Google DeepMind announced Gemini 4 Carbon on 28 October 2026 — a frontier model released just two weeks after Argon. Carbon took first place on the Artificial Analysis Intelligence Index v5.0 with a score of 59 and set new records on three cybersecurity benchmarks. Neither developers nor businesses can use it yet: for now the model goes only to a narrow group of teams working on cyber defence.
Key takeaways
- SEC-bench Pro 88.2%, ExploitGym 54.8%, CWE-bench 71.0% — three records across the defence cycle
- Gray Swan IPI Benchmark: 0.0% successful prompt injections against 0.7% for Argon and 8.5% for GPT-6 Astra
- Terminal-Bench 4.0: successful task cheating driven to 0.0%, attempts down to 0.4%
- High-severity misalignment alerts in internal coding environments fell by almost 80%
- Introductory pricing of …10 per million output tokens
Where this starts
A security team owns a C library used by several hundred services inside the company. The code is more than a decade old and runs to several hundred thousand lines — this is an editorial example, and Google describes no specific deployment. A classic scanner raises 300 warnings a week, of which perhaps five are real threats.
The problem is not spotting something suspicious. It is the three questions that follow: is this really a flaw, can it actually be exploited, and how can it be patched without breaking everything else.
Each of those three questions is currently a separate tool, a separate team and a separate week of work.
Gemini 4 Carbon is built to answer all three — and Google measures its lead with exactly three benchmarks matching those stages.
What did Google actually announce?
Carbon is a direct extension of Gemini 4 Argon, which reached the market two weeks earlier. Koray Kavukcuoglu, SVP at Google DeepMind and Chief AI Architect at Google, describes it as the company's strongest model.
On the Artificial Analysis Intelligence Index v5.0 — an aggregate ranking that folds many test results into a single number — Carbon placed first with a score of 59, ahead of Claude Opus 5.5 and GPT-6 Astra.
Outside security, the largest single jump is in web development: +89 elo?elo: a rating that measures comparative strength, borrowed from chess — a higher score means more head-to-head wins against other models points on WebDev Arena and fourth place at 1768. Google's internal teams report that Carbon can work a single engineering task for days, pushing through dead ends instead of stopping.
Ryan Whitwam, senior technology reporter at Ars Technica, reads the same numbers more cautiously: Carbon beats Argon on every test, but by slim margins, and every frontier model currently sits in a similar scoring band.
What does this defence cycle look like?
This is a simplified flow based on the three benchmarks Google published, not a description of a finished product on the market.
What do these names mean?
The announcement leans on five terms without which the numbers say very little.
- SEC-bench Pro — a test of whether a model independently finds a real vulnerability buried in working software. The equivalent of a practical exam rather than a knowledge quiz. Carbon: 88.2%.
- ExploitGym — a test of whether a discovered flaw can be turned into a working exploit?exploit: a program or crafted input that uses a flaw in code to force unintended behaviour, which is what makes it genuinely dangerous. Carbon: 54.8%.
- CWE-bench — a benchmark from Collinear measuring whether a model can turn a confirmed finding into a working code fix. Carbon: 71.0%.
- **Prompt injection** — an attack that hides an instruction inside data the model processes, so the model follows it instead of the user's instruction. It can be compared to SQL injection, except the target is the model rather than the database.
- Misalignment — a case where the model completes a task against the intent of whoever assigned it, for instance by gaming a test instead of fixing the code.
The five fit together: the first three measure how much defensive work the model does, the last two whether it can be trusted while doing it.
Why isn't an ordinary vulnerability scanner enough?
A typical security pipeline today rests on static analysis?static analysis: inspecting code without running it, working only from the contents of the source files and rules. The scanner matches patterns against code and flags everything that fits. It is fast and cheap, but it has no grasp of context — it cannot tell whether a suspicious line is reachable from outside at all, or whether the inputs are validated earlier.
The result is a flood of false alarms. A security team spends most of its time filtering rather than fixing.
A language model fills a role the scanner does not: it reads code the way a person does, traces the data path and decides whether a finding is reachable. That is why Google splits the measurement across three benchmarks rather than one — detection without validation would only make the flood of reports larger.
There is a second problem the scanner never touches: ownership of the fix. If a model generates a patch, somebody has to determine whether that patch introduces a new flaw. Hence Google's emphasis on the model not gaming tests and not making unsupported claims — a codebase patched that way would be worse off than an unpatched one.
What about the model's own behaviour?
The second half of the announcement is about discipline rather than capability.
On Terminal-Bench 4.0 — a set of tasks carried out in a terminal — Google drove successful task cheating down to 0.0% and the attempts themselves to 0.4%. These are cases where the model, instead of solving the problem, manipulates the test into passing.
In internal coding environments, high-severity misalignment alerts fell by almost 80%. Unsupported claims dropped roughly twofold against Argon. Google also reports overreach down 26% and under-service down 29%.
The single strongest result concerns prompt injection. On the Gray Swan benchmark Argon led with a 0.7% attack success rate, and Carbon repelled every evaluated attempt.
| Model | Prompt injection success rate |
|---|---|
| Gemini 4 Carbon | 0.0% |
| Gemini 4 Argon | 0.7% |
| Claude Opus 5.5 | 1% |
| GPT-6 Astra | 8.5% |
Is it working yet?
Not for developers, businesses or end users. From the week of the announcement, Google is giving Carbon only to a subset of cyber defence teams, with access for further trusted partners to be opened gradually through the Fairwind Program.
Google is also taking part in the voluntary US government process for pre-release model testing. The company has given no date for wide availability.
The introductory price is 10 per million output tokens, with cached input tokens discounted by 95%. After the introductory period the rates rise to 20. Google did not answer when Ars Technica asked for the date of that increase.
Why does this matter?
Two weeks between Argon and Carbon is a pace at which frontier model launches stop being an annual rhythm. Something else matters more, though: for the first time Google is withholding broad access not because of compute costs but because of the model's offensive capability. A tool that independently finds flaws and builds exploits for them cuts both ways.
What next?
- Access for further trusted partners is to open in stages through the Fairwind Program — Google gave no timeline
- Pricing rises to …20 per million output tokens after an introductory period whose end date Google declined to give when asked by Ars Technica
- Argon moved from the same staged rollout to wide availability in roughly two weeks — the only existing reference point for Carbon's schedule
