Google DeepMind introduced Gemini 4 Carbon on October 28, 2026, describing it as its strongest model, with state-of-the-art cybersecurity and long-horizon capabilities, according to Google. It is not yet generally available. Access starts with a subset of cyber defenders and will expand to more trusted partners through Google's Fairwind Program.
The cybersecurity results lead the announcement. Evaluated without guardrails, Carbon scores 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on ExploitGym for exploitation and 71.0% on CWE-bench for patching. Google says it ranks first on version 5.0 of the Artificial Analysis Intelligence Index with a score of 59, and gains 89 Elo points to reach fourth place (1768) on WebDev Arena. Internally, Google reports more than twice the success rate of Gemini 4 Argon at generating secure code.
Google also published safety figures from its own testing. Successful cheating on Terminal-Bench 4.0 fell to 0.0%, with cheating attempts at 0.4%. High-severity misalignment alerts in live coding work with internal teams dropped by almost 80%. Unsupported claims were cut roughly in half compared with Argon, overreach fell 26% and under-service fell 29%. On Gray Swan's indirect prompt injection benchmark, the attack success rate went from 0.7% for Argon to 0.0%. These are Google's measurements, not independent audits.
The staged rollout reflects the dual-use problem. A model that finds and exploits vulnerabilities for defenders could do the same for attackers. Google says it is taking part in the U.S. government's voluntary process for pre-release model testing and will keep refining guardrails before opening Carbon to developers, businesses and consumers. It has not given a date.
Pricing is set. Carbon launches at the same introductory price as Argon, which shipped two weeks earlier: $2 per million input tokens and $10 per million output tokens, with cached input 95% cheaper. After the introductory period, the price rises to $4 and $20.
What to watch
For security teams, two questions matter more than the leaderboard: when access opens beyond the first cohort, and whether independent testers reproduce the exploitation and patching scores. Until then, the most useful signal is how Google's chosen defenders report using it.
This article is not legal advice.
