Google is giving Gemini 4 Carbon to cyber defenders before everyone else
On 28 October 2026, Google DeepMind announced Gemini 4 Carbon, a frontier model built for cybersecurity and opened first to a subset of defenders. The scores are spectacular, but access is closed: here is what a CISO should take away right now.
28 October 2026. Google DeepMind announced Gemini 4 Carbon, its “strongest model,” ranked first on the Artificial Analysis Intelligence Index v5.0 with a score of 59. Two weeks after Gemini 4 Argon, the new model posts massive gains in vulnerability discovery, exploitation, and patching — the full defense loop. The point that matters: Google is not putting it on sale. It is reserving it first for a subset of cyber defenders, then for Fairwind Program partners, and only then for developers, businesses, and consumers. A frontier model whose first door is a security door is not trivial.
A model graded on finding, exploiting, and fixing
Google’s messaging is built around three benchmarks, presented as “evaluated without guardrails”:
- Find: 88.2% on SEC-bench Pro, billed as state of the art for uncovering real flaws buried in production code.
- Validate: 54.8% on ExploitGym, an exploitation benchmark meant to sort genuinely exploitable vulnerabilities from the rest.
- Fix: 71.0% on CWE-bench, which measures turning a finding into a working code patch.
On top of that, two strong internal claims: indirect prompt-injection resistance measured at 0.0% attack success on the Gray Swan IPI benchmark (versus 0.7% for Argon), and secure-code generation more than twice as good as Argon. The Chrome team says Carbon produces patches “more than 10 times better” than another large frontier model.
One detail is worth underlining: on Terminal-Bench 4.0, Carbon supposedly cut successful cheating to 0.0%, with attempts dropping to 0.4%. In other words, the model does not just answer better — it cheats less, a sensitive point for anyone handing production code to an agent.
A closed front door, on purpose
The most unusual fact is not the performance, it’s the access sequencing. Google says it is “actively engaged” in the U.S. government’s voluntary pre-release testing process, then lays out three concentric circles: cyber defenders first, Fairwind partners next, and only then developers, businesses, and consumers through its product surfaces.
That strategy flips the usual power dynamic. Normally a frontier model opens to paying developers the same day. Here the implicit argument is twofold: first, the model’s offensive capabilities (ExploitGym at 54.8% is literally an exploitation score) justify not handing it to just anyone; second, Google wants feedback on its guardrails before wide release. The uncomfortable corollary: at announcement time, nobody outside that circle can verify the numbers.
The price, however, is already public: $2 per million input tokens and $10 per million output tokens at launch, with cached input tokens billed at 95% off. After the introductory period, the grid rises to $4 and $20. It is the same introductory pricing as Argon — a signal that Carbon is not a niche product but the next default model in the Gemini line.
That caveat — “evaluated without guardrails” — is the one to read twice. Security benchmarks stripped of safety filters measure raw capability, which is what a defender wants to know but also what an attacker wants. A model that scores 54.8% on autonomous exploitation is a genuine dual-use tool, and that is precisely why Google sequenced access the way it did. For a buyer, the takeaway is that the capability and the guardrail are two separate products: never assume the public release ships with the same numbers as the safety-stripped benchmark.
What a CISO should do with this today
Separate what is verifiable from what is not. The cited benchmarks are self-reported and the model is inaccessible to most teams; no independent evaluation can yet confirm the 88.2% on SEC-bench Pro or the 0.0% injection resistance. Prudence therefore requires treating those numbers as a stated target, not a finding.
That does not prevent drawing three concrete conclusions:
- Cybersecurity is becoming a model battleground. When a company of Google’s size positions a frontier model on “find, validate, fix,” defense teams without a defensive-AI strategy fall behind — this is not a theoretical risk.
- Injection resistance becomes a buying criterion. A 0.0% attack-success rate on Gray Swan IPI is exactly the metric a CISO should demand from its agent vendors — and one it must be able to audit, not just read in a press release.
- Conditional access is a precedent. If Google reserves offensive capabilities for defenders, it validates the idea that automated exploitation is now a sensitive capability to control. Expect regulators to pick it up.
In short, treat Carbon as a capability announcement wrapped in an access policy: the capability is the news, the policy is the signal.
# What you can audit today without Carbon access:
# 1. Check the injection resistance of YOUR production agents
# (public Gray Swan IPI benchmark, or an in-house indirect-prompt bench)
# 2. Track public third-party scores on the three cited benchmarks
# (SEC-bench Pro, ExploitGym, CWE-bench) once independents publish them
# 3. Prepare for the pricing switch: $2/$10 -> $4/$20 after introGuardrails with numbers, not just benchmarks
Beyond raw scores, Google published alignment metrics that matter directly to an operator: Carbon would cut overreach by 26% and under-service by 29%, reduce unsupported claims by a factor of 2 versus Argon, and drop high-severity misalignment alerts by nearly 80% in internal coding environments. On WebDev Arena, it gains 89 ELO points and ranks fourth (1,768).
These numbers are self-reported too, but they describe precise behavior: an agent that stays “strictly within scope” and surfaces discrepancies before acting is exactly what you want to hand a security-patching task. The risk of a model that invents a patch is worse than one that withholds it — which is why the “0.0% cheating” on Terminal-Bench 4.0 matters.
Verdict
If you are a defender in a position to join the program, ask for access now: a model that promises to triage exploitable vulnerabilities (ExploitGym) and produce root-cause patches (CWE-bench) is worth testing against your own code before it goes wide. If you lack access, base no decision on the announced numbers: they are self-reported scores on a closed model, and the only sane posture is to treat them as a target to audit once independent evaluations appear. In every case, take away the structural lesson: cybersecurity has become a market where model providers compete on the ability to find and exploit flaws, not just to answer. Your defensive-AI roadmap — models, injection benches, audits — is no longer optional; it determines whether you use these tools or whether they are the ones testing you.