Google's Gemini 4 Carbon Limits Cyber Model to Selected Defenders

Google's newest frontier model can find software flaws, judge whether attackers could exploit them and write fixes for them. Almost nobody can use it yet. Gemini 4 Carbon launched on Wednesday, October 28, 2026, and Google is releasing it first to a small group of cybersecurity defenders. That choice puts AI-driven cyber capability in front of US security teams and policymakers before the model reaches the public.

Google called Carbon its strongest model and built the launch around cybersecurity and long-running work, according to its Google Blog announcement. The company says the model covers three stages of security work: finding vulnerabilities, judging whether they can be exploited, and writing fixes, as Interesting Engineering reported. Google also says it takes part in the US government's voluntary pre-release testing, according to SecurityWeek.

Carbon follows Gemini 4 Argon, which Google launched about two weeks earlier. The rollout pattern is worth noting. Argon's cyber-defense features reached Fairwind partners first, before the model appeared in the Gemini app and AI search mode, according to Engadget.

Which cyber benchmarks Carbon leads

Every headline cyber number Google has published comes from its own testing. The Hacker News reported three scores that define the model's pitch:

Koray Kavukcuoglu, an SVP at Google DeepMind and Google's chief AI architect, said Carbon is “landing a firm lead in SEC-bench Pro (88.2%) for finding vulnerabilities.” That single score is the one Google wants security buyers to remember, and it is the easiest to compare with rival models once they publish their own results.

Outside cyber tasks, Google reports that Carbon scored 59 on the Artificial Analysis Intelligence Index v5.0 and ranked first. Google also says secure-code generation runs at about twice Argon's rate. In internal tests, the company reports roughly half as many unsupported claims as Argon, according to Help Net Security.

Google's Chrome team reported the sharpest claim. Carbon produced high-quality fixes more than 10 times better than those from another lab's large frontier model. Google did not name the rival, which makes the claim hard to check.

Treat these numbers with care. The cyber tests were run without guardrails, and NeuralTrust notes that the cyber scores come from Google alone. No independent lab has published matching results in the coverage reviewed for this story.

What Google's safety results show

Google's internal prompt-injection test found a 0.0% attack success rate for Carbon. Argon scored 0.7% and Anthropic's Claude Opus 5.5 scored 1.0% on the same test, according to Yahoo Tech. Those are Google's internal results, so they show how the model performed in Google's setup, not in the wild.

Google also reports nearly an 80% drop in high-severity misalignment alerts in its internal coding environments, per SecurityWeek. A drop in alerts is a useful signal only if the alert system stays the same across models. Google has not said whether it changed how alerts are counted.

Google framed the release as a judgment call. “Pushing the frontier forward requires moving fast while remaining deliberate about deployment,” the company said.

Who can get Carbon now, and when

Access is limited to a group of cybersecurity defenders for now. Google says more trusted partners will get Carbon through its Fairwind Program before any wider release. The company has not published criteria for choosing defenders, and it has not given a date for broad release.

For everyone else, the wait continues. Google says it will make Carbon available to developers, businesses and consumers “as soon as possible,” but it gave no date. Small businesses and most individual users should expect a long wait.

Pricing is the one practical detail that has surfaced, and it comes from a single source. Tickernews reported $2 per million input tokens and $10 per million output tokens, the same rate as Argon. Only one outlet has reported the figures, so treat them as unconfirmed until Google posts them on its pricing page.

Google is not the only lab gating a sensitive model. OpenAI opened its biology model, GPT-6 Rosalind, only to approved customers. Restricted access for high-risk capability is becoming a standard launch step.

How Carbon compares with GPT-6 Astra and Claude Opus 5.5

Google compared Carbon with OpenAI's GPT-6 Astra and Anthropic's Claude Opus 5.5 on coding, science, math, multimodal and cyber benchmarks, according to Yahoo Tech. Engadget reports that Carbon tops Opus 5.5 on several key benchmarks. Public coverage focuses most on Opus 5.5, so a clean head-to-head against Astra on cyber tasks is still hard to find.

OpenAI is playing the same game. Its GPT-6.1 Terra, released October 26, reached what OpenAI describes as the “Critical” cybersecurity threshold under its Preparedness Framework, and it keeps the protections GPT-6 Astra uses, according to TestingCatalog.

A less authoritative write-up from AIPlanetX reports that Terra bypassed restrictions in 29.6% of low-stakes tests run at maximum effort without system safeguards. The same write-up warns that such tests may not predict real use, so read the figure as a warning sign, not a measure of everyday risk.

The pattern matters more than any single score. Google and OpenAI both now treat cyber capability as a release decision, not a feature checkbox. Defenders on early-access lists gain the most in the near term. Smaller teams without a partner route may wait longest, and attackers will pay close attention to which capabilities reach the public first.

What security teams should do now

Most readers cannot use Carbon directly, so the practical steps are about preparing for a faster threat cycle. These are our suggestions, not guidance from Google.

• Security leads should ask software vendors and security providers whether they are Fairwind partners and what access they hold.
• Keep normal patching habits. AI-assisted vulnerability discovery is likely to speed up disclosure, so plan for shorter gaps between a flaw becoming public and attempts to exploit it.
• Check Google's pricing page before budgeting for Carbon, rather than relying on the single reported rate.

What to watch next

Three signals will show whether Carbon's rollout is a careful release or a long hold. The first is whether Google publishes criteria for choosing defenders and a date for broad release. The second is whether the US government discloses anything about its review of Carbon. The third is whether independent researchers can reproduce the cyber scores.

The spending behind these models will draw scrutiny too, as Big Tech's $3 trillion AI spending pledges test investor patience. Argon's path from Fairwind partners to the Gemini app suggests Carbon will follow a similar sequence. The partner list, not the launch blog, will show how fast that happens.