Google announced Gemini 4 Carbon on Oct. 28, and it is not releasing it widely. Starting this week, only a subset of cyber defenders can use it. Google calls Carbon its strongest model for cybersecurity and long-running agentic work. Broader access for developers, businesses and consumers will come later, once the guardrails are refined.
What Google says Gemini 4 Carbon can do
Google’s announcement puts Carbon first on the Artificial Analysis Intelligence Index v5.0, at 59. The security numbers are the headline, though. Google lists 88.2% on SEC-bench Pro, a test of vulnerability finding, and 71.0% on CWE-bench, which measures patching. A third score, 54.8% on ExploitGym (a benchmark for exploiting flaws), is described by Google as a new state of the art.
Google also says internal tests showed Carbon more than doubled the secure-code success rate of its earlier Gemini 4 Argon model. Its Chrome team found Carbon produced high-quality patches more than 10 times better than another lab’s large frontier model. All of this is company-reported. The outside benchmark runs also had guardrails switched off, so they show what the model can do, not what the shipped product will allow.
Carbon is built for long-horizon work. Google says internal teams watched it run for days on multi-step engineering jobs, like tracing the root cause of a bug in a large codebase and then patching it.
Who gets access first
Access starts with a limited group of cyber defenders. Trusted partners will be added gradually through what Google calls the Fairwind Program. Google says it is still collecting feedback before it opens Carbon up more widely. The model arrives about two weeks after Gemini 4 Argon.
Google says it is also part of the U.S. government’s voluntary pre-release model testing process. Carbon uses the same safety stack as Argon: model training, real-time misuse defenses, prompt-injection resilience and chain-of-thought monitoring. On the Gray Swan indirect prompt injection benchmark, Google reports a 0.0% attack success rate, against 0.7% for Argon.
Gemini 4 Carbon pricing
Developers who get in pay an introductory $2 per million input tokens and $10 per million output tokens. Once the introductory period ends, that rises to $4 and $20. Cached input tokens cost 95% less than standard input.
Why the narrow release matters
Finding and exploiting software flaws is useful to defenders and attackers alike. Giving the model first to people who patch systems for a living puts defense ahead of offense. Our coverage of Moonshot’s Kimi K3.1 Pro benchmarks shows how rival models are measured, and our report on the Ivanti Connect Secure vulnerability shows what an unpatched flaw looks like in practice.
Two questions remain. Will the guardrails hold once more people use Carbon? And can independent testers reproduce Google’s numbers? Google gives no date for general availability beyond “as soon as possible.” If you run security tooling, treat the early claims as a reason to ask for a trial. They are not proof that Carbon will find more bugs in your own code.
The staged release also tells buyers something. Google is betting that defenders will accept a waiting list if the strongest tool does not go to everyone on day one. If Gemini 4 Carbon performs as described, pressure to widen access will build fast.
Editor’s take
Watch the rollout, not the leaderboard. The scores are Google’s own claims. What the Fairwind partners report after using Gemini 4 Carbon on real codebases will matter more. If defenders see fewer missed bugs and the guardrails hold, this staged approach becomes the template for models like it. If not, pressure to widen access will grow anyway.
