Google releases Gemini 4 Carbon with top cyber scores but limits access to vetted defenders

Google released Gemini 4 Carbon on October 28, 2026, casting it as a frontier model built for cybersecurity and long-horizon engineering work. The company says the model is its strongest to date, yet most people cannot use it. Access begins with a small group of cyber defenders rather than the general public, a decision that makes the launch as much a policy experiment as a product announcement.

The release lands 15 days after Gemini 4 Argon, which Google rolled out on October 13. Carbon is not a Flash-tier product but an upgrade on Argon, with gains that Google and independent evaluators describe as real but concentrated in specific areas. Ars Technica reported on October 28, 2026 that Google announced Carbon just two weeks after Argon and that the release is staged.

Cybersecurity benchmarks have become a preferred stage for labs because they produce clear, comparable numbers. SEC-bench Pro measures the discovery of real-world vulnerabilities, ExploitGym measures whether a model can turn a flaw into an exploit, and CWE-bench measures patching. Those tasks sit close to the work of security teams, and they also sit close to misuse. Google evaluated its security results without guardrails, then restricted access to vetted defenders.

The gatekeeper is the Fairwind Program, Google's channel for trusted partners. Google says it is also taking part in the U.S. government's voluntary pre-release testing process. Starting in the week of October 28, Carbon goes to a subset of cyber defenders, then to more trusted partners, and only later to developers, businesses and consumers. No broad release date has been given.

Key Facts

Google announced on October 28, 2026 that Carbon ranks first on the Artificial Analysis Intelligence Index v5.0 with a score of 59. Artificial Analysis reported on October 28, 2026 that the model leads four of the nine Index evaluations: HLE-Diamond, Terminal-Bench-Science, AA-Omniscience and AutomationBench-AA. It does not lead in coding or general knowledge work. On the Coding Agent Index, Carbon with the Antigravity CLI scores 59, three points behind Claude Code with Claude Opus 5.5 at 62. It ranks second on Terminal-Bench 4.0 at 64% and on FrontierCode v1.1 at 51%.

The security numbers are the centerpiece. Google reported SEC-bench Pro at 88.2%, ExploitGym at 54.8% and CWE-bench at 71.0%, all without guardrails. The company compares those results with Argon at 83.4% on SEC-bench Pro, 42.0% on ExploitGym and 68.0% on CWE-bench, and with GPT-6 Astra at 85.4% on SEC-bench Pro. The Verge reported on October 28, 2026 that Carbon holds the top spot on SEC-bench Pro and ExploitGym. Those two tests cover finding bugs and weaponizing them, while CWE-bench covers the repair step.

Google also points to gains that are easier for engineering teams to feel. It says Carbon delivers more than a 2x uplift in the success rate for generating secure code over Argon. The Chrome team reported that Carbon performed more than 10 times better than another lab's large frontier model when generating high-quality patches. Wiz, Google's cloud security platform, sees Carbon leading on web penetration testing benchmarks tied to its Scan for Good initiative. Carbon also gained 89 Elo points to reach fourth place at 1768 on WebDev Arena.

The model carries a 1 million token context window and accepts text, image, video and speech input with text output. Google says internal teams have seen it run for days through dead ends on multi-step engineering tasks. Google also cites safety. It says Carbon cut successful cheating on Terminal-Bench 4.0 to 0.0%, with attempts down to 0.4%, and that high-severity misalignment alerts in internal live coding environments dropped nearly 80%. Unsupported claims were halved versus Argon, overreach fell 26% and under-service fell 29%.

On Gray Swan's Indirect Prompt Injection Benchmark, Google reports 0.0% attack success for Carbon, versus 0.7% for Argon. Ars Technica reported on October 28, 2026 that Carbon resisted every attempted prompt injection in that evaluation, while Claude Opus 5.5 scored 1% and GPT-6 Astra scored 8.5%. Pricing matches Argon's introductory rate: $2 per million input tokens and $10 per million output tokens, with cached input at 95% off, rising to $4 and $20 after the introductory period. Artificial Analysis puts the standard price at $4 and $20 and estimates $7.76 per Intelligence Index task, about 23% less than Claude Opus 5.5 and about 1.2 times GPT-6 Astra.

Analysis

Google has reclaimed the top of a prominent leaderboard, but the lead is narrower than the headline suggests. Artificial Analysis reported on October 28, 2026 that Carbon wins four of nine evaluations and trails Claude Opus 5.5 on the Coding Agent Index. Ars Technica reported on October 28, 2026 that Carbon beats Argon by small margins on every test Google published and edges GPT-6 Astra, Claude Opus 5.5 and Claude Fable 5.1 on nearly all of them. What this really means is that the frontier has become a cluster, not a single peak. Small gaps can change the ranking without changing the practical gap in capability.

That distinction matters for buyers. Carbon's strongest claims are in security discovery, exploitation and patching, plus long-running agentic work. Its weaker relative position is in coding agents, where Claude Opus 5.5 remains ahead, and in knowledge work, where Artificial Analysis says it does not lead. A security team should separate the tasks it will run from the aggregate score. The 88.2% SEC-bench Pro result is impressive, but it measures a benchmark, not a production environment, and the absence of guardrails in evaluation makes the deployment setting more important, not less.

The release strategy is the real story. Google is not shipping Carbon to everyone on day one. It is using the Fairwind Program to sequence access and taking part in voluntary U.S. government testing. That posture reflects the dual-use nature of a system that can find and exploit vulnerabilities. The restricted rollout also gives selected defenders a head start with the model before the broader market. Ars Technica reported on October 28, 2026 that Google made no promises about a timeline for broad release, though Argon moved from restricted access to wider availability in about two weeks.

The pricing tells a similar story of careful positioning. At $7.76 per Intelligence Index task, Carbon is cheaper than Claude Opus 5.5 but more expensive than GPT-6 Astra, according to Artificial Analysis. The introductory API rate of $2 and $10 per million tokens is aggressive, but the standard rate doubles to $4 and $20 after the introductory period, with no announced end date. Carbon also uses 123,000 output tokens per task, 29% fewer than Opus 5.5 at 173,000. Efficiency and price are therefore part of the competitive case, not footnotes.

Why It Matters

For cybersecurity, a model that can find, exploit and patch vulnerabilities changes the economics of defense. Defenders who get access first can use it for discovery and patching, while everyone else waits. That asymmetry is the point of the Fairwind rollout, and it is also its risk. Google's decision to start with vetted defenders is a bet that controlled distribution is safer than a broad release, not evidence that the underlying capability is contained.

For the frontier model market, Carbon shows that leadership is now measured across a portfolio of benchmarks rather than one aggregate number. Google can claim first place on the Intelligence Index, first on SEC-bench Pro and ExploitGym, and fourth on WebDev Arena, while still trailing on coding agents. That complexity makes marketing easier and purchasing harder. Enterprise buyers will need to test on their own workloads, especially because the independent evaluator found no lead in coding and knowledge work despite the top rank.

For safety policy, the launch is a test of staged access. Carbon's 0.0% score on Gray Swan's indirect prompt injection benchmark and the drop in internal misalignment alerts are strong signals, but they are lab results from Google and its partners. The company's own numbers show why the claims need context: hallucination on AA-Omniscience rose from 4% for Argon to 11% for Carbon, even as accuracy improved. A model can be safer on some axes and less reliable on others. That is the case for outside evaluation, and for keeping the release narrow until the evidence catches up.

Next Up

Google says access will widen gradually through the Fairwind Program before reaching developers, businesses and consumers. The company has not set a date. Argon's two-week path from restricted access to wider availability is the closest precedent, but Google has not applied that precedent to Carbon. Ars Technica expects AI Ultra subscribers and Gemini API developers to be among the first broader audiences, though that is a projection, not a confirmed schedule.

The next signals to watch are independent retests of the security benchmarks, the end date for the introductory discount, and the first reports from Fairwind partners. Until then, Carbon's most important number may be the one it does not have: a public availability date. That gap is deliberate, and it defines the launch as much as the 59 score does.