Google announces Gemini 4 Carbon, open first to cyber defenders

Google announced Gemini 4 Carbon on 28 October 2026, calling it its strongest model, with "state-of-the-art cybersecurity and long horizon capabilities". According to Google's announcement by Koray Kavukcuoglu, Carbon ranks first on the recently updated v5.0 of the Artificial Analysis Intelligence Index, at 59. It arrives two weeks after Gemini 4 Argon, which Google launched on 13 October.

Who can use it now

Almost nobody. Google says it is taking a "deliberate approach" and is taking part in the US government's voluntary process for pre-release model testing. Starting this week, a subset of cyber defenders get Carbon, and Google will phase in more trusted partners through its Fairwind Program. It says it will bring Carbon to developers, businesses and consumers "as soon as possible" and gives no date.

The security numbers Google reports

• SEC-bench Pro, for finding vulnerabilities: 88.2%.
• ExploitGym, for exploiting them: 54.8%.
• CWE-bench, from Collinear, for patching: 71.0%.
• Google says these external benchmarks were run without guardrails, and that on its own internal tests Carbon more than doubles Argon's success rate at generating secure code.
• Google says the Chrome team found Carbon more than 10 times better than another lab's large frontier model at producing high-quality patches. Google does not name that model.

These are Google's figures. Google also reports that Wiz, a cloud security company it owns, saw Carbon leading benchmarks for web penetration testing. The announcement does not link run logs or say who else ran the tests.

Coding, agents and behaviour

Google says Carbon is built for long agentic jobs and that internal teams have seen it run for days on multi-step engineering tasks, such as tracing and patching subtle bugs in large codebases. On WebDev Arena it gained 89 Elo points to reach fourth place at 1769.

The announcement also makes several claims about conduct, all from Google's internal testing unless stated otherwise:

• Cheating on Terminal-Bench 4.0 fell to 0.0% of successful runs, with attempts at 0.4%.
• High-severity misalignment alerts in live internal coding environments dropped by almost 80%.
• Unsupported claims fell by about half against Argon.
• Overreach fell 26% and under-service 29%, which Google presents as staying within project scope.
• On Gray Swan's indirect prompt injection benchmark, Argon's 0.7% attack success rate fell to 0.0%.

A 0.0% result on a fixed benchmark means it resisted every attack in that test. It does not mean the model cannot be injected in your environment.

What it costs, and what Google leaves out

Google says Carbon will launch at Argon's introductory price: $2 per million input tokens and $10 per million output tokens, with cached input tokens 95% cheaper. A footnote says that after the introductory period the price becomes $4 and $20. The announcement does not say when that period ends for Carbon, and Argon's own promotional price runs to 30 November 2026.

Also missing: context window size, latency, availability on Vertex AI or the Gemini API, and any independent result beyond the Artificial Analysis ranking. Until the model reaches developers, plan around Argon and treat Carbon as something to evaluate once access opens.