Google announced Gemini 4 Carbon on Wednesday, its second frontier model in two weeks and the first it has framed explicitly as a cyber-defence tool rather than a general assistant. The company says Carbon ranks first on the updated v5.0 Artificial Analysis Intelligence Index at 59, and claims leading scores across the three stages of the vulnerability lifecycle: 88.2% on SEC-bench Pro for finding real flaws in real software, 54.8% on ExploitGym for confirming which of them are actually exploitable, and 71.0% on Collinear's CWE-bench for turning a confirmed finding into a working patch.
The release lands two weeks after Gemini 4 Argon, and Google is presenting the interval itself as the message. "Carbon illustrates the pace at which we're pushing the frontier forward," wrote Koray Kavukcuoglu in the announcement, adding that researchers and models are now "working hand in hand." On coding, the company reports a jump of 89 Elo points to 1769 on WebDev Arena, good for fourth place, and says internal teams have watched Carbon run for days on end while root-causing bugs across large codebases and low-level systems.
The rollout is the unusual part. Carbon is not going to developers, businesses or consumers yet. "Starting this week, we will make Carbon available to a subset of cyber defenders," the post says, with wider access phased through Google's existing Fairwind trusted-partner programme. Google also says it is taking part in the US government's voluntary pre-release testing process — a step that has become a de facto requirement for any lab shipping security-capable models into critical infrastructure.
Pricing is the same introductory rate as Argon: $2 per million input tokens and $10 per million output tokens, with cached input at 95% off the input price. That is a deliberate signal. If a router or an agent framework can choose between labs on cost, Google wants its newest model to be the cheap option, not the premium one.
The safety numbers are as interesting as the capability numbers, because Google chose to publish them. On Terminal-Bench 4.0, successful cheating fell to 0.0% with attempts down to 0.4%, while accuracy improved. In live internal coding environments, high-severity misalignment alerts dropped by almost 80%. Unsupported claims roughly halved against Argon. Overreach fell 26% and under-service 29% — the pair that decides whether a multi-step task gets finished or quietly abandoned. On Gray Swan's indirect prompt-injection benchmark, Carbon reports a 0.0% attack success rate, against Argon's already low 0.7%. The Chrome team says Carbon produced "more than 10X" better patches than another lab's large frontier model on internal comparisons, and Wiz reports it leading on web penetration-testing benchmarks.
Every one of those figures is vendor-reported. Google labels the external security benchmarks as evaluated without guardrails, which is the honest way to state a capability score but also the number that matters least in production, where guardrails are the point. None of it has been independently reproduced yet, and the Artificial Analysis index — third-party, but fed largely by vendor-run evaluations — is a ranking, not an audit.
The deeper tension is structural. A model that autonomously finds 88.2% of the flaws in real-world software is, by construction, a model that can be pointed at software its operator does not own. Google's answer is not to reduce the capability but to gate the access: a small cohort of defenders first, a trusted-partner programme second, everyone else later. That works only as long as the gate holds, and gates in this market have historically held for months, not years.
What to watch next: whether Carbon reaches general availability at the Argon price, whether independent researchers reproduce the SEC-bench and ExploitGym figures, and whether the Fairwind cohort publishes anything about what the model found in their own estates. The last one is the only real test of whether a benchmark lead translates into fewer breached systems.
