Google’s newest model is launching to almost nobody. Gemini 4 Carbon, which Google announced on Oct 28, 2026, goes first to a limited set of cyber defenders. Developers and consumers get it later. That tells you how Google sees the model: strong enough at finding and exploiting bugs that the rollout needs a gate.
It also arrives only two weeks after Gemini 4 Argon. That pace is the other story here.
What Carbon does well
Carbon ranks #1 on version 5.0 of the Artificial Analysis Intelligence Index with a score of 59. Google says it improved across coding, agentic tasks, scientific work, full-stack web development and multimodal understanding. On WebDev Arena it gained 89 Elo points and sits at #4 with 1768. That’s a big jump, though not first place, and OpenAI and Anthropic still have a say there.
The more interesting claim is endurance. Google says internal teams watched Carbon run for days on hard engineering jobs, pushing through dead ends to root-cause and patch subtle bugs in large codebases and low-level systems. Long-horizon work is where agent products tend to fall apart, so this is the number to test once you get access.
The security numbers
This is the headline. Google reports these results, evaluated without guardrails:
- SEC-bench Pro, finding vulnerabilities: 88.2%
- ExploitGym, exploitation: 54.8%
- CWE-bench, patching root causes: 71.0%
- More than 2x improvement over Argon in generating secure code on internal benchmarks
Google also says the Chrome team found Carbon more than 10x better than another lab’s frontier model at producing high-quality patches, and Wiz saw it lead on web penetration testing. These are vendor-reported figures, so treat them as promising, not settled. Still, covering detection, validation and remediation in one model is the right target for defenders.
Safety claims
Google spends real space on alignment. Carbon reportedly cut successful cheating on Terminal-Bench 4.0 to 0.0%, with attempted cheating at 0.4%. High-severity misalignment alerts in live internal coding dropped almost 80%, and unsupported claims fell about 2x versus Argon. On Gray Swan’s indirect prompt injection benchmark, Carbon hit 0.0% attack success, down from Argon’s 0.7%.
If those hold outside Google, they matter more than a few index points. An agent that runs for days is only useful if it doesn’t invent evidence or wander out of scope. Google says overreach fell 26% and under-service 29%.
Pricing and availability
Pricing matches Argon: $2 per million input tokens and $10 per million output tokens, with cached input 95% off. That is aggressive for a model claiming the top spot. Access starts this week for a subset of cyber defenders, then widens to trusted partners through the Fairwind Program. Google is also taking part in the U.S. government’s voluntary pre-release testing process. There is no date for general availability, only “as soon as possible.”
Does it matter?
Yes, with caveats. A staged release for a dual-use model is sensible, and it sets a template rivals will likely follow. But you can’t build on Carbon today, and the benchmark results come from Google. Watch for independent replication of the exploitation and patching scores. If they hold up, Google has a real claim to the best security model on the market, at a price competitors will struggle to match.
