Gemini 4 Carbon: Google’s Cyber Model, Gated for Now

Google unveiled Gemini 4 Carbon on October 28, 2026, calling it the company’s strongest model yet for cybersecurity and long-running engineering work. It finds software flaws, tests whether attackers could actually exploit them, and writes patches aimed at the root cause — and on Google’s own benchmarks it beats its predecessor, Gemini 4 Argon, by a wide margin. Here is the catch that most launch coverage buries in paragraph five: you almost certainly cannot use it yet. First access goes to a subset of cyber defenders through Google’s Fairwind Program, and Google has given no public date for general developer, business, or consumer access.

That gate is the real story. The benchmarks are impressive, the pricing is public, and the model itself sounds like a genuine step forward for defensive security work. But for a small business owner, a freelancer who hires developers, or an independent builder, Carbon matters right now mainly as a signal about where AI-assisted security is heading — and as a reason to tighten the code-review habits you already have, rather than waiting for a model you cannot sign up for today.

What Gemini 4 Carbon actually is

Carbon is Google DeepMind’s newest frontier model, announced just two weeks after Gemini 4 Argon. Where Argon was a general-purpose flagship, Carbon is a specialist: it is built for three security jobs that normally take separate tools and separate teams.

First, vulnerability discovery — scanning code and systems to find weaknesses before attackers do. Second, exploitation validation — checking whether a reported flaw can actually be turned into a working attack, which is how security teams separate real emergencies from theoretical noise. Third, patching — writing a fix that addresses the underlying cause, not just the symptom that triggered an alert.

Google also pitches Carbon as a long-horizon engineering model. Internal teams have kept it working on single engineering problems for days, including multi-step bug investigations across large codebases and low-level systems work. That matters because real security fixes are rarely one-shot tasks. A bug in a payment flow, for example, might touch authentication code, a database query, a third-party library, and a deployment script. A model that can hold that whole chain in mind — and keep working through dead ends — is useful in a way a clever one-answer chatbot is not.

Carbon also carries over Argon’s safety stack: layered training, real-time misuse defenses, prompt-injection resilience, and monitoring of the model’s chain of thought. Google reports that successful cheating on Terminal-Bench 4.0 fell to 0.0%, that high-severity misalignment alerts in live internal coding dropped by almost 80%, and that unsupported claims fell by roughly half compared with Argon. Those are internal figures, and they should be read that way, but the direction is consistent: Google is trying to make a powerful security model that does not itself become a security problem.

The benchmark numbers, with the caveats attached

Google led with three security benchmarks, and they are worth quoting precisely because every other article will quote them too:

On vulnerability discovery specifically, Carbon more than doubles Argon’s success rate on Google’s internal comparisons. Google also says Carbon generates secure code at more than twice Argon’s success rate, and cites the Chrome team reporting that Carbon produced high-quality patches more than 10 times better than another lab’s large frontier model in its own tests.

Two honest caveats belong right next to those numbers. First, the security benchmarks were evaluated without guardrails, according to coverage of the announcement — which is the right way to measure raw capability, but not the same as the performance you would see in a production product with safety filters switched on. Second, the Chrome comparison does not name the rival model, so you cannot independently check it. The 10x figure is a Google-reported internal result, not a replicated finding.

Outside Google’s own tests, one independent signal exists: Artificial Analysis places Carbon first on its Intelligence Index v5.0 with 59 points, ahead of Claude Opus 5.5 at 58, GPT-6 Astra at 57, and Argon at 50. That is a broad capability ranking, not a cybersecurity ranking, but it tells you Carbon is not a narrow tool that gave up general ability to get good at security. On WebDev Arena, Carbon rose 89 Elo points to 1769, good for fourth place — strong, but not first, which is a useful reminder that “best at security” and “best at everything” are different claims.

Independent testing also surfaced trade-offs. Coverage of outside evaluations notes that Carbon trails some rivals on certain professional tasks and records a higher hallucination rate than Argon on a factual-knowledge test. That last point matters for anyone tempted to treat a security model as an oracle: a model can be excellent at finding bugs and still be wrong about facts. The two skills are not the same.

The Fairwind gate: who actually gets Carbon first

This is the part to read twice. Google says Carbon is being made available first to a subset of cybersecurity defenders through its Fairwind Program, then gradually to additional trusted partners, and only later to developers, businesses, and consumers. Google is also participating in the U.S. government’s voluntary pre-release model testing process, and the first Fairwind group has not been publicly named.

From Google’s announcement coverage, Fairwind prioritizes vetted national cyber authorities, critical infrastructure operators, and core technology platforms, for defensive and academic use. In plain English: the first users are the organizations that defend power grids, hospitals, banks, and major platforms — not a solo developer with an API key and a weekend project.

There is a real argument for this order. A model that can find vulnerabilities and validate exploits is dual-use by nature: the same capability that helps a defender patch a flaw helps an attacker find one. Giving it first to defenders, with testing and guardrails iterated in between, is a deliberate attempt to keep the defensive advantage. You can agree with that logic and still notice the side effect: the teams with the most resources get the new tool first, and everyone else waits without a date.

Developer reaction, as summarized in launch-week coverage of X and Reddit discussion, has been split in exactly the way you would expect. Some developers welcome a security-first flagship. Others are frustrated that small teams cannot prototype while larger enterprises build production workflows weeks ahead of them. That frustration is fair — staged rollouts do create a head start for incumbents — but it is not a reason to assume Carbon will stay gated forever. Google’s stated plan is a phased expansion, not a permanent closed club. The honest position is: no date, no signup page for the general public, and no point refreshing a waitlist that does not exist yet.

What Carbon costs — and what the price really buys

Pricing is one of the few parts of Carbon that is fully public, and it matches Argon’s introductory rates:

Google has not said when the introductory period ends, so treat the $2/$10 rates as a launch window, not a permanent price. Budget on the $4/$20 rates if you are planning anything beyond a short experiment, and you will not be caught out when the window closes.

Worked example, so the token math is not abstract. Suppose a security review run consumes 2 million input tokens and 500,000 output tokens. At introductory rates that costs $4.00 for input plus $5.00 for output, or $9.00 total. At the later rates the same run costs $8.00 plus $10.00, or $18.00. Cached input changes the picture sharply: if most of that input is a codebase the model has already seen, the 95% cache discount drops the input side to pennies, and output tokens dominate the bill. That is why Google’s caching discount matters more than it looks — security work re-reads the same code many times.

One independent per-task cost analysis reported during launch week put Carbon at $7.76 versus $10.04 for Claude Opus 5.5 on the same benchmark suite, a gap of about 23%, with Carbon using 29% fewer output tokens. That is a single third-party analysis, not a universal price comparison, and your own costs will depend on your prompts, your caching, and how much output a task needs. But it supports the broader point: Carbon’s pricing is competitive with other frontier models, not a premium tax for the security label.

Carbon vs Argon: the table that actually helps you decide

If you already use Gemini models, the question is not “is Carbon better?” — on Google’s benchmarks, it is — but “does the difference change what I should do today?” For most readers, the answer is no, because you cannot switch to Carbon yet. Still, the comparison clarifies what changed in two weeks:

The price row is the interesting one. Google did not charge extra for the specialist. When Carbon reaches general availability, the decision will be about access and fit, not about paying a premium for the security version.

A secure-code checklist for non-technical founders

You do not need Carbon to benefit from the idea behind it. If you hire developers, run a website, or pay an agency to build software for you, here is a checklist you can use in your very next conversation with them. It is the practical version of what Carbon is built to automate:

1. Ask how code is reviewed before it ships. Every change should pass a second pair of eyes — human or automated — before it reaches production. If your developer says “we just push it,” that is the finding.
2. Ask what happens when a dependency has a known flaw. Libraries and plugins go stale. Your team should be able to name the tool that flags vulnerable dependencies and the last time it ran.
3. Ask for the patch, not just the fix. When a bug is found, ask whether the fix addresses the root cause or just the reported symptom. Carbon’s CWE-bench score measures exactly this distinction, and it is the question most non-technical clients never ask.
4. Ask how secrets are handled. API keys, passwords, and tokens should never sit in code that gets shared or stored in version control. If a key leaks, rotating it matters more than deleting the file.
5. Ask what gets tested after a security fix. A patch that breaks the checkout page is not a win. Regression tests — checks that old features still work — should run after every security change.
6. Ask for a plain-English summary of each security change. You should not need a computer science degree to understand what was fixed, what was at risk, and what could still go wrong.

None of this requires a frontier model. It requires a process. Carbon may eventually make that process faster, but it does not replace it — and a team with no process will produce insecure code with or without AI help.

What to do while you wait

If you are a developer, the sensible move is to keep building on the models you can actually access today. Argon is broadly available at the same introductory price, and the coding-agent workflows you build around it — the prompts, the test suites, the review steps — will transfer when Carbon arrives. Do not pause a security project waiting for a model with no release date.

If you run a small business, use this launch as a prompt to audit your own exposure. The week Carbon launched, Anthropic’s Frontier Red Team separately reported that an unreleased Claude model had chained flaws into working browser and operating-system exploits. That is a reminder from the other side of the fence: the same class of models is getting better at attack as well as defense. Keeping software updated, turning on automatic updates for your website platform and plugins, and using unique passwords with two-factor authentication are unglamorous steps — and they still block more real attacks than any frontier model announcement.

If you are a security professional, watch for three things: the Fairwind expansion announcements, independent replications of SEC-bench Pro and CWE-bench once outsiders get access, and the end date of the introductory pricing window. Those three events will tell you more about Carbon’s real value than any launch-week benchmark table.

Why this launch matters even if you never touch Carbon

Carbon matters for a reason that has nothing to do with its benchmark scores. For years, the frontier-model race was mostly about general chat, coding speed, and reasoning tests. Carbon is Google’s bet that the next frontier is narrower and more consequential: models built for a specific high-stakes job, released carefully, and judged on whether they make real systems safer. If that bet pays off, expect every major lab to ship security-specialized models, and expect “does your AI tool understand security?” to become a standard question in software procurement.

It also matters because of the timing. Carbon arrived fifteen days after Argon, and Google’s last two turns at the top of the Artificial Analysis ranking lasted only weeks before rivals caught up. Leads in this industry are short. The model that is best today will probably not be best in December. That is not a reason to ignore Carbon — it is a reason not to reorganize your business around any single model. Build the process, keep the tools interchangeable, and let the models compete for your attention.

The bottom line is simple. Gemini 4 Carbon looks like a genuinely strong security model with public pricing and a deliberately narrow rollout. You cannot use it yet, and nobody outside Google’s first Fairwind group can tell you exactly when you will be able to. What you can do today is ask better questions of the people who write your code, keep your own systems updated, and watch the three milestones above. When Carbon does open up, you will be ready to judge it on your own work — not on its launch-week numbers.

Frequently Asked Questions

What is Google Gemini 4 Carbon?

Gemini 4 Carbon is Google DeepMind’s frontier AI model announced on October 28, 2026, built for cybersecurity tasks — finding vulnerabilities, validating exploits, and patching root causes — plus long-running software engineering work. Google calls it its strongest model for cybersecurity and long-horizon tasks.

Can I use Gemini 4 Carbon right now?

Almost certainly not. First access goes to a subset of cyber defenders through Google’s Fairwind Program, with expansion to additional trusted partners before any general release to developers, businesses, and consumers. Google has not announced a public date.

How much does Gemini 4 Carbon cost?

The introductory API price is $2 per million input tokens and $10 per million output tokens, with cached input tokens discounted by 95%. After the introductory period, prices rise to $4 and $20 per million tokens. Google has not said when the introductory period ends.

How is Carbon different from Gemini 4 Argon?

Argon, launched two weeks earlier, is a general-purpose flagship broadly available to developers and consumers. Carbon is a security specialist that scores higher on Google’s security benchmarks — 88.2% on SEC-bench Pro and 71.0% on CWE-bench — and ranks first on Artificial Analysis’ Intelligence Index v5.0 at 59 points, versus Argon’s 50.

Should small businesses wait for Carbon before fixing security issues?

No. Keep patching, updating, and reviewing code with the tools available today. Carbon has no public release date, and basic hygiene — updates, two-factor authentication, dependency checks, and code review — blocks more real attacks than waiting for any single model.

Are Carbon’s benchmark scores independently verified?

Not yet. The security benchmarks were reported by Google, evaluated without guardrails, and have not been independently replicated because outside researchers do not have general access yet. The Artificial Analysis Index score of 59 is an independent ranking, but it measures broad capability, not cybersecurity specifically.

Sources: Reuters coverage of the October 28 launch via WTBX and Duke FM’s Reuters syndication, and VentureBeat’s launch analysis. For a related, already-published guide to building with Gemini’s coding tools, see Your Coding Agent Can Borrow Gemini’s Brain in 2026, and for how Carbon’s predecessor is priced, see Gemini 4 Argon vs GPT-6 Astra vs Claude flagship pricing.