Google DeepMind announced Gemini 4 Carbon on October 28, just two weeks after Gemini 4 Argon — and framed the new model not as a general-purpose upgrade but as a cybersecurity specialist. The benchmark numbers are striking. The rollout plan is more interesting.

What Google claims

Carbon is, in Google’s telling, its strongest model for cybersecurity and long-horizon engineering work. The headline scores:

  • 88.2% on SEC-bench Pro — finding real software vulnerabilities
  • 54.8% on ExploitGym — testing whether a flaw is actually exploitable
  • 71.0% on CWE-bench — producing working patches
  • #1 on the Artificial Analysis Intelligence Index v5 at a score of 59

Google also reports more than 2x uplift in secure-code generation over Argon, and says its Chrome team found Carbon “more than 10X better than another lab’s large frontier model” at generating high-quality security patches. Internal testing put Terminal-Bench 4.0 cheating at 0.0% and Gray Swan indirect prompt-injection attack success at 0.0%. Introductory API pricing is $2 per million input tokens and $10 per million output, stepping up later to $4 and $20.

Engineer reviewing an AI-generated security patch

All of that is Google’s own account. None of the headline numbers have been independently reproduced yet, the 10x Chrome comparison does not name the rival model, and no public model card accompanied the launch. Treat the scoreboard as a claim, not a verdict.

The decision that matters: gated access

Carbon is not going on general sale. First access goes to “a subset of cyber defenders” through Google’s Fairwind Program — a network of 650-plus partners spanning governments, national cyber authorities, and critical-infrastructure operators in healthcare, energy, telecom, and finance — with wider developer access promised later, on no fixed timeline. Google says it is also participating in voluntary U.S. government pre-release testing before broader availability.

This is the consequential choice in the launch, and it is the right frame for understanding it. A model that can find real vulnerabilities, confirm they are exploitable, and write the patch is inherently dual-use: the same capability that lets a defender close a hole before it is attacked lets an attacker find that hole first. Google’s phased rollout is an explicit bet that the defender’s advantage depends on sequencing — give the good actors the tool first, harden the safeguards under controlled use, and only then widen the circle.

It is also a bet with a short half-life. Capability like this does not stay gated for long. Anthropic’s Frontier Red Team reported the same week that an unreleased Claude chained flaws into working browser and OS exploits; OpenAI has moved its most advanced models offline after security scares. Every frontier lab is converging on the same uncomfortable fact: cyber-offense capability is now a standard frontier-model property, not an exotic extra. Gating buys time for defenses and for norms. It does not repeal the underlying dynamic.

What organizations should actually require

If you run a security team, Carbon’s benchmarks are the least important part of this announcement. The questions worth asking before letting any model of this class touch your code are about permissions, not performance:

  1. Scope control. Can the model be restricted to read-only analysis on a defined codebase, with no ability to touch production systems or exfiltrate findings? Google reports overreach down 26% versus Argon — but 26% better is not a guarantee.
  2. Patch provenance. Every AI-generated fix needs human review and a test suite that fails without it. A patch that looks right and passes a shallow test is worse than no patch, because it closes the ticket while leaving the flaw.
  3. Disclosure handling. When the model finds a vulnerability in a third party’s software, who decides the disclosure timeline — you, the vendor, or the model provider? Get that answer in writing before the first scan.
  4. Independent verification. Demand benchmark reproduction by someone other than the vendor. The Chrome 10x claim is precisely the kind of number that should be replicated before it enters a procurement deck.

The broader pattern is worth naming: frontier-model launches are increasingly deployment announcements disguised as capability announcements. Argon to Carbon in two weeks is not a story about two models; it is a story about a lab learning to ship capability in slices, with access as the throttle. Expect more of this — more “trusted tester” phases, more defender-first programs, more pricing that starts low and steps up once dependence sets in.

Carbon may or may not deserve its leaderboard position. But the access decision already tells us something the benchmarks cannot: Google believes this class of model is powerful enough that who uses it first is a safety-relevant variable. That judgment, more than any score, is what the rest of the industry should be pricing in.

Sources: Google DeepMind announcement via The Neuron and AI Weekly (Oct 29, 2026); Digital Trends (Oct 28, 2026). Benchmark and pricing figures are Google’s own claims and await independent verification.