Google Launches Gemini 4 Carbon AI Model With Cybersecurity Upgrades, Limits Initial Access

Google has unveiled Gemini 4 Carbon, its latest frontier artificial intelligence (AI) model, designed to tackle advanced cybersecurity threats, complex coding challenges, and long-running engineering tasks.

The new model delivers improved performance in vulnerability detection, exploitation testing, and software patching, but Google is initially restricting access to selected cybersecurity defenders as it evaluates safety measures before a broader rollout.

Here's what Google revealed.

TL;DR

 

• Google launched Gemini 4 Carbon on October 28, 2026, with advanced cybersecurity and coding capabilities.
• The model scored 88.2% on vulnerability detection, 54.8% on exploitation testing, and 71% on software patching benchmarks.
• Access will initially be restricted to selected cybersecurity defenders through a phased rollout.
• Introductory API pricing starts at $2 per million input tokens.

Google Gemini 4 Carbon Brings Advanced Cybersecurity Capabilities

In its official announcement, Google described Gemini 4 Carbon as its strongest model, highlighting substantial improvements across cybersecurity defense, coding, agentic workflows, and long-horizon engineering tasks.

Source

The model follows Gemini 4 Argon, Google's earlier frontier AI model, as the company continues developing advanced AI systems for software engineering and enterprise applications.

According to Reuters, the launch also intensifies Google's competition with OpenAI and Anthropic, particularly as AI companies race to develop more capable coding and cybersecurity systems.

Google says Carbon can assist cybersecurity professionals throughout the vulnerability management process, from identifying potential security weaknesses and determining whether they can be exploited to generating patches that address underlying software flaws.

The model ranked first on version 5.0 of the Artificial Analysis Intelligence Index with a score of 59, according to Google's announcement.

More notably, Google reported strong results across three cybersecurity benchmarks:

• SEC-bench Pro: 88.2% for identifying real software vulnerabilities.
• ExploitGym: 54.8% for evaluating vulnerability exploitation.
• CWE-bench: 71.0% for generating software patches.

These benchmark results were obtained in evaluations without guardrails and should not be interpreted as guaranteed performance across real-world security environments.

Google also reported that Carbon achieved more than twice the success rate of Gemini 4 Argon when generating secure code in its internal evaluations.

Its Chrome team observed that Carbon performed more than ten times better than another laboratory's large frontier model when generating high-quality security patches.

These improvements could make the model useful for cybersecurity teams seeking to identify and remediate vulnerabilities more efficiently, although independent real-world validation remains important.

Gemini 4 Carbon Can Handle Coding Tasks That Run For Days

Beyond cybersecurity, Google designed Gemini 4 Carbon to handle complex engineering problems requiring sustained reasoning and multiple stages of execution.

The company said its internal teams have observed Carbon working for days on difficult engineering tasks, including identifying the root causes of software bugs and developing fixes across large codebases.

Rather than simply generating short code snippets, Carbon is designed to persist through unsuccessful attempts and continue working toward a solution.

The model also demonstrated improvements in full-stack web development, scientific reasoning, multimodal understanding, and agentic workflows.

Google reported that Carbon gained 89 Elo points on WebDev Arena, reaching fourth place, reflecting improvements in the quality of web development outputs.

The company also highlighted progress in reducing problematic AI behavior.

According to Google's internal testing, high-severity misalignment alerts declined by almost 80% in live coding environments, while unsupported claims were reduced by approximately half compared with Argon.

Carbon also recorded a 0% attack success rate on Gray Swan's Indirect Prompt Injection benchmark under the tested conditions.

Google further reported reductions of 26% in overreach and 29% in under-service, suggesting improvements in how the model follows instructions and respects task boundaries.

These results remain specific to the company's reported evaluations and do not establish that Carbon is immune to security attacks or reliability failures.

Google Limits Gemini 4 Carbon Access Amid Security Concerns

Despite the model's advanced capabilities, Google is taking a gradual approach to deployment.

As Business Today reported, Gemini 4 Carbon will initially be available to a limited group of cybersecurity defenders before access is expanded to other trusted partners.

Google confirmed that the rollout will take place through its Fairwind Program, with additional access being introduced as the company collects feedback and strengthens safeguards.

The company is also participating in the US government's voluntary process for pre-release model testing.

This cautious approach is particularly important because advanced AI cybersecurity capabilities have potential dual-use applications.

A model capable of identifying vulnerabilities and validating whether they can be exploited could help security teams defend their systems. However, similar capabilities could also be misused by malicious actors.

Google says its safety strategy combines model training, real-time misuse defenses, prompt-injection resistance, and monitoring mechanisms.

In the official announcement, Koray Kavukcuoglu, Senior Vice President at Google DeepMind and Google's Chief AI Architect, wrote:

"We're taking a deliberate approach to rollout and are actively engaged in the U.S. government's voluntary process for pre-release model testing."

He also confirmed that Google is gathering feedback and updating safeguards before extending access to developers, businesses, and consumers.

No specific date for broader public availability has been announced.

Gemini 4 Carbon Pricing Starts At $2 Per Million Input Tokens

Google has also announced introductory pricing for Gemini 4 Carbon, matching the initial rates offered for Gemini 4 Argon.

The model will cost $2 per million input tokens and $10 per million output tokens, with cached input tokens receiving a 95% discount on the standard input-token rate.

Once the introductory pricing period ends, rates will increase to $4 per million input tokens and $20 per million output tokens.

However, the announced pricing does not mean the model is immediately available to all developers through Google's API.

Access remains restricted during the initial rollout, with broader commercial availability planned for a later stage.

As Small Business Trends highlighted, the model's cybersecurity and coding capabilities could eventually benefit smaller businesses that lack extensive in-house security resources.

However, these potential benefits depend on broader availability, practical deployment costs, and the model's ability to deliver reliable results in real-world business environments.

For now, Google is positioning Gemini 4 Carbon as a frontier model capable of handling increasingly complex software engineering and cybersecurity tasks while maintaining tighter control over its initial deployment.

The next major development will be how the model performs with its first group of cybersecurity defenders and when Google decides to expand access to developers, enterprises, and everyday users.