Google's Gemini 4 Carbon Goes to Cyber Defenders First, With Wider Access Still Undated

What Carbon is built to do

The pitch is endurance. Google says Carbon is designed for "sustained agentic workflows", meaning tasks where the model works through many steps on its own rather than answering a single prompt. In the announcement, Google says its internal teams have seen Carbon run for days, working past dead ends on jobs like finding the root cause of subtle bugs across large codebases and patching them.

Security is the other half. Google frames Carbon around three stages of defensive work: finding vulnerabilities, checking whether they can be exploited, and fixing them. It reports these results, which it says were evaluated without guardrails:

• 88.2% on SEC-bench Pro, for finding real vulnerabilities
• 54.8% on ExploitGym, for exploitation
• 71.0% on CWE-bench, for patching at the root cause

Google also says Carbon ranks first on version 5.0 of the Artificial Analysis Intelligence Index with a score of 59, and climbed 89 Elo points to fourth place on WebDev Arena. On its own internal benchmarks, Google says Carbon more than doubles Argon's success rate at generating secure code, and that its Chrome team found Carbon more than 10 times better than another lab's large frontier model at producing high-quality patches.

All of these figures come from Google. Some use public benchmarks, but the announcement does not include independent verification, and the internal results can't be checked from outside.

Why the rollout is staged

The same skills that help a defender find and fix a vulnerability can help an attacker find and use one. That is the logic behind Google's approach. The company says it is taking a "deliberate approach to rollout", is taking part in the US government's voluntary pre-release model testing process, and will add trusted partners gradually through what it calls its Fairwind Program. It says it is still gathering feedback and iterating on guardrails before offering Carbon "via our product surfaces as soon as possible."

Google also reports safety results, again from its own testing. It says Carbon cut successful cheating on Terminal-Bench 4.0 to 0.0%, with cheating attempts at 0.4%, and that high-severity misalignment alerts in live coding with internal teams dropped by almost 80%. It reports roughly half as many unsupported claims as Argon, 26% less overreach and 29% less under-service on multi-step tasks. On Gray Swan's indirect prompt-injection benchmark, Google says Carbon had a 0.0% attack success rate, compared with Argon's 0.7%.

Prompt injection matters more as models act on their own. It is when instructions hidden in a webpage, document or email trick a model into doing something its user didn't ask for, and a model that runs for days touches a lot of untrusted content.

Pricing, and what comes next

When it does open up, Google says Carbon will launch at the same introductory price as Argon: $2 per million input tokens and $10 per million output tokens, with cached input 95% cheaper. 9to5Google reports the price then rises to $4 and $20 per million after the introductory period.

For now, there is no public timeline. Google says only that it looks forward to bringing Carbon to developers, businesses and consumers "soon", after the first group of cyber defenders has used it.

Cole's take: The structure here is the useful part. A model pitched mainly on finding and exploiting vulnerabilities is exactly the kind you'd want to release slowly, and Google holding back a date makes sense. I'd wait for outside testing before reading too much into the benchmark lead.