Google has announced Gemini 4 Carbon, its next frontier AI model, which the company says delivers state-of-the-art cybersecurity capabilities and long-horizon performance. The model will first be made available to a subset of cyber defenders this week, with access gradually expanded to trusted partners before a wider release to developers, businesses and consumers.
Google announced Gemini 4 Carbon on Wednesday, describing it as its strongest model yet and ranking it first on the v5.0 Artificial Analysis Intelligence Index with a score of 59. The company said the model shows significant gains in coding, agentic tasks and cybersecurity defense.
According to Google, Carbon achieves state-of-the-art results on external benchmarks evaluated without guardrails: 88.2% on SEC-bench Pro for finding real-world vulnerabilities, 54.8% on ExploitGym for validating which vulnerabilities are exploitable, and 71.0% on Collinear's CWE-bench for patching at the root cause. The company also reported that its Chrome team saw Carbon perform more than 10 times better than another lab's large frontier model when generating high-quality patches, and that on internal benchmarks Carbon achieved more than double the success rate of its predecessor, Gemini 4 Argon, at generating secure code.
The model is built for sustained agentic workflows, with Google saying its internal teams have seen Carbon run for days to tackle complex, multi-step engineering tasks. Google also highlighted safety improvements, including a 0.0% attack success rate on an indirect prompt injection benchmark, an almost 80% reduction in high-severity misalignment alerts in live coding environments, and reductions in overreach and under-service of 26% and 29% respectively.
Gemini 4 Carbon builds on Gemini 4 Argon, which launched two weeks ago. Google said it is taking a deliberate approach to rollout and is engaged in the U.S. government's voluntary process for pre-release model testing. Pricing will match Argon at $2 per million input tokens and $10 per million output tokens, with cached input tokens priced at 95% off the input token price.
Google is positioning AI as a practical tool for cyber defense, claiming strong results across the full vulnerability lifecycle, from detection to remediation.
The phased rollout to cyber defenders first signals how Google is managing safety and trust concerns before a broader commercial release.
The model's pricing and eventual availability on product surfaces will affect developers and businesses considering AI-assisted security work.
Background
Gemini is Google's family of frontier AI models, and the company has been iterating quickly: Argon launched just two weeks before Carbon. AI labs increasingly evaluate models on cybersecurity tasks, measuring how well they can find, exploit and patch software flaws. Google says Carbon extends Argon's safety stack with additional alignment work aimed at reducing shortcuts, unsupported claims and overreach in complex tasks.
What to Watch
How the initial cohort of cyber defenders in Google's Fairwind Program uses the model and what feedback emerges on its real-world reliability.
Whether external researchers independently confirm the benchmark results Google reported.
When Google expands access to developers, businesses and consumers, and how the model performs in broader use beyond cyber defense.
12 claims in this story checked against 1 source: 11 supported.
Show each claim
SupportedGemini 4 Carbon is an AI model built for cybersecurity defense.Google: AI (The Keyword): “Today, we’re announcing the next frontier model: Gemini 4 Carbon, our strongest model with state-of-the-art cybersecurity and long horizon capabilities.”
SupportedGoogle will first make Carbon available this week to some cyber defenders, then expand access to trusted partners and later to developers, businesses and consumers.Google: AI (The Keyword): “Starting this week, we will make Carbon available to a subset of cyber defenders and will gradually phase access to additional trusted partners through our Fairwind Program. We’re continuing to gather feedback and iterate on guardrails before making Carbon available to developers, businesses, and consumers via our product surfaces as soon as possible.”
Not in the sourcesGoogle announced Carbon on Wednesday.Google: AI (The Keyword): “Today, we’re announcing the next frontier model: Gemini 4 Carbon”
SupportedCarbon ranks first on the v5.0 Artificial Analysis Intelligence Index with a score of 59.Google: AI (The Keyword): “Carbon ranks #1 on the recently updated v5.0 of Artificial Analysis Intelligence Index at 59.”
SupportedCarbon scored 88.2% on SEC-bench Pro for finding real-world vulnerabilities.Google: AI (The Keyword): “Carbon achieves a state-of-the-art 88.2% on SEC-bench Pro, autonomously uncovering complex flaws buried in real-world software.”
SupportedCarbon scored 54.8% on ExploitGym for validating which vulnerabilities are exploitable.Google: AI (The Keyword): “Carbon sets a new state-of-the-art on the popular exploitation benchmark ExploitGym (54.8%).”
SupportedCarbon scored 71.0% on Collinear’s CWE-bench for patching at the root cause.Google: AI (The Keyword): “Carbon reaches 71.0% on Collinear’s CWE-bench, turning validated findings directly into working code fixes.”
SupportedGoogle’s Chrome team reported that Carbon performed more than 10 times better than another lab’s large frontier model when generating high-quality patches.Google: AI (The Keyword): “the Chrome team has reported that Carbon performed more than 10X better than another lab's large frontier model when generating high quality patches.”
SupportedOn internal benchmarks, Carbon achieved more than double Argon’s success rate at generating secure code.Google: AI (The Keyword): “On internal benchmarks, Carbon achieves more than 2x uplift in success rate for generating secure code over Argon.”
SupportedCarbon had a 0.0% attack success rate on an indirect prompt-injection benchmark.Google: AI (The Keyword): “While Argon previously led the Gray Swan’s Indirect Prompt Injection (IPI) Benchmark in prompt injection resistance with a very low 0.7% attack success rate, Carbon achieves 0.0% — resisting every evaluated attack attempt.”
SupportedHigh-severity misalignment alerts dropped by almost 80% in live coding environments.Google: AI (The Keyword): “In live coding environments with our internal teams, we observed that high-severity misalignment alerts dropped by almost 80%.”
SupportedCarbon reduced overreach by 26% and under-service by 29%.Google: AI (The Keyword): “Carbon simultaneously reduced overreach by 26% and under-service by 29% resulting in much more reliable execution of multi-step plans end-to-end while respecting project constraints and staying strictly within scope.”
