Gemini 4 Carbon opens to cyber defenders first, not as a general release

Google announced Gemini 4 Carbon on October 28, 2026, and called it the company’s strongest model, with state-of-the-art cybersecurity and long-horizon capabilities. Koray Kavukcuoglu, SVP of Google DeepMind and chief AI architect at Google, presented it as a follow-on to Gemini 4 Argon, launched two weeks earlier. It is not a general release.

Starting this week, Google said, Carbon goes to a subset of cyber defenders, then to additional trusted partners through the Fairwind Program. Developers, businesses, and consumers are promised the model on product surfaces “as soon as possible,” after feedback and further guardrail work. In the same post, Google said it is actively engaged in the U.S. government’s voluntary process for pre-release model testing.

Ars Technica’s Ryan Whitwam reported that general access is not open and that Google has set no wide-release date. Ars described the partner rollout — spelled “Fairwinds” in that piece — as coming once voluntary testing is done, a tighter sequence than Google’s own wording, which puts a defender subset on the model this week while that process is already underway. Ars also said a staged release could take a while, and that if Carbon follows Argon it might reach wider use in a couple of weeks, probably first for AI Ultra subscribers and Gemini API developers. That calendar is Ars’s analogy. Google has not published one. Google AI’s account posted on October 28 and sent readers to the blog; the post text on record does not itself state the access rules.

What Google claims, and what it does not prove

Google ranks Carbon No. 1 on Artificial Analysis Intelligence Index v5.0, at 59. On external cyber benchmarks it says were evaluated without guardrails, it published 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on ExploitGym, and 71.0% on Collinear’s CWE-bench for turning findings into code fixes. Those are Google’s scores, not an independent bake-off.

Ars, reading Google’s comparison charts, reported slim margins over Argon and only a few points of separation from other frontier models Google plotted, including GPT-6 Astra, Claude Opus 5.5, and Claude Fable 5.1. On Gray Swan’s indirect prompt-injection benchmark, Google said Carbon’s attack success rate was 0.0%, against 0.7% for Argon. Ars also listed 1% for Opus 5.5 and 8.5% for GPT-6 Astra. Ars’s caveat is that benchmarks don’t tell the whole story, and that frontier scores in these tests sit in the same neighborhood.

Other figures in the announcement are likewise Google’s:

WebDev Arena: up 89 Elo, to No. 4 at 1768.
Internal secure-code benchmarks: more than a 2x uplift in success rate over Argon.
The Chrome team reported Carbon was more than 10 times better than another lab’s large frontier model at generating high-quality patches. Google did not name that model.
Wiz, which Google called its leading cloud security platform, observes Carbon leading on web penetration-testing benchmarks tied to Scan for Good. No public Wiz score is in the post.
Internal long runs: teams have seen Carbon persist for days on multi-step engineering work, including root-causing and patching subtle bugs across large codebases and low-level systems.
Alignment claims from Google’s own tests: successful cheating on Terminal-Bench 4.0 cut to 0.0%, with cheat attempts at 0.4%; high-severity misalignment alerts in internal live coding down almost 80%; unsupported claims cut by about 2x versus Argon; overreach down 26% and under-service down 29%.

Ars noted that Google presents Carbon as a new model while leaving open, from the outside, whether it is a post-training upgrade of Argon. Google does not resolve that. It says Carbon uses Argon’s multi-layered safety stack — training, real-time misuse defenses, prompt-injection resilience, and chain-of-thought monitoring — and that researchers are advancing capability and safeguards together. Ars also described Carbon as an improvement on Argon, not the Flash-class model Ars said it had been waiting for.

Price is set; the discount clock is not

Carbon launches at Argon’s introductory API rate: $2 per million input tokens and $10 per million output tokens, with cached input tokens at 95% off the input price. After the introductory period, Google’s footnote sets $4 per million input tokens and $20 per million output tokens. No end date is in the post. Ars reported that Argon’s discount runs through the end of November, and that Google declined to give a Carbon end date when asked.

For agent and security teams, the gate matters more than the leaderboard. Carbon is not on general product surfaces. First access is a subset of cyber defenders, then Fairwind partners. There is no published date for developers, businesses, or consumers, and no published date for when $2 / $10 becomes $4 / $20.

Read Google’s announcement before planning around these scores, and treat the cyber, agent, and days-long figures as vendor claims until an outside evaluation repeats them. If you are waiting on API access, watch for a general-availability date and an introductory-pricing end date rather than assuming Argon’s calendar will apply.

What Google claims, and what it does not prove

Price is set; the discount clock is not

Sources