Google has unveiled Gemini 4 Carbon, a new artificial intelligence model designed to help cybersecurity professionals detect software vulnerabilities, validate security risks and develop fixes. Announced on October 28, 2026, the model expands Google’s Gemini portfolio with a stronger focus on cybersecurity defence and complex, long-running engineering tasks.
Google DeepMind says Carbon delivers significant improvements over Gemini 4 Argon, which was introduced just two weeks earlier. The initial rollout will be limited to selected cybersecurity professionals as Google continues testing the model’s safeguards.
Gemini 4 Carbon Targets the Cybersecurity Lifecycle
Gemini 4 Carbon is designed to support multiple stages of cybersecurity, from discovering vulnerabilities to validating their impact and generating code patches.
According to Google, the model achieved an 88.2% score on SEC-bench Pro, a benchmark for identifying software vulnerabilities. It scored 54.8% on ExploitGym, which evaluates exploitation capabilities, and 71% on CWE-bench for producing fixes for software weaknesses.
These results were obtained in evaluations conducted without guardrails, meaning they should not be interpreted as a guarantee of equivalent performance in real-world environments.
Google also reported that Carbon generated secure code with more than twice the success rate of Argon in internal benchmarks. Its Chrome team found that Carbon produced high-quality patches at more than 10 times the rate of another large frontier model in its internal testing.
Designed for Complex, Long-Running Tasks
Beyond cybersecurity, Gemini 4 Carbon is built to handle demanding engineering assignments that require multiple steps and sustained reasoning.
Google says its teams have used the model to investigate subtle bugs, work across large codebases and develop fixes for low-level systems. The model can persist through unsuccessful approaches and continue working towards a solution over extended periods.
Carbon also recorded improvements in full-stack web development, gaining 89 Elo points to reach fourth place on WebDev Arena with a score of 1,769.
These capabilities could help security engineers automate repetitive investigation and remediation tasks, potentially allowing them to spend more time assessing complex risks and validating fixes.
Google Strengthens AI Safety Measures
The model builds on the safety framework introduced with Gemini 4 Argon. Google’s approach combines model training, real-time misuse prevention, prompt-injection resistance and monitoring of model behaviour.
In its internal tests, Google reported an almost 80% reduction in high-severity misalignment alerts during coding work. It also said Carbon reduced unsupported claims by approximately half compared with Argon.
On Gray Swan’s Indirect Prompt Injection Benchmark, Carbon recorded a reported attack success rate of 0%, compared with Argon’s 0.7%. These results reflect the tested scenarios rather than proving that the model is immune to prompt injection.
Limited Rollout and Pricing
Google is initially providing Gemini 4 Carbon to a subset of cybersecurity defenders. Additional trusted partners will receive access through its Fairwind Program, with broader availability planned for developers, businesses and consumers after further testing and refinement of safeguards.
The introductory price is $2 per million input tokens and $10 per million output tokens, matching Argon’s introductory pricing. Cached input tokens are priced at a 95% discount compared with standard input tokens.
What It Means for Cybersecurity Teams
Gemini 4 Carbon reflects the growing role of AI in vulnerability discovery, software security testing and automated remediation. If its benchmark results translate into practical improvements, the model could help security teams identify and fix flaws more efficiently.
However, organisations will still need human oversight, independent validation and established security controls. AI-generated patches must be tested before deployment, while automated vulnerability testing must remain within authorised environments.
