Gemini 4 Carbon: Google's Cybersecurity Model and What Its Benchmarks Actually Show

Google announced Gemini 4 Carbon on October 28, 2026, positioning it explicitly as a model for cyber defenders rather than a general purpose release. That framing shows up immediately in the rollout: instead of a simultaneous public launch, access starts with a limited set of cybersecurity defenders this week, then expands to trusted partners through Google's Fairwind Program, with a broader release to developers, businesses, and consumers planned for later and tied to further guardrail work. Google is also participating in a voluntary United States government pre release testing process for the model, the same pattern it used with Carbon's predecessor, Gemini 4 Argon, two weeks earlier.

Three benchmarks, three distinct capabilities

The headline 88.2 percent figure on SEC bench Pro measures something specific: finding real vulnerabilities in real software, which is the discovery half of the vulnerability management problem. That alone is not the hard part of enterprise security work. Finding a flaw and proving it actually matters are different skills, which is what ExploitGym, and similar exploit validation benchmarks like GLM 5.3's ExploitBench results, test, and Carbon's 54.8 percent there is described by Google as a new state of the art result for exploitation validation. The third leg, CWE bench, measures whether the model can generate a patch that fixes the root cause of a weakness rather than papering over a single symptom, where Carbon scores 71.0 percent. Read together, the three numbers describe a model that is strongest at discovery, meaningfully capable at validating what it finds, and solidly middle of the pack at the hardest step, which is writing a correct fix.

Google also reports internal results it has not had independently verified: more than double Argon's success rate at generating secure code by default, and a Chrome team comparison in which Carbon produced patches the team rated at more than ten times the quality of an unnamed competing frontier model on the same task. Wiz separately reported Carbon leading on its own web penetration testing benchmarks. None of these internal figures name specific competitor models, so treat them as directional claims from the vendor and the vendor's partners rather than independently reproduced results.

The safety numbers matter as much as the capability numbers

For a model explicitly marketed at security teams, Google leaned hard on reliability metrics that have nothing to do with raw capability. Cheating on Terminal Bench 4.0 fell to a 0.0 percent success rate, with cheating attempts themselves down to 0.4 percent. Resistance to indirect prompt injection, measured on the Gray Swan benchmark, hit a 0.0 percent attack success rate against 0.7 percent for Argon, though Google is careful to frame this as a benchmark result rather than proof the model cannot be manipulated at all. Unsupported claims in model outputs were roughly halved relative to Argon, overreach incidents fell 26 percent, under service incidents fell 29 percent, and high severity misalignment alerts in internal live coding environments dropped by almost 80 percent. For a buyer evaluating whether to let a model operate against production code with elevated trust, those operational numbers are arguably more decision relevant than the headline vulnerability detection score.

Pricing and who can actually use it today

Carbon's introductory pricing matches Argon's structure: 2 dollars per million input tokens and 10 dollars per million output tokens, with a 95 percent discount on cached input, rising to 4 dollars input and 20 dollars output per million tokens once the introductory period ends. The catch is access. As of this week, Carbon is available only to a limited set of cyber defenders, with expansion to trusted partners happening gradually through Fairwind rather than on a fixed public date. If your organization is not already engaged with Google on the security side, the realistic planning assumption is that general availability is a matter of quarters, not days, and your immediate options for AI assisted vulnerability detection remain the models and tools already on the market, including Gemini 4 Argon itself and the open source scanning tools built around other frontier models.

Google says Carbon is also designed for long horizon work, with internal teams reporting runs lasting multiple days on complex engineering problems such as tracing a bug to its root cause across a large codebase and then patching it. That duration claim has not been independently measured, but it is consistent with the broader industry move toward agentic sessions that persist and checkpoint over hours or days rather than completing in a single pass.

When this applies to your stack

If your organization is evaluating AI assisted code review or vulnerability scanning right now, Carbon's benchmark profile is worth tracking even though you cannot buy access yet. The specific skill breakdown, strong at discovery, improving at exploit validation, still middling at automated root cause patching, is a useful template for scoring any vendor's security model claims, including the one you can already access today. Contra Collective helps engineering teams build the evaluation harness and AI integration layer that turns a frontier model's benchmark sheet into an actual secure code review pipeline, whichever vendor ends up winning the access race.

FAQ

Can I use Gemini 4 Carbon today? Only if you are part of the initial limited group of cyber defenders Google selected, or you gain access later through the Fairwind Program. There is no public general availability date yet.

Does Carbon replace a human security review? Google's own benchmark pattern argues against that. The model is strongest at finding vulnerabilities and validating exploitability, and comparatively weaker at generating a fully correct root cause patch, which still benefits from human review.

How does Carbon's pricing compare to Gemini 4 Argon? The introductory rate is identical: 2 dollars per million input tokens and 10 dollars per million output tokens, rising to 4 and 20 dollars respectively after the introductory period.

What is the Fairwind Program? It is Google's staged access mechanism for giving trusted cybersecurity partners early access to security focused models like Argon and Carbon before a broader public release.

Are Google's comparisons to other frontier models independently verified? No. The Chrome team patch quality comparison and the Wiz penetration testing results are vendor and partner reported, and Google's own announcement does not name specific competing models in its public benchmark claims.