Gemini 4 Carbon is Google's newest frontier AI model, announced on 28 October 2026 on the Google blog by Koray Kavukcuoglu of Google DeepMind. Google calls it its strongest model, with state-of-the-art cybersecurity and long-horizon capabilities, and it builds on Gemini 4 Argon, released two weeks earlier. Unlike most launches, Carbon is not generally available yet: it goes to cyber defenders first.
Ranking: Google reports that Carbon is #1 on version 5.0 of the Artificial Analysis Intelligence Index, with a score of 59.
Who can use Gemini 4 Carbon
Google is taking a staged rollout and says it is part of the U.S. government's voluntary pre-release model testing process. Access starts with a subset of cyber defenders, then extends gradually to trusted partners through Google's Fairwind Program, while Google gathers feedback and refines guardrails before opening Carbon to developers, businesses and consumers. At launch it will cost the same as Argon's introductory price: $2 per million input tokens and $10 per million output tokens, with cached input 95% off.
Cybersecurity results Google reports
Google evaluated Carbon across the defense lifecycle, without guardrails:
- Finding vulnerabilities: 88.2% on SEC-bench Pro.
- Validating risk through exploitation: 54.8% on ExploitGym.
- Patching at the root cause: 71.0% on Collinear's CWE-bench.
- Secure code: more than 2x the success rate of Argon on internal benchmarks.
- Patches: the Chrome team reported Carbon did more than 10x better than another lab's large frontier model (not named) at generating high-quality patches.
Coding and long-horizon work
Carbon is built for sustained agentic workflows. Google says its teams have seen it run for days, working through dead ends to root-cause and patch subtle bugs across large codebases and low-level systems. On WebDev Arena it gained 89 Elo points to reach #4 (1768).
Safety and alignment
- Successful cheating on Terminal-Bench 4.0 fell to 0.0%, with cheating attempts at 0.4%, while accuracy improved.
- About 2x fewer unsupported claims than Argon in internal testing.
- Overreach down 26% and under-service down 29%, so plans run end to end within scope.
- 0.0% attack success on Gray Swan's Indirect Prompt Injection benchmark, down from Argon's 0.7%.
- High-severity misalignment alerts in live internal coding dropped by almost 80%.
What it means for security teams
A frontier lab giving defenders first access is a sign of how capable these models have become at finding and exploiting flaws. Security teams should plan now for using models like this in vulnerability discovery and patching, alongside the governance around them. Our courses on securing agentic AI and on generative AI risks cover the controls.
