Google DeepMind announced Gemini 4 Carbon on October 28, 2026, its new frontier model with a focus on cybersecurity and long, multi-step tasks. It arrives just two weeks after Gemini 4 Argon. Anyone hoping to drop a new model ID into their app will have to wait, though: Gemini 4 Carbon is going to a select group of cyber defenders first. Developers, businesses and consumers will get it later, and Google has not given a date.
The announcement comes with strong benchmark numbers and a notably cautious rollout. Here is what the figures show, what Google leaves open, and why a model that is better at finding and exploiting vulnerabilities is not simply switched on for everyone.
Key Takeaways
- Google calls Gemini 4 Carbon its strongest Gemini model so far, built for cybersecurity and long-running agentic work.
- According to Google, it ranks first on the Artificial Analysis Intelligence Index v5.0 with a score of 59.
- Cyber benchmarks per Google: 88.2% on SEC-bench Pro (finding flaws), 54.8% on ExploitGym (exploitation), 71.0% on CWE-bench (patching).
- Access goes first to a subset of cyber defenders, then gradually to partners in the Fairwind Program. General availability: not announced.
- Introductory pricing matches Argon: $2 per million input tokens and $10 per million output tokens, rising to $4 and $20 afterwards.
What is Gemini 4 Carbon?
In the official announcement, Koray Kavukcuoglu, Google’s Chief AI Architect, describes Carbon as a model with “state-of-the-art” capabilities in cybersecurity and long-horizon tasks. Carbon builds directly on Gemini 4 Argon, which Google made broadly available in mid-October. We covered the general availability of Gemini 4 Argon at the time.
Google highlights two directions. First, Carbon is meant to stay on hard engineering problems for a long time. Internally, Google says, the model has run “for days” to push through dead ends, for example when root-causing and patching subtle bugs across large codebases and low-level systems. Second, the model targets the whole cyber defense lifecycle: finding vulnerabilities, validating whether they can be exploited, and fixing them at the root cause.
Gemini 4 Carbon benchmark results
Google lists a range of numbers. One caveat up front: these are vendor figures that we have not verified independently. Google also says the cyber benchmarks were run “without guardrails”, meaning without the protections that are supposed to be active in the product later.
- Artificial Analysis Intelligence Index v5.0: 59 points, rank 1.
- SEC-bench Pro: 88.2% for finding real vulnerabilities.
- ExploitGym: 54.8% for exploiting vulnerabilities.
- CWE-bench (Collinear): 71.0% for producing working patches.
- WebDev Arena: 1,768 Elo, up 89 points, good for rank 4.
Google adds internal measurements: Carbon reportedly more than doubles Argon’s success rate at generating secure code. The Chrome team says Carbon did more than 10x better than “another lab’s large frontier model” at generating high-quality patches. Google does not say which model that was. Comparisons without a name or a methodology are hard to assess and are best read as a rough signal.
What the numbers do and do not tell you
Topping an aggregate index is a snapshot. Indexes like Artificial Analysis’s are reweighted regularly, and Google notes that version 5.0 was updated only recently. The cyber scores are more useful in practice because they map to concrete work steps. Still, benchmarks are curated task sets. Whether a model performs as well in a grown enterprise codebase with in-house frameworks and legacy code only shows up in real use.
Safety and alignment: what Google claims
Google devotes a large part of the announcement to model behavior. Carbon uses the same layered safety stack as Argon: training, real-time misuse defenses, prompt injection resilience and chain-of-thought monitoring. Specifically, Google reports:
- Less cheating: successful cheating on Terminal-Bench 4.0 fell to 0.0%, with cheating attempts at 0.4%. In internal live coding environments, high-severity misalignment alerts dropped by almost 80%.
- Fewer unsupported claims: internal testing shows roughly half as many unsupported claims as Argon.
- Less overreach: overreach fell by 26% and under-service by 29%.
- Prompt injection: on Gray Swan’s Indirect Prompt Injection benchmark, the attack success rate was 0.0%, compared with 0.7% for Argon.
These are relevant claims, especially for agents that work autonomously inside codebases. A zero attack success rate on one benchmark does not mean the model is immune to prompt injection, however. It means the tested attacks did not work. New attack patterns appear all the time.
Access through the Fairwind Program
The most important part of the news is arguably not a benchmark but the rollout. Google says it is taking a “deliberate approach” and participating in the U.S. government’s voluntary process for pre-release model testing. Starting this week, a subset of cyber defenders gets access, with more trusted partners added in phases through the Google DeepMind Fairwind Program.
Google launched Fairwind in September. According to the program page, it works with more than 650 partners worldwide and prioritizes groups such as governments, healthcare providers and telecom operators. Partners may only use the models for defensive and research purposes. Google took a similar path with Argon, which in early October was first restricted to cybersecurity experts before it became broadly available.
The reasoning is straightforward: a model that reliably finds and exploits vulnerabilities is just as valuable to attackers as it is to defenders. Whoever gets it first has a head start. Google wants to hand that head start to defenders and tighten the guardrails based on their feedback before Carbon reaches its own products.
Pricing and availability
Pricing is already set even though general availability is not. At launch, Gemini 4 Carbon costs the same as Argon: $2 per million input tokens and $10 per million output tokens, with cached input tokens 95% cheaper. After the introductory period, the price rises to $4 per million input tokens and $20 per million output tokens. Google does not say in the announcement how long the introductory period lasts.
For teams already using Argon, nothing changes for now. Anyone planning for Carbon should budget for the doubled list prices after the introductory period, especially for long-running agents that burn through many tokens.
Context: security as the selling point
With Carbon, Google is making a clear statement. While other vendors pitch new models on general intelligence or computer use, Google puts cyber defense front and center. That fits a trend we have been watching for weeks: AI models keep getting better at understanding code and finding bugs, which turns the question of who gets access into a security question.
The pace also remains high. Two frontier models in two weeks is a lot, even for Google. Just a day earlier, Google brought Gemini Robotics ER 2 to Google Cloud. For companies, this means model switches are becoming a permanent task, and in-house tests with real workloads matter more than the next leaderboard.
Bottom line
On paper, Gemini 4 Carbon is a clear step forward, especially for cybersecurity and long agentic tasks. The numbers come from Google’s own presentation, some without a transparent methodology, and the cyber benchmarks were measured without safeguards. For most developers, Carbon is not usable yet. The controlled rollout through Fairwind is not a marketing footnote but the core of the story: Google is deliberately holding back a model because it might be too good at offense. When Carbon will be available to everyone remains open.
