Gemini 4 Carbon Is Built for Cybersecurity - but Most Developers Can’t Use It Yet

Google’s Gemini 4 Carbon is being introduced as a cybersecurity-focused AI model with strong reported results across vulnerability discovery, exploit validation, and patching. Announced on October 28, 2026, Carbon follows Gemini 4 Argon and is designed for demanding coding and long-running engineering tasks. Google reports an 88.2% score on SEC-bench Pro, 54.8% on ExploitGym, and 71.0% on CWE-bench. Yet there is a major limitation: most developers cannot use Gemini 4 Carbon yet. Google is starting with a subset of cyber defenders and plans to expand access to trusted partners before broader availability. It has not announced a firm public release date.

What Is Gemini 4 Carbon?

Gemini 4 Carbon is Google’s newly announced frontier AI model focused on cybersecurity and complex software engineering. Google says it builds on Gemini 4 Argon, which launched roughly two weeks earlier, with improvements in coding, agentic tasks, and security-related work. The company describes Carbon as capable of tackling multi-step engineering tasks that may require sustained work, such as investigating subtle bugs in large codebases and helping produce patches.

The cybersecurity emphasis is important because vulnerability handling is more than identifying suspicious code. A useful workflow may involve finding a potential weakness, checking whether it can be exploited, understanding its severity, and producing a fix that does not introduce new problems. Google is presenting Carbon as a model that can assist across several of these stages.

That does not mean the model can safely replace a security engineer. Benchmark scores are snapshots of performance under specific evaluation conditions. Real software includes dependencies, business logic, configuration choices, and operational constraints that a benchmark may not fully represent.

For context on the model that came before Carbon, see Saganote’s Gemini 4 Argon guide to finding, validating, and patching security vulnerabilities. The Gemini 4 Argon coding benchmarks and access guide covers Argon’s coding claims and availability context.

Gemini 4 Carbon’s Cybersecurity Benchmarks

Google highlighted three benchmark results covering different stages of vulnerability work. The company reports that Carbon scored 88.2% on SEC-bench Pro, 54.8% on ExploitGym, and 71.0% on CWE-bench. Google describes these as results for vulnerability discovery, exploitation, and patching, respectively.

SEC-bench Pro: 88.2% for finding vulnerabilities

The first step in many security investigations is to locate a real flaw in a large and often unfamiliar codebase. Google says Carbon achieved 88.2% on SEC-bench Pro and characterizes the result as state-of-the-art performance for finding complex vulnerabilities in real-world software.

For developers, the useful question is not simply whether a model can flag suspicious code. It is whether the finding is valid, reproducible, and relevant to the application’s actual threat model. Teams should track false positives as well as missed vulnerabilities and should not treat a high benchmark score as proof that a repository is secure.

ExploitGym: 54.8% for exploitation tasks

A vulnerability’s practical risk can depend on whether an attacker can exploit it under realistic conditions. Google reports a 54.8% score on ExploitGym, which it uses to evaluate exploitation-related capabilities.

This kind of evaluation can help security teams understand whether a finding deserves urgent attention, but exploit validation must remain authorized and controlled. A benchmark result does not establish that a vulnerability is exploitable in every deployment, nor does it replace a scoped test in an isolated environment.

CWE-bench: 71.0% for patching

Finding a vulnerability is only part of the job. A patch must address the underlying cause without breaking expected behavior or creating a new security issue. Google reports a 71.0% score for Carbon on CWE-bench, focused on patching weaknesses.

Even a plausible patch needs human review and automated testing. Developers should verify the original failure, review the diff, run regression and security tests, and confirm that the fix fits the application’s architecture. Treat model-generated code as a proposed change-not a production-ready fix by default.

What Google Says Carbon Improves Over Gemini 4 Argon

Google presents Carbon as an advancement over Gemini 4 Argon, with a particular focus on secure coding and multi-step engineering work. The company also reports gains on internal coding and reliability evaluations.

• Secure-code generation: Google reports more than a 2× uplift over Argon in success rate on its internal benchmarks.
• Long-running tasks: Google says Carbon has been used on complex engineering tasks that can run for days, including finding subtle bugs and patching large codebases.
• Web development: Google reports an 89-point Elo increase on WebDev Arena and places Carbon at No. 4 in its announcement.
• Indirect prompt injection: Google reports a 0.0% attack-success rate on Gray Swan’s Indirect Prompt Injection benchmark, compared with 0.7% for Argon.
• Unsupported claims: Google says Carbon makes approximately half as many unsupported claims as Argon in its internal testing.

These are claims from Google’s announcement, not independent proof of universal superiority. Performance can vary with task design, tool access, model settings, safety controls, and the software being tested. Teams should compare Carbon with alternatives on their own representative tasks when access becomes available.

For a more detailed look at the predecessor, read Gemini 4 Argon for Coding: Benchmarks, 1M Token Output, and Access Status. For the security workflow Google has been emphasizing across this model line, see Gemini 4 Argon can find, validate, and patch security vulnerabilities.

Why Most Developers Can’t Use Gemini 4 Carbon Yet

The main limitation is availability. Google says Carbon’s initial rollout is restricted to a subset of cyber defenders. It plans to extend access gradually to additional trusted partners through the Fairwind Program, using feedback from those deployments to continue evaluating and improving safeguards.

Google has framed the staged rollout around the model’s cybersecurity capabilities. Tools that help defenders find and fix weaknesses can also create risks if used irresponsibly. Restricting access at the start gives Google and participating organizations a chance to test how the model behaves, refine protections, and learn from real security workflows before opening access more broadly.

Google says it is also participating in the U.S. government’s voluntary process for pre-release model testing. However, its announcement does not specify when general access will begin. As of October 29, 2026, the responsible summary is that Carbon has been announced, selected defenders are first in line, and a broad public release date remains unconfirmed.

What the staged rollout means

• Selected defenders first: Initial access is limited to a subset of cyber defenders rather than all developers.
• Trusted partners next: Google plans to expand access gradually through the Fairwind Program.
• Wider availability later: Google says developers, businesses, and consumers should get access through its product surfaces, but it has not published a firm date.
• Pricing does not prove access: Announced token rates do not necessarily mean the model is already available through a public API. Check the official documentation for actual model availability and account eligibility.

For developers choosing tools right now, avoid basing a project timeline on Carbon becoming available by a particular date. Evaluate models that can be accessed today, and revisit Carbon when Google publishes clearer availability details. Saganote’s free AI tools guide is a useful starting point for finding accessible options while the rollout remains limited.

Gemini 4 Carbon Pricing: What the Announcement Says

Google announced introductory rates of $2 per million input tokens and $10 per million output tokens. It says cached input tokens are discounted by 95% from the input rate. After the introductory period, the announced input rate rises to $4 per million tokens and output rises to $20 per million tokens.

Google has not specified in its announcement when the introductory period ends. Teams should therefore avoid assuming the initial rates will remain available for a fixed number of weeks or months.

Token rates are only one part of the cost. A long-running agent may read large amounts of source code, generate extensive output, repeat tasks, and call tools multiple times. The cost of a real workflow depends on the volume of input and output, how much input can be cached, and the number of iterations needed to finish the job. Estimate usage against a representative task before budgeting for a production deployment.

Before making a purchasing or architecture decision, check the official Gemini API pricing documentation and confirm that Carbon is listed as available for your account and region. Saganote’s AI API pricing guide provides broader context for comparing usage-based model costs.

How Security Teams Should Evaluate Gemini 4 Carbon

If your organization receives access, the strongest way to judge Carbon is to test it against a clear, authorized evaluation plan. Use cases should reflect your systems and threat model rather than relying on headline benchmark scores alone.

• Build a representative test set: Include known vulnerabilities, historical bugs, and realistic code-review tasks from systems you are authorized to assess.
• Measure false positives and misses: Record which findings are valid, which important issues are missed, and how much analyst time is needed to verify results.
• Keep exploit testing isolated: Use controlled test environments with explicit authorization and a defined scope.
• Review every patch: Require code-owner approval and run unit, integration, regression, and security tests before merging changes.
• Use least privilege: Limit repository permissions, credentials, network access, and tool capabilities to what the task requires.
• Keep an audit trail: Save findings, tool calls, code diffs, test output, and reviewer decisions so results can be reproduced.
• Test prompt-injection resilience: Check whether untrusted code comments, issue text, documents, or web content can redirect the model away from the task.
• Plan for failure: Define rollback procedures and a way to pause automation if the model behaves unexpectedly.

This checklist is general deployment guidance, not a claim that Carbon has been independently tested in your environment. Strong model performance and safe operational deployment are separate things that both need evidence.

What We Know-and What Remains Unclear

What Google has announced

• Gemini 4 Carbon follows Gemini 4 Argon and is focused on cybersecurity and demanding engineering tasks.
• Google reports 88.2% on SEC-bench Pro, 54.8% on ExploitGym, and 71.0% on CWE-bench.
• Initial access is restricted to selected cyber defenders, with a staged expansion to trusted partners planned.
• Introductory input and output token prices have been announced, along with higher rates after the introductory period.

What developers still need to know

• When broad developer access will actually open.
• When introductory pricing will end.
• Which API and product surfaces will support Carbon and what account or regional restrictions will apply.
• Whether independent evaluations will reproduce Google’s reported results across varied real-world workloads.

That is the central tension behind Gemini 4 Carbon: the early numbers make it a model to watch for security engineering, but restricted access prevents most developers from validating those claims themselves. Until access broadens, treat the benchmarks as a signal of potential-not a substitute for hands-on evaluation.