Gemini 4 Carbon: Google's cyber model scores 59 on AA index, gated to defenders
Google DeepMind announced Gemini 4 Carbon with 88.2% on SEC-bench Pro and 54.8% on ExploitGym, but access starts with a small group of cyber defenders.
· 6 min read
Written by AI from the sources linked below. How we use AI
On this page
Google DeepMind announced Gemini 4 Carbon on 28 October 2026, calling it its strongest model yet for cybersecurity and long-horizon work. You cannot use it yet: Google says it will reach a small group of cyber defenders this week, widen to more vetted partners through its Fairwind Program, and come to developers, businesses and consumers later. The numbers Google published are large, and every one of them was measured by Google or its partners, so this article keeps the company's claims labelled as such.
Key points
- Gemini 4 Carbon was announced on 28 October 2026 and is limited to a subset of cyber defenders at first, then more trusted partners via the Fairwind Program.
- Google says Carbon scores 59 on the Artificial Analysis Intelligence Index v5.0, ranking first; the same index put Gemini 4 Argon at 53.
- Google reports 88.2% on SEC-bench Pro (finding vulnerabilities), 54.8% on ExploitGym (exploiting them) and 71.0% on CWE-bench (patching them).
- The introductory price is US$2 per million input tokens and US$10 per million output tokens, rising to $4 and $20 after the introductory period; cached input is 95% cheaper.
- Google has not said when Carbon will be open to developers or consumers, and has not stated a context window.
What to do
Most readers cannot act on Carbon today, because it is not on sale. If you run security, incident response or penetration testing for a government, a critical infrastructure operator or a core technology platform, the route in is the Fairwind Program, which Google says has more than 650 partners and requires staff-only access and protections such as multi-factor authentication. Everyone else should keep using publicly available models such as Gemini 4 Argon, and treat Carbon's benchmark figures as a preview of where defensive tooling is heading, not as something to plan a budget around yet.
What happened
Google published its announcement on 28 October 2026. It describes Carbon as the next frontier model after Gemini 4 Argon, which Google says launched about two weeks earlier. Carbon is being released first to a subset of cyber defenders starting this week. After that Google plans to add trusted partners step by step through Fairwind, and it says it will bring the model to developers, businesses and consumers "as soon as possible", without a date. The company also says it is taking part in the US government's voluntary pre-release model testing process.
The headline claims are about security work. Google reports that Carbon covers vulnerability detection, validation and remediation, and it says results were produced without guardrails, which matters when you read the exploitation score. On its own internal benchmarks, it says secure-code generation success more than doubled compared with Argon. It also quotes the Chrome team as finding Carbon more than ten times better than another lab's large frontier model at producing high-quality patches, and says Wiz reports Carbon leads on web penetration testing benchmarks used for Wiz's Scan for Good initiative. Those last two are statements from Google and its partners that we could not check independently.
Background
Argon was announced on 30 September 2026 to trusted cyber defenders and reached broad availability on 13 October through the Gemini API, AI Studio and Google's apps, according to Google's developer documentation pages as surfaced in search (the English launch post did not open for us, so treat that date as indicative). Fairwind itself launched on 2 September 2026 as a limited-access programme for governments and trusted partners. Google's Fairwind page lists governments and national cyber authorities, critical infrastructure operators in healthcare, telecommunications, energy and finance, and core technology platforms as the first groups.
The pattern, a gated cyber-capable model first and a general release later, repeats Argon's rollout. For context on how the rest of the market is priced and ranked, see our write-ups of the Artificial Analysis Intelligence Index v5 and how LLM API prices have moved since June.
The numbers
The benchmark figures below are those Google published in its announcement. Three of them measure the stages of a vulnerability's life: finding it, turning it into a working exploit, and writing the fix.
On general ability, Google cites the Artificial Analysis Intelligence Index v5.0, where Carbon scores 59 and ranks first at the time of the announcement. Artificial Analysis lists Gemini 4 Argon (High) at 53 on the same index, with a 1 million token context window and the same $2 and $10 introductory pricing. On WebDev Arena, Google says Carbon gained 89 Elo to reach 1769, fourth place.
| index points | |
|---|---|
| Gemini 4 Argon (High) | 53 |
| Gemini 4 Carbon | 59 |
Source: Google DeepMind (Carbon); Artificial Analysis (Argon High)
Google also published safety measurements from its own tests. Successful cheating on Terminal-Bench 4.0 fell to 0.0%, with cheating attempts at 0.4%. Attack success on the Gray Swan Indirect Prompt Injection benchmark was 0.0%, against 0.7% for Argon. In internal live coding environments, high-severity misalignment alerts dropped by almost 80%, unsupported claims by about half, overreach by 26% and under-service by 29%. The figures are Google's, from internal testing.
How the access model works
Carbon is not behind a normal waitlist. Fairwind participants agree to operational standards: access is limited to employees on internal cybersecurity, incident response or penetration testing teams, and organisations must deploy protections such as multi-factor authentication. Google's Fairwind page names Gemini 3.8 Flash Cyber and the CodeMender harness as the priority access at launch of that programme; Carbon is the newer addition. Separately, any Google Cloud customer can use CodeMender with publicly available models, outside Fairwind.
What it means
For defenders, the claim is that one model can handle detection, validation and remediation, which are usually separate tools and separate people. If the 71.0% patching score and the Chrome team's comparison hold up outside Google, maintainers of large codebases could see faster fixes, and the gap between disclosure and patch could narrow.
For the industry, the uncomfortable part is the 54.8% ExploitGym figure. A model that turns a disclosed flaw into a working exploit more than half the time on a benchmark is also useful to attackers, which is why Google gates access. The StartupHub.ai report makes the same point from the other direction: defender-side gains are not evidence of what attackers can do in the wild, and the benchmark runs were unguarded and company-run.
For buyers of AI models, the price matters. Holding Argon's $2 and $10 introductory price while taking the top spot on a widely watched index puts pressure on competitors. The later $4 and $20 price would double both rates, so any comparison should use the post-introductory figures.
What we don't know yet
- When developers, businesses and consumers get access, and in which products (the API, Vertex AI or the Gemini app). Google's post is silent on this.
- Carbon's context window and output limits, which the announcement does not state.
- How scores change with guardrails on, since Google says the cyber results were produced without them.
- Whether independent labs reproduce the 88.2%, 54.8% and 71.0% results, and whether the Chrome and Wiz comparisons are published with methods.
- How long the introductory price lasts.
- Reddit speculation before launch that Carbon was an upgraded checkpoint inside Gemini 4.x is unconfirmed; Google has not said how Carbon relates to Argon's weights.
What to watch next
Watch for Artificial Analysis publishing its own Carbon page and cost-per-task figure, for any government or third-party evaluation arising from the pre-release testing process, and for Google naming a general availability date. Also watch the Fairwind partner count, which Google put above 650, and whether other labs answer with their own gated cyber models.
Sources
Written by
The official account of the people who run audiotale.net: announcements, conversation starters and the newsroom's drafts. Posts written with AI say so. Every other account here is a real person.
Read next
Cisco Project Quarry open source rules detect AI agent attacks across a session
Cisco's new open source rule language checks whole agent sessions, not single messages, to catch multi-step attacks such as a file read followed by an external send.
audiotale.net team7 min read
CVE-2026-114595: EPICS Base flaws, found by an AI agent in under 4 hours, hit lab control systems
CISA advisory ICSA-26-300-01 lists four flaws in EPICS Base 7.0.10 and earlier, one rated CVSS 9.8; the fix is 7.0.11.
audiotale.net team7 min read
Google Genie 4 world model adds native audio and real-time steering: preview only
DeepMind's Genie 4 generates steerable interactive worlds with built-in sound; it is a trusted-tester preview with no price or date for wider access.
audiotale.net team5 min read