Gemini 4 Carbon is a Google model that almost nobody can use yet. Google announced it on 2026-10-28 as a frontier model "designed for sustained engineering work and cybersecurity", and began access with a subset of cyber defenders.[1] This Model Watch reads Google's announcement and the primary pages for the three security benchmarks it leans on, and explains what each score does and does not tell you.
We did not run the model, and nobody outside the early-access group can check most of the claims. Everything below was read on 2026-10-29. Where we interpret, we say so.
Quick answer
- What was announced: Gemini 4 Carbon, described by Google as its strongest model, building on Gemini 4 Argon from about two weeks earlier.[1]
- Who can use it: a subset of cyber defenders now; more trusted partners gradually through the Fairwind Program. Not developers, businesses or consumers yet.[1]
- Price as stated: $2 input and $10 output per million tokens at introduction, $4 and $20 afterwards; cached input is 95% cheaper.[1]
- How to read the numbers: most come from Google or its partners. Three of the headline benchmarks test different security tasks and are not interchangeable.
What Google documented
According to the announcement, Carbon is aimed at long-horizon engineering and security work. Google says it is taking part in the voluntary U.S. government pre-release testing process, and that it is still gathering feedback and refining guardrails before launching to developers, businesses and consumers "as soon as possible".[1]
Google also says Carbon uses the same layered safety stack as Argon: model training, real-time misuse defences, prompt-injection resilience and chain-of-thought monitoring. It reports, from internal testing, that high-severity misalignment alerts in live internal coding environments dropped by almost 80%, and that unsupported claims were cut by about half compared with Argon.[1] These are Google's internal results; the announcement does not offer a way to reproduce them.
On pricing, the announcement lists the same introductory rates as Argon and a higher standard rate afterwards. The text we read does not say when the introductory period ends. Because the model is not generally available, you cannot budget on these figures yet; treat them as a signal that Google intends to price Carbon like Argon.[1]
The benchmarks Google cites
| Benchmark | What it scores | Google's figure | Who produced it |
|---|---|---|---|
| SEC-bench Pro | Reproducing a working proof-of-concept input for a disclosed bug | 88.2% | Google-reported[1] |
| ExploitGym | Turning a bug-triggering input into a working exploit | 54.8% | Google-reported[1] |
| CWE-bench (Collinear) | Fixing a target weakness in a real open-source repository | 71.0% | Google-reported; also listed on the benchmark's site[1][4] |
| Artificial Analysis Intelligence Index v5.0 | Weighted average over 9 evaluations | 59 (ranked #1) | Google-reported[1][5] |
| Gray Swan indirect prompt injection | Attack success rate | 0.0% (Argon 0.7%) | Google-reported[1] |
Google reports each of these in a single announcement, and partner statements in it (for example from the Chrome team and Wiz) are labelled by Google as not independently verified.[1]
SEC-bench Pro: finding the trigger
SEC-bench Pro has 344 validated vulnerabilities across the V8 and SpiderMonkey JavaScript engines and the Linux kernel. Each task pairs a disclosed bug with instructions, and the model must reproduce a working proof-of-concept input.[2] The authors also argue that rule-based graders are unreliable for this and propose an LLM-based judge, reporting that the choice of grading method changes the results.[2]
That last point matters for reading Google's 88.2%. In the paper (revised 2026-07-20), the best result among the models and agents tested was 58%, from Codex with GPT-5.5.[2] The two numbers are not comparable: different models, a different date, and we do not know which harness or judge Google used. Our interpretation is that a very large jump is plausible but unverifiable until an independent run is published.
ExploitGym: going further than the trigger
ExploitGym has 898 instances across userspace programs, V8 and the Linux kernel. The agent is given an input that triggers a vulnerability and must extend it into a working exploit; protections are varied per instance to measure their effect.[3] The paper's strongest configurations produced working exploits for 157 instances (Claude Mythos Preview) and 120 (GPT-5.5) of 898.[3]
Two cautions. First, 157 of 898 is about 17.5% by our arithmetic, so Google's 54.8% cannot be set beside it without knowing which subset, protections and settings Google used; the announcement summary we read does not say. Second, this is a dual-use task: the same skill that lets a defender confirm a bug is exploitable lowers the barrier for an attacker, as the authors themselves note.[3]
CWE-bench: fixing the weakness
CWE-bench is defensive. Per its site, it uses 120 held-out tasks over 73 weakness types; a fix passes only if a proof-of-concept exploit stops working and existing tests still pass, with no partial credit.[4] The leaderboard lists Gemini 4 Carbon at 71% pass@1, which matches Google's figure. The site lists its own limits: five tasks unsolved by every model, only 10 to 14 tasks per OWASP category and three Rust tasks in total. It says Collinear built the benchmark and Artificial Analysis evaluated the results, while a separate FAQ line says Collinear runs submitted models, so who ran Carbon is not fully clear from the page.[4]
The Intelligence Index: a composite
Artificial Analysis lists v5.0 as nine evaluations in four categories, each weighted 25%: knowledge work, coding, science and general. Only some of the evaluations are cyber-related, and several are private sets.[5] Google notes the index was recently updated to v5.0, so the 59 should not be compared with scores from earlier versions.[1][5]
A decision guide
| If you are... | Then |
|---|---|
| A security team in the early-access group | Run your own tasks on your own code first; compare against your current model with the same harness and grading |
| A developer waiting for the API | Do nothing yet. There is no model ID, rate or limit to code against. Re-read the pricing and model pages when it ships |
| Choosing a model for general work today | Use the generally available models. Carbon's published numbers are mostly cyber-specific |
| Writing or citing a comparison | Name the benchmark, who ran it and the date, and avoid "best at security" without those |
For the general method, see How to Read an AI Benchmark Claim Without Being Misled. For how the labs describe their safeguards, see Frontier AI Safety Frameworks Compared.
What remains uncertain
- Independent results. The CWE-bench match is the only independent-looking figure we found, and its run arrangement is unclear.
- Settings behind each score. Harness, reasoning level, number of attempts and judge are not given in what we read.
- The introductory price end date.
- General capabilities. Google's own framing is engineering and cybersecurity; the announcement does not make a broad claim we can check for everyday work.
Frequently asked questions
What is Gemini 4 Carbon? Google describes it as a frontier model designed for sustained engineering work and cybersecurity, building on Gemini 4 Argon.[1]
Can I use it today? Only if you are among the selected cyber defenders; wider access is planned through the Fairwind Program.[1]
How much does it cost? Google states $2 and $10 per million input and output tokens at introduction, rising to $4 and $20, with cached input 95% cheaper.[1]
Does a high SEC-bench Pro score mean it is good at all security work? No. That benchmark scores reproducing a bug trigger, not patching, triage or exploitation.[2]
