Gemini 4 Carbon is Google’s new frontier model, launching first with selected cybersecurity defenders after its October 28 announcement. Google says Carbon improves vulnerability discovery, exploitation testing and software patching, but the company has not opened it broadly to developers, businesses or consumers.

The controlled launch establishes four concrete facts:

• Access begins with a subset of cyber defenders.
• SEC-bench Pro performance is reported at 88.2%.
• Introductory pricing starts at $2 per million input tokens.
• No general-availability date has been announced.

Gemini 4 Carbon Starts With Fairwind Access

Google’s official announcement describes Carbon as its strongest model for cybersecurity and long-horizon work. The company is making it available this week to a subset of cyber defenders, followed by additional trusted partners through the Fairwind Program.

The rollout is also participating in the U.S. government’s voluntary process for pre-release model testing. That makes the October launch a controlled evaluation rather than a public product release. Google says developers, businesses and consumers will receive access later, after feedback and further guardrail work.

Carbon follows Gemini 4 Argon, which Google introduced in September and expanded more broadly in October. The new model is a separate release with new benchmark results and a stronger emphasis on sustained engineering and cyber-defense tasks, not a renamed Argon update.

Reuters independently reported the model’s October 28 launch, initial Fairwind access and introductory price. The reporting also places Carbon in Google’s competition with OpenAI and Anthropic for demanding coding and security workloads.

Carbon’s Cybersecurity Scores Cover Three Stages

Google reports that Carbon scored 88.2% on SEC-bench Pro for finding vulnerabilities in real software. It also lists 54.8% on ExploitGym, which tests whether a model can validate flaws through exploitation, and 71.0% on CWE-bench for producing code patches that address root causes.

Those three evaluations cover distinct parts of defensive security: discovery, risk validation and remediation. A model can be strong at locating suspicious code while still struggling to prove exploitability or produce a safe fix. The separate scores are therefore more informative than one combined cyber label.

Google says the external cyber benchmarks were evaluated without guardrails. That condition helps measure underlying capability, but it does not describe the restrictions, monitoring or tool permissions that users will encounter in a deployed service. Production results will also depend on repositories, test harnesses and human review.

The company additionally reports more than twice Argon’s secure-code success rate on internal tests. Google’s Chrome team says Carbon produced high-quality patches at more than ten times the rate of another lab’s frontier model, although Google did not identify that rival or publish a complete independent protocol for the comparison.

Independent evaluator Artificial Analysis places Carbon first on its Intelligence Index v5.0 with a score of 59. Its testing also shows tradeoffs: Carbon is not the leader on every coding or professional-work measure, so the composite score should not be treated as universal superiority.

Long-Horizon Engineering Drives Carbon’s Positioning

Google built Carbon for sustained agentic workflows that can continue through unsuccessful approaches while diagnosing and fixing difficult problems. The company says internal teams have run the model for days on multi-step engineering assignments across large codebases and low-level systems.

That positioning targets work where a model must inspect evidence, use tools, revise a plan and verify changes rather than produce a single response. It could be useful for software migrations, debugging and security remediation, but long duration also increases token use, tool costs and the consequences of an incorrect action.

Carbon’s introductory price matches Argon at $2 per million input tokens and $10 per million output tokens. Cached input is discounted by 95%. Google says standard prices will later rise to $4 and $20 respectively, but it has not published an end date for Carbon’s introductory period.

Matching unit prices do not establish a lower cost for completed work. Agentic jobs can consume tokens through planning, retries, tool instructions and verification. Businesses will need measurements of successful task completion, latency and reviewer effort before comparing Carbon’s economics with other models.

Google Reports Stronger Alignment and Injection Resistance

Google says Carbon combines model training with real-time misuse defenses, prompt-injection resistance and monitoring of reasoning and actions. On Terminal-Bench 4.0, the company reports a 0.0% successful cheating rate and a 0.4% attempt rate, while internal high-severity misalignment alerts fell by almost 80%.

The company also says unsupported claims were cut by about half compared with Argon. Its internal evaluations recorded a 26% reduction in overreach and a 29% reduction in under-service, metrics intended to capture whether the model completes requested work without acting beyond the user’s scope.

On Gray Swan’s indirect prompt-injection benchmark, Google reports a 0.0% attack success rate for Carbon, compared with 0.7% for Argon. A perfect result on one evaluation does not prove immunity to prompt injection, particularly when agents encounter new websites, documents, tools and adversarial instructions in production.

The most important next evidence will come from Fairwind users: confirmed vulnerabilities, patch quality, false positives, misuse incidents and the burden of human validation. Until Google opens a public endpoint and publishes fuller technical documentation, Carbon remains a significant but restricted frontier-model launch.

Related Coverage

• Google Unveils Gemini 4 Argon With 1M-Token Output Limit
• Anthropic Cyber Verification Program Expands Access for Security Teams