Google has built a new flagship Gemini model and is handing it to almost nobody yet. Gemini 4 Carbon, announced on 28 October 2026 in a post on the Google blog by Koray Kavukcuoglu, starts this week with a subset of cyber defenders. More trusted partners will be added gradually through a program Google calls Fairwind. Developers, businesses, and consumers get it “as soon as possible,” with no date attached.
We reported last week that testers were already poking at Carbon in public arenas. The official version confirms the model is real and explains the slow lane. Google says it has signed on to Washington’s optional review of models before release, and that it is still adjusting guardrails using feedback from the first group.
The headline claim is security work. Three external scores carry the case. SEC-bench Pro, which tests finding vulnerabilities, gives Carbon 88.2%. ExploitGym, which tests exploiting them, gives 54.8%. Collinear’s CWE-bench, which tests turning findings into working fixes, gives it 71.0%. Google calls each a state-of-the-art result. It also says these runs were evaluated without guardrails, so defenders using the safeguarded version will be working with a different system, and the post does not say how much the safeguards change the scores.
Some of the evidence comes from inside Google. The company says Carbon more than doubles Argon’s success rate at generating secure code on internal benchmarks, and that its Chrome team found Carbon more than 10 times better at producing high quality patches than a large frontier model from a competing lab. The post names neither the rival model nor the measure. Wiz, the cloud security firm Google owns, reports Carbon leading on web penetration testing benchmarks.
On general ability, Carbon ranks first on version 5.0 of the Artificial Analysis Intelligence Index with a score of 59. Web development is a softer spot: it gains 89 Elo points on WebDev Arena but lands fourth, at 1768. Google also says its own teams watched Carbon work for days on a single engineering task, such as tracking down and patching subtle bugs in large codebases.
A good share of the post covers behavior. On Terminal-Bench 4.0, Google says successful cheating fell to 0.0% and attempted cheating to 0.4%, with accuracy still improving. In live coding sessions with its own teams, Google counted nearly 80% fewer serious misalignment alerts. Carbon makes about half as many unsupported claims as Argon, and Google says overreach fell 26% while under-service fell 29%, meaning it strays outside the task less often and also drops fewer of the steps it was asked to do.
Prompt injection, where hidden instructions in a web page or document hijack an AI agent, gets its own number. Argon had led Gray Swan’s benchmark, where 0.7% of attacks got through; for Carbon the figure is 0.0%. That means it resisted every attack in the test set, which is a narrower statement than being immune to attacks nobody has written yet.
Pricing is the same introductory rate as Argon, which Google launched two weeks earlier: $2 for every million tokens (the chunks of text a model reads) going in, $10 for every million coming out, and a 95% discount on cached input. Two frontier releases in a fortnight is a pace few labs have shown, and Google says its researchers and models are now working together to speed it up.
Until Fairwind widens, most teams can budget for Carbon but cannot buy it. Security groups outside the first circle will have to decide whether to wait for access or keep running Argon, and the 88.2% figure will not settle that until independent testers run the guarded model.
Reported by the Google blog on 28 October 2026.
