Google introduced Gemini 4 Carbon on Oct. 28, calling it “our strongest model with state-of-the-art cybersecurity and long horizon capabilities.” For now, only a group of vetted cyber defenders can use it.
Koray Kavukcuoglu, a senior vice president at Google DeepMind and Google’s chief AI architect, announced the model in a company blog post. He wrote that Google is taking “a deliberate approach to rollout” and is taking part in the U.S. government’s voluntary process for testing models before release.
Access starts this week with “a subset of cyber defenders,” Google says, and will widen gradually to other trusted partners through its Fairwind Program. Google’s page for the program says it gives priority to governments, critical-infrastructure operators and core technology platforms, with restricted access for defensive security teams.
Google says it will open Carbon to developers, businesses and consumers “as soon as possible” but hasn’t given a date. Ars Technica summed up the situation in its headline, calling Carbon a frontier AI model “that you can’t use.”
What Google says it can do
Carbon arrives two weeks after Gemini 4 Argon, which Google released to everyone on Oct. 13. Google says the new model ranks first on version 5.0 of the Artificial Analysis Intelligence Index, with a score of 59.
Most of the pitch is about security work.
Google reports 88.2% on SEC-bench Pro, a test of finding real software vulnerabilities, and 54.8% on ExploitGym, which checks whether a model can show a flaw is exploitable. It reports 71.0% on CWE-bench, a patching test. Google says those scores were measured without its guardrails turned on.
The company also cited internal results. It says Carbon produces secure code at more than twice Argon’s success rate, and that Google’s Chrome team found it “more than 10X better than another lab’s large frontier model” at writing high-quality patches. Google didn’t name the other lab.
Ars Technica raised a caution about the gap. It noted that Carbon beats Argon “by slim margins in every test” and that every frontier model scores “in the same neighborhood,” with only a few points separating them. The outlet also said that, for all anyone outside Google knows, Carbon could be a post-training upgrade of Argon.
Google pitches Carbon for long, multi-step jobs. Kavukcuoglu wrote that internal teams have seen it “run for days” to track down and fix subtle bugs in large codebases.
On safety, Google says Carbon cut successful cheating on the Terminal-Bench 4.0 coding test to 0.0% and resisted every attack in Gray Swan’s indirect prompt injection benchmark. Prompt injection is when hidden instructions in a web page or file trick a model into doing something the user didn’t ask for. Ars Technica reported that Argon’s rate on that test was 0.7%, compared with 1% for Claude Opus 5.5 and 8.5% for GPT-6 Astra.
Google also says Carbon makes about half as many unsupported claims as Argon in internal testing. None of the safety figures have been checked independently.
What it will cost
When it opens up, Carbon will launch at Argon’s introductory price of $2 per million input tokens and $10 per million output tokens, Google says. Tokens are the small chunks of text that models read and write. The price rises to $4 and $20 after the introductory period.
Argon’s discount ends Nov. 30. Ars Technica reported that Google declined to give an end date for Carbon’s discount when asked.
Source: Google Blog, Koray Kavukcuoglu, “Introducing Gemini 4 Carbon”
Additional sources: Ars Technica, “Google announces Gemini 4 Carbon, its latest frontier AI model that you can't use”; Google DeepMind, “Fairwind Program”
