Google Unveils Gemini 4 Carbon, a Cyber Defense Model You Cannot Use Yet
Google Unveils Gemini 4 Carbon, a Cyber Defense Model You Cannot Use Yet
Google DeepMind announced Gemini 4 Carbon on October 28, 2026, describing it as its strongest model so far, with state of the art cybersecurity and long horizon capabilities. The catch is access. At launch, Carbon is going first to a subset of cyber defenders, not to developers, businesses, or consumers in general.
That staged rollout is the most important part of the announcement. Google says it is still gathering feedback and iterating on guardrails before a wider release, and it is taking part in the United States government’s voluntary process for pre-release model testing.
Background: a fast follow-up to Argon
Carbon arrives only two weeks after Gemini 4 Argon, according to Google DeepMind. Reuters reported the same timing, noting that the launch expands Google’s Gemini family for developers and enterprise customers and intensifies competition with OpenAI and Anthropic. The speed matters because it shows how quickly frontier labs are now shipping follow-up models, rather than waiting months between major releases.
Google positions Carbon as a model for hard, long-running engineering work. Its internal teams have seen it run for days on single tasks, persisting through dead ends while root-causing and patching subtle bugs across large codebases. It is aimed at sustained agentic workflows, where a model must keep track of a complex task over many steps.
Key details: benchmarks across the defense lifecycle
Google frames Carbon’s cybersecurity work around three stages: finding a vulnerability, validating whether it can be exploited, and patching it at the root cause. On external benchmarks evaluated without guardrails, Google reports 88.2 percent on SEC-bench Pro for finding vulnerabilities, 54.8 percent on ExploitGym for exploitation, and 71.0 percent on CWE-bench for patching.
On internal benchmarks, Google says Carbon generates secure code at more than twice the success rate of Argon. Reuters reported that same claim. Google also says its Chrome team found Carbon performed more than 10 times better than another lab’s large frontier model at generating high quality patches, although Google does not name the other model in its announcement.
Carbon also ranks first on version 5.0 of the Artificial Analysis Intelligence Index, with a score of 59. Artificial Analysis confirms that ranking and notes that Carbon leads in 4 of the index’s 9 evaluations, while ranking second to Claude Opus 5.5 on its Coding Agent Index. Artificial Analysis also reports that its hallucination rate rose from 4 percent for Argon to 11 percent on its AA-Omniscience test.
Google also reports safety and honesty gains. In live coding environments with its own teams, high severity misalignment alerts dropped by almost 80 percent. In internal testing, Carbon cut unsupported claims by approximately half compared with Argon. On Gray Swan’s Indirect Prompt Injection Benchmark, Carbon resisted every evaluated attack attempt, improving on Argon’s 0.7 percent attack success rate to reach 0.0 percent. These are Google’s internal or cited evaluation results, not independent reproductions, so they should be read as claims to test once wider access arrives.
Access and pricing
Starting in the week of the announcement, Google is making Carbon available to a subset of cyber defenders, then gradually phasing access to additional trusted partners through its Fairwind Program. Google says it will bring Carbon to developers, businesses, and consumers as soon as possible, but it gives no date for that wider release.
When wider access does arrive, pricing is already set. Carbon will launch at the same introductory price as Argon: 2 dollars per million input tokens and 10 dollars per million output tokens, with cached input tokens priced at 95 percent off the input token price. Artificial Analysis lists standard pricing of 4 dollars per million input tokens and 20 dollars per million output tokens, with a 50 percent launch discount and no confirmed end date for that discount.
For web development, Google says Carbon gained 89 Elo points to reach fourth place at 1768 on WebDev Arena.
Why it matters
Carbon matters for two reasons. First, it shows security becoming a headline capability for frontier models, not a side feature. Finding flaws, proving they matter, and fixing them is work that security teams do every day, and a model that can sustain that work over days could change how patching queues are handled.
Second, the rollout itself is a signal. By giving defenders first access while it tests safeguards, Google is acknowledging that the same capability that helps defenders can also be misused. Reuters framed the launch as part of an intensifying race in coding and cybersecurity systems. The question for the rest of the market is not only how good Carbon is, but how long the defender-first window lasts and what safeguards look like when the model finally reaches the public API.
For now, most readers should treat Carbon as a model to watch, not a tool to try. Security teams in the Fairwind Program will provide the first real world evidence. Everyone else will need to wait for Google to announce a date, and for independent testers to check whether the benchmark lead holds outside Google’s own evaluations.
