Gemini 4 Carbon: Google's new frontier model goes to cyber defenders first

On 28 October Google announced Gemini 4 Carbon, which it calls its "next frontier model" and its strongest so far. It arrives only two weeks after Gemini 4 Argon reached general availability. The headline is not just another benchmark win. Carbon's standout skill is computer security, and that is exactly why Google is not giving it to everyone at once. This week a small group of cyber defenders gets access. Developers, businesses and the public will have to wait.

What Google says Carbon can do

Google describes Carbon as built for "long-horizon" work: big engineering jobs that take many steps and run into dead ends along the way. It says its own teams have watched Carbon keep going for days on tasks such as finding the root cause of subtle bugs across large codebases and low-level systems, then patching them.

On general measures, Google says Carbon ranks first on version 5.0 of the Artificial Analysis Intelligence Index with a score of 59, and that it climbed 89 Elo points to fourth place (1,768) on WebDev Arena, a leaderboard for building websites. These are Google's own figures, reported in its announcement.

The security numbers

The figures Google leads with are about security. It splits the work into three steps that defenders care about:

• Finding flaws. 88.2% on SEC-bench Pro, a test of uncovering vulnerabilities in real-world software.
• Checking whether a flaw can be exploited. 54.8% on ExploitGym.
• Fixing the root cause. 71.0% on Collinear's CWE-bench, which turns confirmed findings into working patches.

Google says all three are state of the art. SecurityWeek reports that Google's comparison puts Carbon ahead of OpenAI's GPT-6 Astra and Anthropic's Claude Opus 5.5 and Claude Fable 5.1 on these tests. Two details matter. First, Google says the scores were measured "without guardrails", so they show what the raw model can do, not what a protected product will allow. Second, they come from Google. No independent lab has published its own results yet.

Google adds some examples from inside the company. It says Carbon is more than twice as successful as Argon at writing secure code on internal tests, and that the Chrome team found it produced high-quality patches more than ten times better than "another lab's large frontier model", which Google does not name. Wiz, Google's cloud security platform, says Carbon leads its web penetration-testing benchmarks.

Why exploitation is on the list

It may seem odd for a company to boast that its model is good at exploiting software. Google's argument is that defenders now use models to check which bugs can really be exploited, so they know what to fix first, or whether to fix it at all. That is true, and it is also the problem. A model that can prove a flaw is exploitable for a defender can do the same for an attacker. This dual-use risk is the reason for the staged rollout.

Who gets it first

Google says it will make Carbon available "starting this week" to a subset of cyber defenders, then gradually add trusted partners through its Fairwind Program. It also says it is taking part in the US government's voluntary process for testing models before release, and that it will keep working on guardrails before releasing Carbon to developers, businesses and consumers "as soon as possible". There is no date for that.

Fairwind is not a public beta. According to Google DeepMind's programme page, it has more than 650 partners worldwide and prioritises governments and national cyber authorities, critical infrastructure operators such as healthcare, telecoms, energy and finance, and core technology platforms. Applicants are background-checked. The programme's rules require approved organisations to use phishing-resistant multi-factor authentication, may only give access to their internal security, incident response or penetration-testing teams, must track who uses it, and may not share or resell access. Permitted "dual-use" work includes authorised threat simulation, reverse engineering and malware analysis for defence or research.

Safety claims beyond cyber

Google also reports a set of behaviour improvements. Again, these are its own measurements:

• Less cheating. On Terminal-Bench 4.0, Carbon's attempts to cheat fell to 0.4% and none succeeded.
• Fewer warnings in real use. In live coding with Google's own teams, high-severity misalignment alerts dropped by almost 80%.
• More honesty. About half as many unsupported claims as Argon.
• Staying in scope. Overreach down 26% and under-delivery down 29%.
• Prompt injection. 0.0% attack success on Gray Swan's indirect prompt-injection benchmark, against 0.7% for Argon.

Price

When it does launch more widely, Google says Carbon will start at Argon's introductory price of $2 per million input tokens and $10 per million output tokens, with cached input 95% cheaper. After the introductory period it rises to $4 and $20. That is a frontier model at a mid-range price, at least to begin with.

Part of a wider pattern

Carbon is the clearest example of a trend that ran through the whole week: security skill has become both a selling point and a reason to hold models back.

• Mistral released the open weights of Mistral Large 4 on 29 October and put security front and centre. Mistral reports 51% on the Artificial Analysis Cyber Index and a 96.6% refusal rate on malicious cyber requests. It also says it saw "a potential for uplift to conduct real attacks" in live traffic and is changing its guardrails. A specialised security version is only for vetted partners.
• OpenAI said its new mid-price model, GPT-6.1 Terra, meets the "Critical" cybersecurity threshold in its Preparedness Framework and keeps the protections built for GPT-6 Astra.
• Oracle announced AI Security Mesh, which uses OpenAI's cyber models to help customers find and fix vulnerabilities, with Oracle running the testing infrastructure.

The difference with an open-weight model like Mistral's is that once the weights are public, nobody can take them back. Google's approach keeps the model behind its own controls. Both companies say they are putting defenders first. They have chosen very different ways of doing it.

What it means if you are not a defender

For now, nothing changes for most people. You cannot use Carbon in the Gemini app or the API yet. If you run a small business or a website, the practical lesson is the same as in last week's post on PHP: AI is making it faster to find and exploit bugs, so keep software up to date and switch on automatic updates where you can.

What to watch

• Independent results. Do outside testers, including government AI security institutes, confirm Google's numbers?
• A release date for developers and businesses, and what guardrails come with it.
• Whether "defenders first" becomes the normal way to launch frontier models, and who gets to decide who counts as a defender.