Google Gives Gemini 4 Carbon to Cyber Defenders Before Developers

Google’s newest frontier model will reach security teams before it reaches anyone building apps. Gemini 4 Carbon, announced on 28 October by Google DeepMind’s Koray Kavukcuoglu, is going first to “a subset of cyber defenders” this week, with access widening to trusted partners through Google’s Fairwind Program. Developers, businesses and consumers will have to wait.

The reason for the order is what Google says Carbon can do. The company calls it “our strongest model with state-of-the-art cybersecurity and long horizon capabilities”, and its headline scores cover the full cycle of a software flaw: finding it, proving it can be exploited, and fixing it. The same skills that help a defender patch a system can help an attacker break into one, which is why Carbon’s release looks so different from a normal model launch.

Google’s scores cover finding, exploiting and patching flaws

Carbon arrives two weeks after Gemini 4 Argon’s worldwide release. Google says it ranks first on version 5.0 of the Artificial Analysis Intelligence Index with a score of 59, a ranking Sundar Pichai repeated on X.

The cybersecurity figures carry the announcement. Google says Carbon scored 88.2% on SEC-bench Pro, which tests whether a model can find real vulnerabilities; 54.8% on ExploitGym, which tests whether it can exploit them; and 71.0% on Collinear’s CWE-bench, which measures fixing them. Google notes that these external tests were run “without guardrails”, meaning on the model without the safety filters customers would meet.

Google also reports internal results. It says Carbon more than doubles Argon’s success rate at writing secure code, and that its Chrome team found Carbon “performed more than 10X better than another lab’s large frontier model” when producing high-quality patches. The rival model is not named. Google says its security business Wiz also sees Carbon leading benchmarks for web penetration testing.

On general coding, Google says Carbon gained 89 Elo points on WebDev Arena to reach fourth place with a score of 1769, and that its own teams have seen it work for days on long engineering jobs such as tracing and patching subtle bugs across large codebases.

The safety claims focus on cheating and prompt injection

Google says Carbon uses the same layered safety stack as Argon, including real-time misuse defences and chain-of-thought monitoring, and that it trained the model to behave better under pressure. On Terminal-Bench 4.0, Google says successful cheating fell to 0.0%, with attempts at 0.4%. In live coding work with internal teams, it says high-severity misalignment alerts fell by “almost 80%”.

Google also claims Carbon makes about half as many unsupported claims as Argon, cuts overreach by 26% and under-service by 29%, and resisted every attack in Gray Swan’s indirect prompt injection benchmark, an attack success rate of 0.0% against Argon’s 0.7%.

Those numbers matter because of what came before. When Google published Argon’s safety report, it said it could not rule out that Argon had reached its critical capability levels for cyberattacks and biological risk. No equivalent report for Carbon was public when the model was announced.

Developers face a familiar wait, at a familiar price

Carbon will launch at Argon’s introductory price: $2 per million input tokens and $10 per million output tokens, with cached input 95% cheaper. Google says that after the introductory period the price rises to $4 and $20, but it has not said when that period ends for Carbon.

The staged rollout echoes Argon, which looked strong on paper but was short on access before its full release. Google said it is “continuing to gather feedback and iterate on guardrails” before opening Carbon more widely, and Pichai told followers to “hang tight”. Teams that already use Argon through products such as GitHub Copilot have no announced date for an upgrade.

A model built to break software is being handed to its defenders first

Releasing Carbon to defenders first is a reasonable answer to an awkward fact: a model that scores well on an exploitation benchmark is, by definition, good at a skill attackers want. Starting with vetted security teams gives the people patching systems a head start before the same capability is in wider circulation. It also gives Google real-world feedback on misuse before millions of users arrive.

The weakness is that almost everything readers can check is Google’s own account. The benchmark scores were chosen and reported by the company, the most striking comparison names no rival, and the internal alignment figures come from Google’s own teams. The external tests were run without guardrails, which shows raw capability but says little about what a customer’s version will refuse to do.

The missing safety report is the larger gap. With Argon, Google’s own documents said it could not rule out critical cyber risk. A stronger cyber model raises the obvious question of where Carbon sits against those thresholds, and the blog post does not say. Voluntary government testing helps, but its results are not public. Until Google publishes Carbon’s safety documentation, security teams should treat the scores as a claim to test on their own code, not a settled ranking.

The next things to watch are Carbon’s safety report and model card, and the date Google gives for developer access through its API.

Sources

• Google, “Gemini 4 Carbon: our next frontier model”, Koray Kavukcuoglu, 28 October 2026
• Sundar Pichai on X, 28 October 2026
• Google on X, 28 October 2026
• Google AI on X, 28 October 2026

Related stories

• Google Releases Gemini 4 Argon Worldwide: What It Costs, Who Gets It and What Google Claims
• Google Says It Cannot Rule Out Gemini 4 Argon Reaching Critical Cyber and Bio Risk Levels
• Gemini 4 Argon Is Now Generally Available in GitHub Copilot: Who Gets It, What It Costs and What Admins Need to Do
• Strong on Paper, Short on Access: What We Know About Google’s Gemini 4 Argon