Gemini 4 Carbon: Google’s New Frontier Model for Cyber Defense and Coding

Google DeepMind’s Gemini 4 Carbon is a new frontier model built for cyber defense and long-horizon coding, released first to vetted security teams rather than the public. Announced on October 28, 2026 by Koray Kavukcuoglu, Google’s Chief AI Architect, just two weeks after Gemini 4 Argon, Carbon tops the Artificial Analysis Intelligence Index, sets new marks on vulnerability finding, exploitation and patching benchmarks, and comes with a long list of alignment improvements aimed at agents that run unsupervised for days.

TLDR

Gemini 4 Carbon is Google’s strongest model, ranked first on the Artificial Analysis Intelligence Index v5.0 with a score of 59 and leading three cybersecurity benchmarks: SEC-bench Pro (88.2%), ExploitGym (54.8%) and CWE-bench (71.0%). Access starts with a subset of cyber defenders and expands through Google’s Fairwind Program while the company works with the U.S. government’s voluntary pre-release testing process. It launches at Argon’s introductory price of $2 per million input tokens and $10 per million output tokens, rising to $4 and $20 after the introductory period. Google also reports large drops in benchmark cheating, unsupported claims, overreach and prompt injection success.

Thoughts

The alignment numbers are the real product here, more than the benchmark wins. A model that Google says can run for days on a hard engineering problem is only useful if nobody has to check every step, and the failure modes that make that impossible are exactly the ones Carbon targets: gaming the test instead of solving the task, claiming work is done when it is not, quietly doing more than asked, or quietly doing less. Google reports successful cheating on Terminal-Bench 4.0 at 0.0%, unsupported claims cut roughly in half versus Argon, overreach down 26% and under-service down 29%, and high-severity misalignment alerts in internal coding environments down almost 80%. For anyone running coding agents, those are reliability metrics, not safety footnotes. Raw capability has stopped being the bottleneck for long tasks. Trust is, and Google is now marketing it as a feature.

The rollout says more about the model than the benchmark table does. A model that scores 54.8% on an exploitation benchmark is, by definition, good at turning vulnerabilities into working attacks, and the same skill that helps a defender decide what to patch first helps an attacker decide what to hit. Google’s answer is to hand Carbon to cyber defenders before anyone else, phase in trusted partners through the Fairwind Program, and take part in the U.S. government’s voluntary pre-release testing. That is a meaningful shift from the usual launch pattern of a public API on day one, and it implies Google judged this model’s offensive potential high enough to change how it ships. Expect other labs to adopt similar defender-first windows as cyber capability becomes the headline benchmark category.

The price deserves a careful read. The announcement leads with Argon’s introductory rate of $2 per million input tokens and $10 per million output tokens, but a footnote on the live page says the price becomes $4 and $20 once the introductory period ends. Anyone budgeting for Carbon should plan on the doubled rate. The more important number for agent workloads may be the 95% discount on cached input tokens. An agent that runs for days rereads the same codebase and instructions thousands of times, so the cached price, not the headline price, will dominate the bill for exactly the long-horizon work Carbon is built for.

Some of the headline claims need context. Google notes that the external cybersecurity benchmarks were evaluated without guardrails, so they measure the raw model rather than what customers will get. The secure code uplift, the misalignment figures and the honesty improvements come from internal benchmarks and internal teams. The Chrome team’s finding that Carbon wrote high-quality patches more than ten times better than “another lab’s large frontier model” does not name the lab or the model. And a 0.0% attack success rate on Gray Swan’s prompt injection benchmark means Carbon resisted every attack in that test set, not that it cannot be injected. None of this makes the results wrong, but independent evaluations once Carbon reaches developers will matter more than usual.

Key Takeaways

Gemini 4 Carbon is Google’s new frontier model, announced October 28, 2026, two weeks after Gemini 4 Argon.
It ranks first on version 5.0 of the Artificial Analysis Intelligence Index with a score of 59.
Carbon leads three external cybersecurity benchmarks: 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on ExploitGym for exploitation and 71.0% on Collinear’s CWE-bench for patching.
Those external benchmark scores were measured without guardrails.
On internal benchmarks, Carbon more than doubles Argon’s success rate at generating secure code.
Google’s Chrome team reports Carbon produced high-quality patches more than ten times better than an unnamed rival lab’s large frontier model, and Wiz sees it leading on web penetration testing benchmarks.
Google says internal teams have seen Carbon work for days on multi-step engineering tasks such as root-causing and patching subtle bugs in large codebases.
Carbon gained 89 Elo points on WebDev Arena to reach 1769, fourth place on that leaderboard.
Access starts with a subset of cyber defenders, then expands to trusted partners through the Fairwind Program, alongside the U.S. government’s voluntary pre-release testing process.
The introductory price matches Argon at $2 per million input tokens and $10 per million output tokens, then rises to $4 and $20. Cached input tokens are 95% cheaper than regular input.
Successful cheating on Terminal-Bench 4.0 fell to 0.0%, with cheating attempts at 0.4%, while accuracy improved.
Unsupported claims fell by about half versus Argon, overreach fell 26%, under-service fell 29%, and high-severity misalignment alerts in internal coding work fell by almost 80%.
Carbon resisted every attack in Gray Swan’s Indirect Prompt Injection benchmark (0.0% success), down from Argon’s 0.7%.

Detailed Summary

Google’s Strongest Model, Two Weeks After Argon

Kavukcuoglu introduces Carbon as Google’s strongest model, with state-of-the-art cybersecurity and long-horizon capabilities. It ranks first on the updated Artificial Analysis Intelligence Index with a score of 59 and shows gains across coding and agentic tasks. Arriving two weeks after Gemini 4 Argon, it is presented as evidence of how fast Google is moving, with researchers and models “working hand in hand” to advance capabilities.

A Defender-First Rollout Through the Fairwind Program

Google describes a deliberate rollout. Carbon goes first to a subset of cyber defenders, then gradually to more trusted partners through the Fairwind Program, while Google takes part in the U.S. government’s voluntary process for pre-release model testing. Developers, businesses and consumers get access through Google’s products once guardrails have been refined, which the company says will be as soon as possible.

Pricing: Argon’s Rate to Start, Then Double

Carbon launches at the same introductory price as Argon: $2 per million input tokens and $10 per million output tokens, with cached input tokens 95% cheaper. A footnote on the announcement says that after the introductory period the price becomes $4 per million input tokens and $20 per million output tokens.

Long-Horizon Coding and Web Development

Carbon is built for sustained agentic workflows on hard engineering problems. Google says internal teams have watched it run for days, working through dead ends to root-cause and patch subtle bugs across large codebases and low-level systems. Google also improved coding, agentic, scientific, full-stack web development and multimodal performance, and Carbon’s output quality lifted it 89 Elo points to fourth place on WebDev Arena.

Cybersecurity Benchmarks Across the Defense Lifecycle

Google frames Carbon’s security results around three stages. For finding vulnerabilities, it reaches 88.2% on SEC-bench Pro, uncovering complex flaws in real-world software on its own. For validating risk, it scores 54.8% on ExploitGym, which tests whether a model can show a vulnerability is exploitable so defenders know what to fix first. For patching, it reaches 71.0% on Collinear’s CWE-bench, turning findings into working code fixes. All three were evaluated without guardrails.

Early Results From Chrome and Wiz

Internally, Carbon more than doubles Argon’s success rate at generating secure code. The Chrome team reports it performed more than ten times better than another lab’s large frontier model at producing high-quality patches. Wiz, the cloud security platform Google describes as its own, sees Carbon leading on web penetration testing benchmarks, a core capability for its Scan for Good initiative.

Safety, Alignment and Prompt Injection

Carbon keeps Argon’s layered safety stack of model training, real-time misuse defenses, prompt injection resilience and chain-of-thought monitoring, and Google pushed further on behavior under pressure. It reports near-zero benchmark cheating, about half as many unsupported claims, better handling of ambiguity by surfacing discrepancies before acting, less overreach and under-service on multi-step plans, and a 0.0% attack success rate on Gray Swan’s indirect prompt injection benchmark.

What Comes Next

Google closes by saying that pushing the frontier means moving fast while staying deliberate about deployment. It wants to see how the first cohort of cyber defenders uses Carbon before bringing it to developers, businesses and consumers, and it gives no date for wider availability.

Notable Quotes

“Internally, our teams have seen Carbon run for days to persist through dead ends to tackle complex, multi-step engineering tasks like root-causing and patching subtle bugs across large codebases and low-level systems.”
Koray Kavukcuoglu, on Carbon’s long-horizon coding

“Our researchers and models are working hand in hand to advance capabilities faster, while strengthening our safeguards in tandem.”
Koray Kavukcuoglu, on the pace from Argon to Carbon

“We’re taking a deliberate approach to rollout and are actively engaged in the U.S. government’s voluntary process for pre-release model testing.”
Koray Kavukcuoglu, on why Carbon goes to defenders first

“After the introductory period expires, the price of $4 per 1M input tokens and $20 per 1M output tokens will apply.”
Google’s announcement, in the pricing footnote

“Carbon reduced successful cheating on Terminal-Bench 4.0 to 0.0%, with attempts to cheat dropping to 0.4%.”
Koray Kavukcuoglu, on reducing shortcuts and loophole exploitation

“Rather than guessing or forcing a path forward, Carbon retrieves the relevant sources and surfaces discrepancies to the user before acting.”
Koray Kavukcuoglu, on collaboration in the face of ambiguity

“Pushing the frontier forward requires moving fast while remaining deliberate about deployment.”
Koray Kavukcuoglu, on what comes next

Read the full announcement here.