Gemini 4 Carbon Goes to Vetted Cyber Defenders Before Anyone Else Can Call It

Google has a new strongest model, and most developers cannot use it yet. Google DeepMind announced Gemini 4 Carbon on October 28, 2026, calling it “our strongest model with state-of-the-art cybersecurity and long horizon capabilities.” It arrives two weeks after Gemini 4 Argon. Instead of a general API launch, Google is starting Carbon with “a subset of cyber defenders” this week and widening access in phases through its Fairwind Program.

The announcement was written by Koray Kavukcuoglu, Google DeepMind SVP and Google’s Chief AI Architect. Google says it is “actively engaged in the U.S. government’s voluntary process for pre-release model testing” and will keep refining guardrails before Carbon reaches developers, businesses and consumers “as soon as possible.” No date is given.

The scores Google is leading with

Every figure below comes from Google. Carbon ranks first on version 5.0 of the Artificial Analysis Intelligence Index, with a score of 59, according to the announcement. Google frames its security results around three stages of defensive work, evaluated “without guardrails”:

• Finding vulnerabilities: 88.2% on SEC-bench Pro.
• Validating them through exploitation: 54.8% on ExploitGym, which Google calls a new state of the art.
• Patching at the root cause: 71.0% on Collinear’s CWE-bench.

Google also cites internal numbers. It says Carbon has “more than 2x uplift in success rate for generating secure code” over Argon. It adds that the Chrome team reported Carbon performing “more than 10X better than another lab’s large frontier model” at producing high-quality patches, without naming that model. Wiz, which the post calls “our leading Cloud security platform,” reports Carbon leading its web penetration-testing benchmarks.

On general coding, Google says Carbon gained 89 Elo points to reach fourth place on WebDev Arena at 1768. It also says internal teams have watched Carbon “run for days” on multi-step engineering work such as root-causing and patching subtle bugs across large codebases and low-level systems.

Alignment claims attached to the launch

Much of the announcement covers behaviour rather than raw capability, again on Google’s own measurements:

• Successful cheating on Terminal-Bench 4.0 fell to 0.0%, with attempts to cheat at 0.4%.
• High-severity misalignment alerts in live internal coding environments dropped “by almost 80%.”
• Unsupported claims fell by “approximately 2x” compared with Argon.
• Overreach fell 26% and under-service 29% on multi-step plans.
• On Gray Swan’s Indirect Prompt Injection benchmark, the attack success rate went from Argon’s 0.7% to 0.0%.

Google says Carbon reuses Argon’s safety stack, which combines model training, real-time misuse defences, prompt-injection resilience and chain-of-thought monitoring. None of these results has been independently reproduced, and Google has not disclosed parameter count, context window or training details for Carbon.

Who gets in first

Fairwind is Google DeepMind’s controlled-access programme for defensive security. Its public page says it prioritises governments and national cyber authorities, critical infrastructure operators in areas such as healthcare, telecoms, energy and finance, and “core technology platforms.” Google says it works with more than 650 partners and runs background checks on applicants.

The terms are strict. Partners may only use the models for permitted dual-use tasks such as authorised threat simulation, reverse engineering and malware analysis for defensive or academic research. They must enforce user-level authentication and phishing-resistant MFA, limit access to internal security, incident-response or penetration-testing teams, and track employee use. Reselling or sharing access is not allowed. As of October 29 the Fairwind page still described the programme in terms of Argon and the CodeMender patching agent and had not been updated for Carbon.

Pricing, when it opens up

Google has published prices ahead of general availability. Carbon launches at the same introductory rate as Argon: $2 per million input tokens and $10 per million output tokens, with cached input 95% cheaper than standard input. Once the introductory period ends, the price rises to $4 per million input tokens and $20 per million output tokens. Google has not said how long the introductory window lasts.

Google’s stated reason for the staged release is to give defenders a head start with a model that is also strong at exploitation. For most teams, Carbon is a model to plan around, not one to call today. The checks will come when Google opens it to developers and independent evaluators can test the cyber and alignment numbers outside Google’s own harnesses.