Gemini 4 Carbon: Google's Cyber-First Frontier Model

Gemini 4 Carbon is Google's new frontier model, announced on October 28, 2026, with cybersecurity capability at the center of the pitch. Google describes it as its strongest model, with state-of-the-art results on benchmarks for finding, validating and patching vulnerabilities, plus the ability to sustain agentic engineering work over days rather than minutes. Access is deliberately narrow for now: a subset of cyber defenders gets it first, with broader availability promised but not dated. Here is what Google actually claimed, what independent evaluators found, and what it means if you build or secure agentic systems. Source

What Google announced

Carbon builds on Gemini 4 Argon, which Google introduced on September 30 and opened more broadly on October 13. Carbon arrived 15 days after that wider Argon rollout, which gives a sense of the release cadence Google is now running at the frontier. The announcement, authored by Koray Kavukcuoglu, Google DeepMind SVP and Google's chief AI architect, frames Carbon around two strengths: cybersecurity across the defense lifecycle, and long-horizon agentic tasks where the model persists through dead ends on multi-step engineering problems. Source Source

Independent evaluator Artificial Analysis places Carbon first on its recently updated Intelligence Index v5.0 with a score of 59, ahead of Claude Opus 5.5 at 58, GPT-6 Astra at 57 and Argon at 50. VentureBeat's count of Google's own comparison table shows Carbon posting the highest result in 15 of 17 benchmark rows, with OpenAI retaining an edge on one software engineering test and Anthropic leading on one computer-use evaluation. Google has not published a technical report for Carbon, disclosed a parameter count, or confirmed whether the model carries a new architecture. Source Source

The cybersecurity benchmarks behind the launch

The headline numbers are specific and worth reading carefully. On SEC-bench Pro, which measures autonomous discovery of real vulnerabilities in real-world software, Google reports a state-of-the-art 88.2 percent. On ExploitGym, which tests whether a model can validate risk by exploiting a flaw, Carbon scores 54.8 percent, also a state-of-the-art result. On Collinear's CWE-bench, which measures turning a validated finding into a working patch at the root cause, Carbon reaches 71.0 percent. Google notes these external evaluations were run without guardrails. Source

Google also cites internal and partner signals. Its own benchmarks show more than a 2x uplift in secure code generation over Argon. The Chrome team reports that Carbon produced high-quality patches at a rate more than 10 times better than another lab's large frontier model, and Wiz, Google's cloud security platform, observes Carbon leading on web penetration testing benchmarks used in its Scan for Good initiative. These are Google's own measurements and partner observations rather than independent evaluations, so treat them as directional. The pattern matches what we saw days earlier when Anthropic demonstrated Claude chaining flaws into working exploits against major browsers, covered in our AI vulnerability discovery post: frontier labs are now competing publicly on offensive and defensive cyber capability. Source

A defender-first rollout through Fairwind

Google is not releasing Carbon broadly at launch. The company says it is actively engaged in the US government's voluntary process for pre-release model testing, and starting this week it is making Carbon available to a subset of cyber defenders. Access then phases gradually to additional trusted partners through the Fairwind Program, the same curated channel Argon used in September, before reaching developers, businesses and consumers through Google's product surfaces "as soon as possible." No public endpoint or product-by-product schedule has been named. Source

One product destination is visible, though without a date. Varun Mohan, the former Windsurf CEO who now heads Google's Antigravity, posted that teams have been using Carbon internally on Antigravity for their hardest tasks, and that access will expand through Fairwind ahead of wider Antigravity availability. For everyone outside Fairwind, Argon remains the generally available Google frontier model, with a documented context capacity above one million tokens and the API surface developers can evaluate today. Source

Pricing: introductory now, double later

Carbon launches at the same introductory price as Argon: $2 per million input tokens and $10 per million output tokens, with cached input tokens discounted 95 percent off the input price. The footnote matters. After the introductory period, the price rises to $4 per million input tokens and $20 per million output tokens, and Google has not said when the introductory period ends. Teams planning agent workloads around Carbon should model costs at the post-introductory rate, since days-long agentic runs multiply token consumption quickly. Source Source

Days-long agentic runs and coding gains

Beyond security, Google positions Carbon as a long-horizon engineering model. The company says its internal teams have seen Carbon run for days, persisting through failed approaches to root-cause and patch subtle bugs across large codebases and low-level systems. On WebDev Arena, Carbon gains 89 elo points over its predecessor to land at number four with a score of 1768, and Google reports significant gains across coding, agentic, scientific and multimodal tasks more broadly. Source

Independent testing adds useful friction to the picture. Artificial Analysis found that while Carbon improves substantially over Argon on coding and knowledge work, it trails several rivals on professional tasks and records a higher hallucination rate than Argon on a factual-knowledge test. That tradeoff is worth tracking for agent builders: a model tuned to persist through long tasks and resist giving up can also be more willing to keep going when it should stop and verify, which is exactly the failure mode AI agent regression testing is designed to catch before deploys. Source

The alignment numbers, and the caveats

Carbon inherits Argon's multi-layered safety stack, which combines model training, real-time misuse defenses, prompt-injection resilience and chain-of-thought monitoring. On Gray Swan's Indirect Prompt Injection benchmark, Google reports Carbon resisted every evaluated attack attempt for a 0.0 percent success rate, improving on Argon's 0.7 percent. On Terminal-Bench 4.0, Google says successful cheating dropped to 0.0 percent with attempts falling to 0.4 percent, and that high-severity misalignment alerts in live internal coding use fell by almost 80 percent. Google also reports Carbon cuts unsupported claims by about half versus Argon, and reduced overreach by 26 percent and under-service by 29 percent on multi-step plans. Source

Two cautions apply to all of these figures. First, they are Google's internal measurements, published without a technical report, and the hallucination finding from Artificial Analysis points the other direction on at least one dimension. Second, benchmark resistance to prompt injection is not the same as resistance in a deployed system with real tools and real data, a distinction that matters for any agent observability practice. The broader context is that both OpenAI and Anthropic published their own monitoring research this week, covered in our piece on frontier model misalignment, and all three labs now treat monitoring as a production system rather than a research topic. Source

What this means for teams building agents

Three takeaways survive the launch framing. Cyber capability is now a headline benchmark axis, not a side note: when a flagship model launch leads with vulnerability benchmarks and another frontier lab demonstrates exploit chaining days apart, security posture becomes a selection criterion for the model layer itself, not only for the scaffolding around it. Access gating is becoming the default pattern for high-capability models, following the same controlled-route logic as Google's Agent Compute Engine: plan for a period where the strongest model is one you cannot call from production. And pricing needs post-introductory modeling from day one, because a model that runs for days at $20 per million output tokens is a different budget conversation than the launch page suggests. None of this requires action this week, since most teams cannot get Carbon yet, but it belongs in capacity and vendor planning now.