Gemini 4 Carbon puts cyber defenders first in a restricted rollout

What Google announced

Google introduced Gemini 4 Carbon on October 28 [1]. Google calls it the company's strongest model and says internal teams have run it for days on difficult engineering tasks.

Google will start with a subset of cyber defenders, then add trusted partners through Fairwind while it tests safeguards.[1] Reuters also reported the restricted rollout, security focus and proposed introductory token prices.[2] Google has promised access for developers, businesses and consumers, but it has not given a date.[1]

The advertised introductory rates are $2 per million input tokens and $10 per million output tokens, with cached input priced at a 95% discount.[1] Google's announcement lists later rates of $4 per million input tokens and $20 per million output tokens, but it does not say when Carbon's introductory period ends or publish detailed billing rules for a public Carbon API.[1][6]

Read the three cyber scores separately

Google reports 88.2% on SEC-bench Pro for vulnerability discovery, 54.8% on ExploitGym for exploitation and 71.0% on CWE-bench for patching.[1] Google ran these external cyber evaluations without guardrails.[1] Product safeguards may change what approved users can reproduce.

Each score answers a different question. A suspected bug still needs validation, and a working exploit still needs a tested repair. Security teams should preserve that sequence instead of treating one aggregate score as proof that Carbon can run an end-to-end vulnerability program.

Artificial Analysis ranks Carbon first [7] on its v5.0 Intelligence Index with a score of 59. The index combines nine evaluations across knowledge work, coding, science and general knowledge, and the evaluator warns that task-specific results may matter more than the aggregate score.

VentureBeat's benchmark review [6] found a mixed picture beneath the headline. Carbon improved over Argon across Google's table, while GPT-6 Astra remained ahead on FrontierSWE 2 and Claude Opus 5.5 remained ahead on one OSWorld computer-use result.

What Google says about agent safety

Google says Carbon uses the safety stack developed for Argon: model training, real-time misuse defenses, prompt-injection resistance and reasoning monitors.[1] The company reports no successful cheating on its Terminal-Bench 4.0 test, a 0.4% attempt rate and no successful attack in the evaluated Gray Swan indirect prompt-injection set.[1] Those results cover defined tests and do not prove immunity in an unfamiliar repository or browsing session.

Google's Argon safety report [5] says the lab could not rule out Argon reaching its Cyber Uplift Level 1 critical capability threshold without mitigations. Google therefore added input and output screening, activation probes, reasoning monitors, account controls and trusted access.

Google's safety overview [4] also explains that Argon solved all 12 simulated end-to-end cyberattack scenarios in the company's evaluation, compared with five for the previous generation. Carbon's announcement reports stronger cyber scores, but Google has not published a separate Carbon safety report that repeats the full risk assessment.[1][5]

A defensible evaluation plan

• Write down the authorized repositories, systems, test accounts and network ranges before requesting access. Exclude customer and production targets unless the owner has approved the exact test.
• Build three task sets: known vulnerable code for discovery, isolated challenge systems for exploit validation and repositories with regression tests for patching. Score each stage independently.
• Run Argon or the current approved tool on the same tasks. Compare true findings, false positives, exploit validity, patch acceptance, elapsed time, token use and reviewer hours.
• Keep exploit validation inside an isolated environment with no production credentials, unrestricted internet access or route to unrelated systems.
• Require a human reviewer to confirm the vulnerability, inspect every command and approve each patch before merge. Run security tests and the existing regression suite after every accepted change.
• Seed repositories and documents with benign prompt-injection canaries. Confirm that the agent ignores them, reports them and does not expose secrets or change scope.
• Record refusals and blocked actions as part of utility testing. Google's unguarded benchmark scores may differ from the behavior available through Fairwind or a later public product.[1]
• Set a stop rule for unexpected egress, privilege changes, scope expansion, fabricated evidence or attempts to alter evaluation infrastructure. Preserve logs for review.

Fairwind changes the operating conditions

The Fairwind program page [3] says participating organizations must use user-level authentication, phishing-resistant multi-factor authentication and applicable access controls. They must restrict access to internal security, incident-response or penetration-testing teams and track employee use.

Fairwind can give verified defenders access to cyber capabilities that standard Gemini access restricts.[3][5] That difference means a result from an approved defensive environment may not describe the later consumer or standard API product.

Teams should ask Google which Carbon model snapshot they receive, which safeguards apply, where data and logs are stored, how access can be revoked and what evidence remains available after an incident. The public Fairwind page still describes Argon in detail, so Carbon-specific contract and product terms need direct confirmation.[3]

What remains uncertain

• Google has not published a Carbon model card, full safety report, API model ID, context limit, supported modalities or public release date.[1][6]
• Google says its Chrome team produced high-quality patches at more than ten times the rate of an unnamed competing model. The release materials do not identify that model or provide the underlying results for independent review.[1]
• The cyber benchmark scores were measured without guardrails, so approved and public deployments may produce different results.[1]
• Artificial Analysis reports no public API and does not publish Carbon's production cost per completed security task.[7]
• A 0.0% attack-success result means the evaluated prompt-injection attacks failed. New attack paths, tools and environments still require testing.[1]
• Google says internal teams ran Carbon for days, but it has not published completion rates, intervention counts, resource use or incident data for those runs.[1]

Frequently asked questions

• Can developers use Gemini 4 Carbon now? Most cannot. Google says selected cyber defenders receive initial access through Fairwind, with broader access coming later.[1][3]
• Is Carbon a replacement for Argon today? Google has announced stronger results, but Argon remains the documented public model while Carbon lacks a public API specification.[1][6]
• Does Carbon find and fix every vulnerability? No. Google's three published cyber scores all remain below 100%, and each covers a defined evaluation.[1]
• Are the security scores independently verified? Artificial Analysis independently reports the broad index result. Google reports the three cyber scores and says it ran them without guardrails.[1][7]
• What should a security team test first? Start with known vulnerable code in an isolated environment, then measure valid findings, false positives, working patches and human review time.
• Does the 0.0% prompt-injection result remove the need for sandboxing? No. It describes one evaluated attack set, while real repositories and tools can expose different instructions and permissions.[1]