Google released Gemini 4 Carbon on Wednesday, a frontier model the company says leads every major cybersecurity benchmark it tested. Almost nobody can use it yet.

The model is live for a small group of cyber defenders through Google's Fairwind Program. Developers, businesses and consumers get access later, once Google finishes reviewing guardrails with early users. Google announced it on its Keyword blog, and Reuters reported the launch the same day.

Benchmark numbers Google put on the record

Carbon ranks first on version 5.0 of the Artificial Analysis Intelligence Index with a score of 59. The Verge reported that the score puts it ahead of Claude Opus 5.5 and GPT-6 Astra.

On security work, Google reports three results: 88.2% on SEC-bench Pro for finding vulnerabilities in real software, 54.8% on ExploitGym for judging whether a flaw can actually be exploited, and 71.0% on CWE-bench for writing patches that fix root causes. Google says it ran these evaluations without guardrails.

Coding scores moved as well. Carbon gained 89 Elo points on WebDev Arena to reach fourth place at 1768. Google says internal teams have watched it run for days on multi-step engineering tasks, including tracing subtle bugs through large codebases and low-level systems.

"On internal benchmarks, Carbon drives a strong uplift in generating secure code, and in live coding environments with our own teams it shows reduced misalignment and fabrication rates," said Koray Kavukcuoglu, senior vice president at Google DeepMind and Google's chief AI architect.

Two claims worth reading closely

Google says the Chrome team found Carbon produced high-quality patches "more than 10X" better than "another lab's large frontier model." The comparison carries no name, and neither the benchmark nor the patch set is public. Treat the multiplier as a vendor statement until somebody outside Google repeats it.

The cloud security firm Wiz also reported that Carbon led on web penetration testing benchmarks. Wiz is a Fairwind partner, which means the result comes from a company with a commercial stake in the program's success. That does not make the number wrong. It means the number needs a second source before it carries much weight.

Pricing, and the part about access

Carbon launches at the same introductory rate as Argon: $2 per million input tokens and $10 per million output tokens, with cached input billed at 95% off the input price. After the introductory period the price doubles to $4 and $20 per million. Google did not say how long the discount runs.

The access decision matters more than the price. A model that finds and exploits vulnerabilities at this level is dual-use by design. Google is handing it to incident response teams, government cyber authorities and critical infrastructure operators first, and requires partners to restrict use to security staff working with multi-factor authentication in place. Fairwind already lists more than 650 partners from its September launch.

Google also says it is taking part in the U.S. government's voluntary pre-release testing process. That is a disclosure, not an approval. No regulator has signed off on how Carbon behaves outside a test harness.

The safety figures Google chose to publish

Google paired the capability claims with alignment numbers it usually keeps internal. On Terminal-Bench 4.0, successful cheating fell to 0.0% while cheating attempts dropped to 0.4%, and overall accuracy improved at the same time. In live coding work with Google's own teams, high-severity misalignment alerts fell by almost 80%.

Carbon also cut unsupported claims by roughly half compared with Argon, reduced actions outside a task's scope by 26%, and reduced what Google calls under-service by 29%. On Gray Swan's Indirect Prompt Injection Benchmark, the model resisted every attack tested, against a 0.7% success rate for Argon.

Read those figures for what they are. They come from Google's internal tests plus one third-party benchmark. A 0.0% injection success rate means the tested attacks failed. It does not mean the attack class is closed, and benchmark results rarely survive contact with motivated adversaries.

Why this release lands now

Carbon arrives two weeks after Gemini 4 Argon, a short gap for a frontier model and a sign of how fast Google is now shipping. Reuters framed the launch as the company stepping up competition with OpenAI and Anthropic on coding and security tools.

The timing sits against a wider shift. On Thursday, Reuters reported that researchers had a Chinese AI model carry out complex cyberattacks in controlled tests. Offensive and defensive security work is automating at roughly the same pace, which turns access policy into part of the product rather than an afterthought.

What to watch next

• When Google opens Carbon to developers, and whether general access keeps the cyber capabilities or ships with them narrowed.
• Whether independent labs reproduce the SEC-bench Pro and ExploitGym scores. Vendor-run evaluations on vendor-chosen benchmarks are the weakest evidence in this category.
• Whether Fairwind partners publish patch volumes or incident data. Deployment numbers would say more than any leaderboard.
• What happens to pricing once the introductory window closes, since $4 and $20 per million tokens changes the math for teams running agents for days.

For now Carbon is a controlled experiment with a launch event attached. The benchmark table is strong. What decides whether it matters is what defenders do with the model over the next few months, and how much of that Google lets the rest of us see.

Sources

1. Gemini 4 Carbon: our next frontier model, Google, October 28, 2026
2. Google launches Gemini 4 Carbon AI model with cybersecurity focus, Reuters, October 28, 2026
3. Google launches Gemini 4 Carbon with a significant leap in cybersecurity, The Verge, October 28, 2026
4. Google says Gemini 4 Carbon beats its predecessors at finding and fixing security flaws, Help Net Security, October 29, 2026
5. Google's Fairwind Program: cyber defense tools for trusted partners, Google, September 2, 2026
6. Chinese AI model carries out complex cyberattacks in controlled tests, researchers say, Reuters, October 29, 2026