Google has introduced Gemini 4 Carbon, a flagship model released just two weeks after Gemini 4 Argon, which secured the top spot in the independent Artificial Analysis Intelligence Index v5.0 with a score of 59. The primary focus is cybersecurity: the model is positioned as a full-cycle tool, from finding real vulnerabilities to providing ready-made fixes. Access is being opened in phases, starting with a narrow circle of security specialists and moving toward a general release, the date of which has not yet been announced.

image
image
image

What happened

Google released Gemini 4 Carbon, accompanying the announcement with a set of security-focused metrics. The model scored 88.2% on SEC-bench Pro, which tests the discovery of real vulnerabilities, 54.8% on ExploitGym, which assesses exploitability verification, and 71% on CWE-bench, which measures patch generation. In the WebDev Arena, Carbon achieved an Elo rating of 1768 and fourth place, improving upon Argon's result by 89 Elo. In Gray Swan's indirect prompt injection benchmark, attacks were unsuccessful every time: 0.0% compared to 0.7% for Argon. According to Google's internal tests, Carbon generates secure code more than twice as well as Argon, and the Chrome team rated its patches as more than 10 times higher quality than those of another leading model. It is also claimed to have approximately 80% fewer serious instruction violations in live coding environments and half as many unfounded assertions. The introductory API price is $2 per million input tokens and $10 per million output tokens, with a 95% discount on cached context.

Context

The announcement differs from the usual race for general intelligence: according to this data, Google is for the first time positioning its flagship primarily as a defense tool, packaging the cycle of "find vulnerability → verify exploitability → write fix" into a single specialization with a separate metric for each step. This represents a shift from measuring general intelligence to a measurable vertical, forming a new category of capability reporting among frontier labs. The release is organized under a controlled access scheme: first a subset of cybersecurity specialists, then partners through the Fairwind Program, and only then a general release, with Google having submitted the model for voluntary pre-testing to the US government. This is how frontier models with dual-use cyber capabilities are released: they reach users not through open access, but via a managed scheme. Regarding metrics, there is a divergence: the top spot in the Artificial Analysis Intelligence Index is a signal from an independent aggregator and thus an independent benchmark, whereas the security benchmarks were presented by the vendor itself.

Why this matters for the industry

Defense packaged as an accessible API primitive is the foundation for a new class of SecOps agents and multi-day autonomous workflows, as well as an opportunity for a service layer built on top of the primitive. The flip side is the direct dismantling of the moat for vendors of point security tools. The announced price level is no higher than Argon's, and the deep discount on cached context recalculates the unit economics of long agent sessions: working with large codebases becomes financially predictable, and this level should already be factored into next year's budget models. The phased release scheme for dual-use models with pre-testing appears to be a candidate for becoming the norm for frontier labs, so product plans should reasonably be designed with managed access in mind. A practical step for today: Argon remains the working default in production, while the "search → verify → patch" pipeline should be built as an orchestrator not tied to a specific model provider.

Why this matters for users

For developers and SecOps specialists, Carbon sets a benchmark for agents that work autonomously for days: they independently find the cause of a bug in a large codebase, restore context, and return with a ready patch; the scenario of a nightly session on technical debt with a morning report is an expected development, not a current capability. For trust in long agent sessions, the decisive factors are not individual records but the model's honesty and instruction following: Google claims progress on both points compared to Argon, and it is precisely this that allows an agent to work for hours without manual control. You cannot try Carbon right now: wide access has not been opened, and Argon remains the working option in production. If you are involved in security research or work with partners, you should request access through the Fairwind Program. For everyone else, it makes sense to prepare your own control tasks in advance to honestly compare Carbon and Argon on your own workloads once general access is available—that is when the first independent data on latency, stability, and real cost will appear.

What is still unknown / limitations

Key figures currently require caveats. The evaluation configuration for security benchmarks (SEC-bench Pro, ExploitGym, CWE-bench) has not been disclosed, so comparability with published results from other models is not obvious. The Chrome team's statement on patch quality is an internal assessment without naming the competitor or criteria; the same applies to internal agent behavior metrics, including honesty and instruction following. Independent verification is impossible while access is limited to a subset of security specialists and Fairwind Program partners, and the general release date has not been announced. There is no data on latency, context window size, or request limits. The top spot in the Artificial Analysis Intelligence Index remains the most independent of the signals provided, but it speaks to the rating rather than the model's behavior in specific production workloads.

Sources

Author

Look at AI, editorial team