Google unveils Gemini 4 Carbon, starting with cyber defenders

Google has announced Gemini 4 Carbon, described in its blog post as "our strongest model with state-of-the-art cybersecurity and long horizon capabilities". It arrives two weeks after Gemini 4 Argon, which Google says shows the pace at which it is pushing the frontier.

Google says Carbon ranks #1 on the recently updated v5.0 of the Artificial Analysis Intelligence Index, at a score of 59. It reports significant gains in coding and agentic tasks and in capabilities critical to cybersecurity defense. On external cybersecurity benchmarks, evaluated without guardrails, Carbon scores 88.2% on SEC-bench Pro (finding vulnerabilities), 54.8% on ExploitGym (exploitation) and 71.0% on Collinear's CWE-bench (patching). Google calls the first two state-of-the-art results and says the model lands a firm lead on the three. On internal benchmarks, Carbon shows more than 2x uplift in success rate for generating secure code over Argon. Google also says the Chrome team reported that Carbon performed more than 10X better than another lab's large frontier model at generating high quality patches, and that Wiz, which the post calls "our leading Cloud security platform", sees Carbon leading on web penetration testing benchmarks.

On long-horizon work, Google says Carbon is built for sustained agentic workflows. Internally, its teams have seen the model run for days, persisting through dead ends on complex, multi-step engineering tasks such as root-causing and patching subtle bugs across large codebases and low-level systems. On web development, Carbon gains 89 Elo points to reach #4 (1768) on WebDev Arena. Google also cites improvements in scientific tasks and multimodal understanding.

The post devotes a long section to safety and alignment. Carbon builds on the same multi-layered safety and security stack as Argon: model training, real-time misuse defenses, prompt-injection resilience and chain-of-thought monitoring. The reported results: successful cheating on Terminal-Bench 4.0 fell to 0.0%, with attempts to cheat at 0.4%, while overall accuracy improved; in live coding environments with Google's internal teams, high-severity misalignment alerts dropped by almost 80%; in internal testing, unsupported claims are cut by approximately 2x over Argon; overreach fell 26% and under-service 29%; and on Gray Swan's Indirect Prompt Injection benchmark, Carbon's attack success rate is 0.0%, against 0.7% for Argon. Google also says that when a task is ambiguous, Carbon retrieves relevant sources and surfaces discrepancies to the user before acting, and that users "should" see a much better collaborative experience.

The rollout is staged. Google says it is taking a deliberate approach and is engaged in the U.S. government's voluntary process for pre-release model testing. Starting this week, Carbon goes to a subset of cyber defenders, with access phased gradually to additional trusted partners through the Fairwind Program. Google will keep gathering feedback and iterating on guardrails before making Carbon available to developers, businesses and consumers through its product surfaces "as soon as possible". No date is given.

Carbon will launch at the same introductory price as Argon: $2 per million input tokens and $10 per million output tokens, with cached input tokens priced at 95% off the input token price.

Key facts

Google calls Gemini 4 Carbon its strongest model, built for cybersecurity and long-horizon engineering; it follows Gemini 4 Argon by two weeks.
Carbon ranks #1 on v5.0 of the Artificial Analysis Intelligence Index with a score of 59, and scores 88.2% on SEC-bench Pro, 54.8% on ExploitGym and 71.0% on CWE-bench (evaluated without guardrails).
Access starts this week for a subset of cyber defenders and phases to more trusted partners through the Fairwind Program; developers, businesses and consumers get it "as soon as possible", with no date.
Introductory price: $2 per million input tokens and $10 per million output tokens, the same as Argon, with cached input tokens 95% off the input price.
Google reports alignment gains: 0.0% successful cheating on Terminal-Bench 4.0, almost 80% fewer high-severity misalignment alerts internally, and 0.0% attack success on Gray Swan's prompt-injection benchmark (Argon: 0.7%).

Why it matters

Google presents Carbon as a second frontier release in two weeks, and the first one it pitches mainly at cyber defense. The headline claims are a #1 rank on the Artificial Analysis Intelligence Index v5.0 (score 59) and leading results across the defense lifecycle Google describes: finding vulnerabilities, validating exploitability and patching. The post also frames the launch as an attempt to deliver leaps in software engineering and cybersecurity defense "without compromising on safety or reliability", and it leans heavily on alignment metrics rather than capability numbers alone.

Who it affects

First in line are the cyber defenders chosen for initial access, then additional trusted partners in the Fairwind Program. Developers, businesses and consumers are told to expect Carbon "soon" through Google's product surfaces. The post names the Chrome team, which reported its patch-quality comparison, and Wiz, which sees Carbon leading on web penetration testing benchmarks, as early observers. Teams doing long-running agentic coding work are the other group the model is aimed at.

How to use it

For now there is no general access: Carbon is going to a subset of cyber defenders this week and access will be phased in to more trusted partners through the Fairwind Program. Everyone else waits for Google to finish gathering feedback and iterating on guardrails. When it launches, the stated introductory price is $2 per million input tokens and $10 per million output tokens, the same as Argon, with cached input tokens at 95% off the input token price.

How solid is it

This is a first-party announcement from Google. The external benchmark figures (Artificial Analysis Intelligence Index, SEC-bench Pro, ExploitGym, CWE-bench, WebDev Arena, Gray Swan's prompt-injection benchmark) come from named third-party benchmarks, but the post reports the numbers itself. The cybersecurity results were evaluated without guardrails. Other claims rest on internal benchmarks or internal testing: the 2x secure-code uplift over Argon, the almost 80% drop in misalignment alerts, the roughly 2x cut in unsupported claims and the 26% and 29% reductions in overreach and under-service. The source gives no independent third-party verification of the internal benchmark claims, apart from the named external benchmarks.

Risks and caveats

Access is deliberately limited, and the source gives no calendar date for wider availability beyond "as soon as possible" and "soon". The price is called introductory, and the source text does not say how long it lasts or what the later price is. The Chrome team's 10X comparison is against an unnamed "another lab's large frontier model". The post does not specify the results of the U.S. government pre-release testing it mentions, and it does not state Carbon's context window, parameter count or architecture. The line that users "should" observe a much better collaborative experience is an expectation, not a measured result. Because the benchmark results were evaluated without guardrails, they describe the model's raw capability, not necessarily what the guarded product will do.

“We're taking a deliberate approach to rollout and are actively engaged in the U.S. government’s voluntary process for pre-release model testing.”

— Google, Gemini 4 Carbon announcement