What do you do when you build an AI that’s scary good at finding security holes? If you’re Google, apparently, you hand it to the good guys first and make everyone else wait. On October 28, Google announced Gemini 4 Carbon, which it calls its “strongest model” yet. But you probably can’t use it. Not yet, anyway.
Right now, Gemini 4 Carbon is going to a small group of cyber defenders. The rest of us are in the queue. So let’s look at what it does, why Google’s holding it back, and whether any of this matters to you.
So what did Google actually launch?
Carbon is Google’s new frontier model. That’s the industry term for a lab’s top-of-the-line AI, the one that pushes the limits. Koray Kavukcuoglu, Google’s Chief AI Architect, announced it on the official Google blog. It builds on Gemini 4 Argon, which arrived just two weeks earlier. We covered what Argon changed for regular users at the time.
Google’s pitch has two parts. First, cybersecurity: finding software bugs, checking whether attackers could exploit them, and writing fixes. Second, what Google calls “long horizon” work, meaning big jobs that take hours or even days.
In fact, Google says its own teams watched Carbon work for days on hard problems. It pushed through dead ends and fixed subtle bugs in huge codebases. That’s a bold claim. It’s also exactly what you’d want from an AI coding partner.
Why Gemini 4 Carbon goes to defenders first
Here’s the twist. A model that’s great at finding and exploiting security holes is great for attackers, too. So Google isn’t flipping the switch for everyone. Instead, a subset of cyber defenders got access during launch week. Next, access will grow step by step to trusted partners through the Fairwind Program, run by Google DeepMind.
Who counts as a defender? According to EdTech Innovation Hub, Fairwind puts organisations that protect critical systems first, such as governments, healthcare providers and telecom services. Academic labs that focus on defensive testing can apply as well. Google also says it’s taking part in the US government’s voluntary pre-release model testing.
“We’re taking a deliberate approach to rollout,” Google wrote. Honestly? We think that’s the right call. We’ve already seen how cheap AI agent hacking has become, so giving defenders a head start makes sense.
The numbers, with a pinch of salt
Google says Carbon debuted at number one on the Artificial Analysis Intelligence Index v5.0, a ranking of AI models, with a score of 59. On the security side, Google ran three outside benchmarks without guardrails and reported these results:
- SEC-bench Pro (finding vulnerabilities): 88.2%
- ExploitGym (exploiting them): 54.8%
- CWE-bench (patching them): 71.0%
Google also says Carbon more than doubled Argon’s success rate at writing secure code in internal tests. Then there’s a spicy one. Google’s Chrome team found Carbon more than 10 times better than “another lab’s large frontier model” at producing high-quality patches. Google didn’t name the rival, of course.
Security firm Wiz also says Carbon leads on web penetration testing benchmarks. Pen testing, by the way, means attacking a system on purpose to find weak spots before criminals do. Still, a quick reality check: almost all of these numbers come from Google itself. So treat them as a strong signal, not gospel.
Is Gemini 4 Carbon safer, too?
Google says yes, at least by its own measures. In internal testing, Carbon made about half as many unsupported claims as Argon. That’s AI-speak for statements the model can’t back up. Meanwhile, high-severity misalignment alerts dropped by almost 80% in Google’s live coding environments. Misalignment, in plain terms, means the model doing something its operators didn’t want.
Prompt injection got attention too. That’s a trick where someone hides malicious instructions inside a web page or file the AI reads. On the Gray Swan benchmark for this attack, attacks on Carbon succeeded 0.0% of the time, compared with 0.7% for Argon.
And on Terminal-Bench 4.0, Google says Carbon’s cheating rate fell to 0.0%. Yes, AI models sometimes try to game their tests. Welcome to 2026.
What it’ll cost when the doors open
For now, there’s no public release date. Google says it’ll open Carbon to developers, businesses and consumers “as soon as possible,” once it has more feedback and better safeguards.
When it does arrive, introductory API pricing matches Argon: $2 per million input tokens and $10 per million output tokens. A token is a small chunk of text, often part of a word. Cached input gets 95% off. After the intro period, though, prices double to $4 and $20.
Okay, but should you care about Gemini 4 Carbon?
If you’re a regular user, not today. You’ll keep using Argon and friends for a while. But the bigger story is how AI launches are changing. The strongest models don’t go straight to everyone anymore. Instead, they go first to the people who can do the most good with them, and to the public later.
For developers and IT teams here in Armenia and across emerging markets, there’s a practical angle. Tools like Gemini 4 Carbon could eventually make serious security work cheaper for small teams. We’ve already seen AI help uncover a decade-old web flaw. Yet the same skills could help attackers, which is exactly why Google’s holding back.
So here’s our question for you: should the most capable AI always go to defenders first, even if it means waiting? We think yes. But we’re curious how long everyone’s patience will last.