Google ships Gemini 4 Carbon to cyber defenders first, not public

Key Points

1. Google released Gemini 4 Carbon on October 28, 2026, restricted initially to a subset of cyber defenders.
2. The model scored 88.2% on SEC-bench Pro vulnerability discovery, which Google called the highest recorded result.
3. Introductory pricing matches Argon at $2 per million input tokens and $10 per million output tokens.

The latest:

Gemini 4 Carbon went live for a limited group of cyber defenders on October 28, 2026, two weeks after Google shipped Argon. Koray Kavukcuoglu, senior vice president at Google DeepMind and chief AI architect, described it as the company’s most capable model, built for cybersecurity and long-horizon work. General availability for developers, businesses and consumers is planned but undated.

Details:

• Security benchmarks: Google said Carbon scored 88.2% on SEC-bench Pro for vulnerability discovery, which it called the highest recorded result, 54.8% on ExploitGym for exploitation, a new high score, and 71.0% on Collinear’s CWE-bench for patching. All three were evaluated with guardrails removed.
• Internal testing: According to Google, Carbon more than doubled Argon’s success rate at generating secure code. The Chrome team found it more than 10 times better than a large frontier model from another lab at producing high-quality patches. Security firm Wiz reported gains on web penetration-testing benchmarks.
• General performance: Google placed Carbon first on version 5.0 of Artificial Analysis’s intelligence index with a score of 59, and fourth on WebDev Arena at 1768 Elo, an 89-point gain. The company cited improvements in coding, agentic tasks, scientific work, full web development and multimodal understanding.
• Pichai’s framing: Chief executive Sundar Pichai said on X that Carbon takes the top spot on the newly updated Artificial Analysis index, arriving just two weeks after Argon. The sequence points to a compressed release cadence between two frontier models from the same lab.
• Safety results: Google reported that successful cheating on Terminal-Bench 4.0 fell to 0.0% and cheating attempts to 0.4% while accuracy improved. High-severity misalignment alerts in internal coding environments dropped roughly 80%, and unsupported claims fell by about half versus Argon.
• Prompt injection: On the Gray Swan indirect prompt-injection benchmark, Google put Carbon’s attack success rate at 0.0%, against 0.7% for Argon. The company said Carbon carries the same multilayered safety stack as Argon, covering model training, live misuse defenses, injection resistance and chain-of-thought monitoring.
• Long-horizon work: Google said internal teams watched Carbon run for days on multi-step engineering tasks, including root-causing and patching subtle bugs across large codebases and low-level systems. It also said the model asks clarifying questions and flags contradictions before acting in ambiguous cases.
• Access path: Starting the week of the announcement, access is limited to a subset of cyber defenders, widening gradually to trusted partners through the Fairwind program. Google said it participates in the US government’s voluntary pre-release testing process, and will open access broadly after more feedback and guardrail work.
• The price: Introductory pricing matches Argon: $2 per million input tokens and $10 per million output tokens, with cached input tokens discounted 95%. After the introductory window, rates double to $4 and $20. Google did not state how long that window lasts, nor the model’s context size.

Between the lines:

A frontier model whose strongest published numbers are offensive security scores, released to defenders first and tested without guardrails, is a product Google is treating as dual-use. Holding the price flat against Argon while gating availability suggests the constraint is trust and feedback, not compute cost.

What’s next

Watch for the separate safety and security report Google said accompanies the model, the end of the introductory pricing window, and how quickly Fairwind partner access widens toward general availability.

Sources: