Gemini 4 Carbon: Google's most powerful model goes to cyber defenders first

What's going on

On October 28, 2026, Google unveiled Gemini 4 Carbon, just two weeks after its predecessor, Gemini 4 Argon. In a blog post, Koray Kavukcuoglu, Google's chief AI architect and a senior vice president at Google DeepMind, describes it as:

“Our most capable model, with frontier performance in cybersecurity and long-horizon tasks.”

Carbon is meant to excel at two things in particular: hardening software against attacks, and working through large, tangled coding tasks over long stretches of time. The general public can't try it yet, though. Selected security professionals, so-called cyber defenders, get access first. Developers, businesses and consumers will have to wait. Google says it's taking part in the US government's voluntary testing program, which evaluates models before release. According to techgenyz, however, that doesn't amount to government approval or certification.

Also worth noting: according to CNET, Google also introduced Genie 4 the same week. It's a so-called world model that simulates physical environments, for robotics or game development, for example. What's new is that it also generates audio, such as background sounds and dialogue. Genie 4 has a waitlist.

What Carbon is supposed to do

The focus is on agentic workflows. Instead of just answering individual questions, the AI works through many steps on its own. Google says its internal teams have watched Carbon stick with complex engineering tasks for days, working past dead ends and trying new approaches along the way. Google's examples include tracking down the root causes of hidden bugs and fixing them in large codebases and low-level systems software. Low-level means software that other software builds on, where bugs have especially serious consequences. Quartz puts it this way: if you let a model work for days, you're no longer steering every step. You're mostly checking the result.

On security, Google splits defense into three phases: finding vulnerabilities, assessing how dangerous they are, and fixing them. For each phase, the company cites a benchmark, meaning a standardized performance test:

• SEC-bench Pro (finding): The model gets a bug description from a published report and has to build an input that actually triggers the bug, a so-called proof of concept.
• ExploitGym (assessing): According to Berkeley RDI, the test contains 898 real vulnerabilities from ordinary applications, Google's V8 JavaScript engine and the Linux kernel. The AI has to turn them into a full exploit, meaning a working attack that executes arbitrary code. Different security mitigations are enabled depending on the task.
• CWE-bench (fixing): This test comes from Collinear AI. A patch only counts if it closes the hole and the program still works normally afterward.

Google's internal tests also show Carbon writing secure code more than twice as often as Argon. Google doesn't give absolute numbers. According to the blog post, security firm Wiz, now part of Google, reports that Carbon leads on web penetration testing evaluations, meaning simulated attacks on web applications. Which tests those were, and by what margin, isn't stated. According to techgenyz, Google's Chrome team also reports that Carbon produces high-quality security patches more than ten times as often as an unnamed competing model.

The numbers at a glance

There's a caveat on the Argon figures. Quartz notes that Google's blog post gives neither an Argon score on the new index nor any competitor results. techgenyz lists the Argon numbers in its table but itself points out that they weren't demonstrably measured under the same conditions. Also important: Google says the three key security tests were run without guardrails. In real-world use, with safety filters switched on, results may look different.

The Artificial Analysis Index comes from an independent organization and rolls many task types into one overall score. That makes it the broadest indicator of general capability. According to CNET, Carbon also beats OpenAI's GPT-6 Astra there. WebDev Arena works differently: two models each build a web app from the same prompt, and users vote on which one is better. Lots of these head-to-heads produce an Elo rating, similar to chess. Carbon gains 89 points here but only lands in fourth place. Google doesn't say who's ahead of it.

Tech site Geeky Gadgets cites an analysis by YouTuber Paul Lipsky, according to which Carbon beats GPT-6 Astra, Claude Opus 5.5 and Claude Fable 5.1 in 16 of 18 test areas. That's not an independent measurement by the site itself.

More honest, less cheating, resistant to manipulation

Google devotes a lot of space to the model's behavior. On Terminal-Bench 4.0, the rate of successful cheating attempts dropped to 0.0%. Cheating here means the model games the test instead of actually solving the task. It still tried to in 0.4% of cases. At the same time, Google says accuracy went up. More of the company's claims from internal testing:

• In coding work with Google's own teams, there were almost 80% fewer severe misalignment flags. Misalignment means the model isn't acting in its users' interests.
• Carbon makes roughly half as many unsupported claims as Argon.
• Carbon is 26% less likely to do more than it was asked and 29% less likely to do less.
• When a task is blocked, the model doesn't make up evidence. Instead, it lists what it needs to keep going. With ambiguous requests, it gathers sources first and flags contradictions.

Carbon was reportedly fully immune to prompt injection: not a single attack succeeded in Google's tests (0.0%). In prompt injection, attackers hide instructions in text, web pages or files that the AI reads, tricking it into acting against its user's interests. For agents that spend days combing through other people's code and documents, that's a central risk. Quartz notes that a perfect score on Google's own tests says nothing about how the model handles attacks Google never tested.

Access and pricing

Google is rolling Carbon out in stages. Selected cyber defenders have had access since the week of the announcement. Next, more “trusted partners” are set to join through the Fairwind program. Only after that come developers, businesses and consumers, with no fixed date. CNET asked when the model will be generally available but didn't get an answer. With Argon, CNET and Geeky Gadgets say it took about one to two weeks to reach public release. There's a reason for the staged rollout: capabilities like finding and exploiting vulnerabilities can be used for defense and attack alike.

Tokens are the chunks of text a model breaks inputs and outputs into, roughly word fragments. The introductory price matches Argon's at launch. Cached inputs, meaning context that gets sent repeatedly, come with a 95% discount. Google doesn't say when the introductory pricing ends. If you're planning now, budget for the doubled price.

Our take

After a long pause, Google has picked up the pace again. According to CNET, Argon was the company's first new frontier model in eleven months, and now Carbon follows after just two weeks. In terms of focus, Google is clearly betting on cybersecurity and long-running agents. Those are exactly the areas where a model can be especially useful and especially dangerous at the same time. Giving defenders first access fits that dual nature.

The critical point remains: almost all the numbers come from Google itself. Key comparison figures are missing, competitors don't appear in Google's post, and the security tests ran without safety filters. The only independent measure is the Artificial Analysis Index, and Carbon really does lead there. In web development, though, it only manages fourth place. For most readers, Carbon is for now a model you can read about but not use. Whether the gains in honesty and manipulation resistance hold up outside Google's test environment will only become clear from independent testing after the broad release.