Gemini 4 Carbon finds software flaws best, but only cyber defenders get it now

Google has introduced Gemini 4 Carbon, which it calls its strongest model yet, with the first access going only to a subset of cyber defenders. The Information reported the launch as Google’s second major model in a month; Google’s own post says it follows Gemini 4 Argon by two weeks.

Cyber defenders get access first, everyone else later

According to the Google announcement by Koray Kavukcuoglu, Google DeepMind’s SVP and Chief AI Architect, Carbon is available this week to a subset of cyber defenders. Access will widen step by step to more trusted partners through the Fairwind Program. Developers, businesses and consumers will get it later through Google’s product surfaces, “as soon as possible” in Google’s words. Google gives no date and no list of products.

Pricing is published already. The introductory rate matches Argon: $2 per million input tokens and $10 per million output tokens, with cached input tokens 95% cheaper. After the introductory period the prices rise to $4 and $20. Google does not say how long that period lasts.

Google says it is taking a deliberate approach to rollout and is taking part in the U.S. government’s voluntary pre-release model testing process.

Security benchmarks carry the pitch

Google presents Carbon as state-of-the-art in cybersecurity and long-horizon work, meaning sustained agentic tasks. Its figures:

• SEC-bench Pro (finding vulnerabilities): 88.2%
• ExploitGym (exploitation): 54.8%
• CWE-bench (patching): 71.0%, per Collinear’s leaderboard
• Artificial Analysis Intelligence Index v5.0: first place with a score of 59
• WebDev Arena: 1769, up 89 Elo points, fourth place

Google also says Carbon more than doubled Argon’s success rate on its internal secure-code generation tests. It cites the Chrome team as finding it more than 10x better at producing high-quality patches than another lab’s large frontier model, which Google does not name. Wiz is quoted as reporting a lead on web penetration testing benchmarks. Google notes the external benchmarks were run without guardrails.

On prompt injection, the Gray Swan benchmark shows a 0.0% attack success rate for Carbon against 0.7% for Argon.

For long tasks, Google says internal teams have watched the model work for days, getting past dead ends while tracing and fixing subtle bugs in large codebases and low-level systems.

Safety claims are measured against Argon

Carbon uses the same safety stack as Argon: model training, real-time misuse defenses, prompt-injection resilience and chain-of-thought monitoring. Google reports that on Terminal-Bench 4.0 successful cheating fell to 0.0% and cheating attempts to 0.4%. In live internal coding environments, high-severity misalignment alerts dropped by almost 80%. Unsupported claims fell about 2x, overreach by 26% and under-service by 29%. These are Google’s own tests, and the post gives no independent replication.

The pairing of strong exploitation scores and a restricted rollout is the story here. A model that scores 54.8% on an exploitation benchmark helps defenders and could help attackers, which is likely why access is staged. Google does not spell out that reasoning, so it remains an inference.

What to watch as access widens

The pace of Google’s releases is the first thing to follow. The Information’s summary says Google went almost a year without a new flagship before these two launches. Our own coverage shows how fast Argon was put to use: Gemini 4 Argon turned 80,000 NASA files into a deck in Google’s examples. Carbon sits at the same token price for now, so the open question is whether customers pay for the stronger model or stay on Argon.

Hardware is the second thread. We reported that OpenAI plans to buy Google TPUs, according to The Information, which means Google’s chips may increasingly serve a rival’s models as well as its own.

Three things would confirm or undercut Google’s claims: outside testers getting access and reproducing the SEC-bench Pro and ExploitGym scores, a general availability date with the post-introductory price in force, and details on what the U.S. pre-release testing found. None of these is in the announcement yet.