An “Unhackable” One?

That doesn’t mean Google’s ambitions are misplaced, nor does it mean that they haven’t made things more secure than before. AI could become one of the most important tools in cybersecurity, particularly as software becomes more complex and attackers become increasingly sophisticated. And if models can help developers identify vulnerabilities earlier, automate security testing and respond to emerging threats more quickly, the result could be a very meaningful improvement in the security of everyday software.

But, perhaps that’s the more realistic ambition, and maybe that’s where we need to draw the line. Rather than promising an internet that can never be hacked, AI could help create one where vulnerabilities are harder to find, attacks are more difficult to execute and security teams can respond before the damage becomes widespread. That’s already a huge achievement and, quite frankly, given the state of cybersecurity, especially over the last few months, that’s probably the most reasonable and realistic goal at this point in time.