On October 28, Google released Gemini 4 Carbon, which it calls its most capable Gemini model to date, built for cybersecurity and long-horizon agentic tasks. For now the model is open only to a small group of network defenders. It will then expand to other trusted partners through a program called Fairwind. Google has not announced when developers, enterprises or ordinary users will get access, saying only that it will happen "as soon as" it can.
"Gemini 4 Carbon is our strongest model with state-of-the-art cybersecurity and long horizon capabilities."
The scorecard leans heavily on security
Most of the scores Google published sit in security benchmarks. On SEC-bench Pro, which tests vulnerability discovery, Carbon scored 88.2%. On ExploitGym, which checks whether a vulnerability can actually be exploited, it scored 54.8%. Google calls both the highest scores recorded. On CWE-bench, which measures vulnerability patching, it scored 71.0%.
On broader leaderboards, Carbon scored 59 on the Artificial Analysis Intelligence Index v5.0, ranking first. On WebDev Arena, the web-development head-to-head leaderboard, it holds 1768 Elo, fourth place and roughly 89 points above the previous generation.
Several other claims come from Google's internal data and have not been independently reproduced. The success rate for secure code generation is more than double that of Argon. And after trying the model, Google's Chrome team said it produces high-quality patches more than 10 times better than "another lab's large frontier model", without naming which lab.
Defending against injection and cheating
The blog post spends considerable space on the model's own safety. In Gray Swan's indirect prompt-injection test, Carbon's attack success rate was 0.0%, versus 0.7% for Argon. On Terminal-Bench 4.0, the model attempted to cheat 0.4% of the time, and its cheating success rate fell to zero. Google also says unsupported assertions dropped by about half, overeager task execution fell 26%, and failures to do what was asked fell 29%.
On safeguards, Carbon carries over Argon's layered protections: alignment during training, real-time abuse blocking, prompt-injection defenses and chain-of-thought monitoring. Google says it took part in voluntary pre-release model testing run by the US government.
"We're taking a deliberate approach to rollout."
Two models in two weeks, with pricing set first
Put the timeline together and Google's pace this month is dense. Gemini 4 Argon, released two weeks ago, focuses on physical reasoning and embodied tasks; it opened first to security teams and then went to general availability. This week Google also released the world model Genie 4. Carbon is built directly on top of Argon.
On pricing, Carbon and Argon share the same promotional rates: $2 per million input tokens and $10 per million output tokens, with cached input billed at 5% of the input price. After the promotional period ends, the price rises to $4 for input and $20 for output. The blog does not say how long the promotion lasts.
The arrangement is somewhat unusual. Models are typically opened up first and priced afterward; with Carbon, pricing came first and availability is still to be announced. Argon followed a similar path, going to security teams first and then to everyone, with a fairly short gap in between. Whether Carbon will follow the same schedule cannot be judged for now.
The blog text does not say when the API, the Gemini app and Vertex AI will each get the model, and it gives no context length. For developers in China, the regional restrictions on the Gemini API itself are unchanged: even once Carbon reaches the public stage, whether it can be called directly still depends on Google's list of supported regions.
Security-focused models are bunching up
Over the same period, vendors have been treating vulnerability-finding as a selling point for frontier models. A day earlier, Anthropic published a report on an internal research model that found vulnerabilities in several mainstream systems and wrote attack chains, and OpenAI is also pushing ahead with external review of AI-driven vulnerability discovery. Google's decision to limit Carbon's first users to defenders is consistent with this round of industry practice: give the capability to the people guarding the gates first, and clear out a batch of existing vulnerabilities before attackers get equivalent tools.
The Chrome team's account of using Carbon to fix patches also shows that Google's own product lines are among the first users. Comparable data on how well that kind of internal trial holds up will have to wait until more outside defense teams get access.
Sources: Google's official blog post on the Gemini 4 Carbon launch, the Google DeepMind blog, CocoLoop; benchmark scores, the promotional period and standard pricing were cross-checked.