Gemini 4 Carbon: Google's New Frontier Model Leads AI Cybersecurity Benchmarks

Gemini 4 Carbon is Google's newest frontier AI model, announced on October 28, 2026, and Google is pitching it first and foremost as a cybersecurity model. Google says it leads rival models at finding software vulnerabilities (88.2% on SEC-bench Pro), proving they're exploitable (54.8% on ExploitGym) and fixing them (71.0% on CWE-bench). It also tops the Artificial Analysis Intelligence Index with a score of 59.

Most developers can't use it yet, though. Google is giving Gemini 4 Carbon first to a small group of vetted cyber defenders through its Fairwind Program, and says it will reach developers, businesses and consumers "as soon as possible."

Below is what Google announced, what the benchmarks actually measure, the safety claims, pricing, how it stacks up against OpenAI and Anthropic, what an independent hands-on review found and what it means for developers and security teams. Every number is Google's own unless I say otherwise.

Gemini 4 Carbon: the key facts

What Google announced

Gemini 4 Carbon arrives just two weeks after Google launched Gemini 4 Argon. (The Hacker News described the gap as less than a week; Google's own announcement says Argon launched two weeks earlier.) Google says the speed shows "our researchers and models are working hand in hand to advance capabilities faster."

The model has three headline themes:

• Cybersecurity: state-of-the-art results on finding, validating and fixing vulnerabilities.

• Long-horizon engineering: Google says its own teams have seen Carbon run "for days" on complex tasks such as root-causing and patching subtle bugs across large codebases and low-level systems.

• Better behavior: fewer shortcuts, fewer unsupported claims, better collaboration when a task is ambiguous and stronger resistance to prompt injection.

The cybersecurity benchmarks, explained

Google frames Carbon's results around the three stages a security team actually works through. All three scores were measured without guardrails, meaning the model's safety filters were off for evaluation.

1. Finding vulnerabilities: 88.2% on SEC-bench Pro. This benchmark tests whether a model can uncover real flaws in real-world software. Google says Carbon "autonomously" found complex flaws buried in existing code.

2. Validating them through exploitation: 54.8% on ExploitGym. This is the number that will make some readers uneasy. Google's argument is that defenders need to know which bugs are actually exploitable to decide what to fix first. "To prioritize which vulnerabilities to remediate first or remediate at all, cyber defenders increasingly rely on models to check which vulnerabilities are exploitable," the company said.

3. Patching the root cause: 71.0% on Collinear's CWE-bench. CWE refers to the Common Weakness Enumeration, the standard catalog of software weakness types. This benchmark checks whether the model can turn a finding into a working code fix.

According to SecurityWeek, Google's comparison puts Carbon ahead of OpenAI's GPT-6 Astra and Anthropic's Claude Opus 5.5 and Claude Fable 5.1 on all three. The published sources don't list the competitors' exact scores, so it's not possible to say from them how big each lead is.

Google adds three internal and partner results:

• On internal benchmarks, Carbon is more than twice as successful as Argon at generating secure code.

• Google's Chrome team reported that Carbon did more than 10 times better than another lab's large frontier model at generating high-quality patches.

• Wiz, the cloud security company owned by Google, says Carbon leads its web penetration testing benchmarks, which support Wiz's Scan for Good initiative.

Treat the last two with care. Both come from inside Google, and the "another lab's model" in the Chrome comparison isn't named.

How Carbon compares on general intelligence

On the independent Artificial Analysis Intelligence Index v5.0, which combines many evaluations into one score, Gemini 4 Carbon ranks first with 59, ahead of Claude Opus 5.5 (58), GPT-6 Astra (57) and GPT-6.1 Sol (55), according to The Hacker News. Artificial Analysis lists Carbon at #1 of 52 models, against a class median of 42.

That's a real lead, but a narrow one. One point separates Carbon from Claude Opus 5.5, and four points cover the top four. At the frontier right now, the "best model" title can change hands within weeks.

Artificial Analysis also flags two practical details worth knowing:

• Carbon is very verbose. It used about 200 million output tokens to complete the Intelligence Index, against a median of about 64 million, ranking 49th of 51 models.

• That makes it expensive to run. At Carbon's standard price, Artificial Analysis puts the cost of running its index at $7.76, ranking 45th of 51. In other words, the top score came with a lot of tokens.

On web development, Carbon climbed 89 Elo points to 1768, placing fourth on WebDev Arena. So it isn't the leader everywhere.

The safety and alignment claims

Google spent a large part of the announcement on behavior, not just capability. It says Carbon uses the same multi-layered safety stack as Argon (model training, real-time misuse defenses, prompt-injection resilience and chain-of-thought monitoring), then goes further on alignment.

According to Google:

• Prompt injection: On Gray Swan's Indirect Prompt Injection benchmark, the attack success rate fell from 0.7% with Argon to 0.0% with Carbon. Carbon resisted every evaluated attack.

• Cheating on tests: On Terminal-Bench 4.0, successful cheating fell to 0.0%, and attempts to cheat dropped to 0.4%, while overall accuracy improved.

• Misalignment in real use: In live coding environments with Google's own teams, high-severity misalignment alerts dropped by almost 80%.

• Honesty: Carbon makes about half as many unsupported claims as Argon. Google says it now puts caveats directly into its output or lists what's still needed, instead of "fabricating or hedging around missing evidence."

• Staying in scope: Carbon reduced overreach by 26% and under-service by 29%, meaning it does less of what it wasn't asked to do while finishing more of what it was.

• Asking instead of guessing: When a task is ambiguous, Google says Carbon "retrieves the relevant sources and surfaces discrepancies to the user before acting," rather than "guessing or forcing a path forward."

These are encouraging, but they are Google's own measurements. A 0.0% attack success rate on one benchmark means Carbon blocked every attack in that test, not that it can't be prompt-injected. Independent red-teaming once more people have access will be the real test.

Who can use Gemini 4 Carbon, and when

Carbon follows the same staged rollout as Argon:

1. This week: a subset of cyber defenders.

2. Next: additional trusted partners through the Fairwind Program.

3. Later: developers, businesses and consumers through Google's products, once Google has gathered feedback and refined its guardrails.

Fairwind is Google's early-access program for defensive security. Its page says it prioritizes governments and national cyber authorities, critical infrastructure operators (including healthcare, telecom, energy and financial networks) and core technology platforms, with academic labs focused on defensive benchmarking also able to apply. All applicants are vetted. Google says it works with more than 650 partners globally. Access is limited to internal security, incident response or penetration testing teams, partners can't resell or share access, and creating malware isn't permitted.

Google also says it's taking part in the US government's voluntary pre-release model testing process, under which top AI models can be evaluated for national security risks before launch.

Gemini 4 Carbon pricing

The introductory price matches Argon's. The standard price comes from SecurityWeek and matches the $4 and $20 rates Artificial Analysis lists. Google hasn't said when the introductory period ends. Given Artificial Analysis's verbosity finding, budget for output tokens carefully: a model that writes three times as much text costs three times as much per answer at the same rate.

The bigger picture: an AI cyber arms race

Carbon didn't launch in isolation. In the same week:

• OpenAI released GPT-6.1 Terra, which it describes as a fast, efficient model that "excels at communication and computer-based tasks." OpenAI says Terra meets the Critical threshold in cybersecurity under its Preparedness Framework and keeps the protections built for GPT-6 Astra. It also says Terra is more likely to stay within scope and disclose its limitations than GPT-5.6 Terra, and showed strong resistance to prompt injection.

• Anthropic's Frontier Red Team published research showing an unreleased internal model finding and chaining serious vulnerabilities in some of the most widely used software: a one-click exploit chain in Chrome, a one-click chain in Safari that could read browsing history and cookies, an Android lock-screen bypass on a Google Pixel 9, a Windows remote denial-of-service flaw (CVE-2026-33096) and a zero-click remote code execution bug in Linux's multipath TCP code. All were patched through coordinated disclosure. (Some reports described the Windows bug as an HTTP.sys flaw. Anthropic's write-up describes it as an out-of-bounds read in the Windows kernel's QUIC, or HTTP/3, implementation.)

Anthropic put the shift bluntly. Building sophisticated multi-step exploits has "historically been the domain of few specialist teams," it wrote. "Now, it's something models can do with little human involvement."

That's the context for Carbon. All three leading labs now describe their frontier models as capable of serious offensive security work, and all three are choosing staged releases to vetted defenders first. The race isn't only about which model scores highest. It's about whether defenders get these tools before attackers build equivalents. We saw this week how quickly attackers are already using AI coding tools to scale real intrusions, in the PHP2Shell firewall campaign covered elsewhere on ByteMuni.

What it means for developers and security teams

If you're a developer, nothing changes today, because Carbon isn't publicly available. When it is, the claims worth testing are secure code generation (Google says it's more than twice as good as Argon), long-running agentic tasks and how often it stops to ask instead of guessing. Our guide to how agentic AI works covers the guardrails you'll still want around any model that runs for hours or days.

If you run a security team, three things are worth doing now:

1. Check Fairwind eligibility. If you work for a government body, critical infrastructure operator or major platform, you may qualify for early access.

2. Scan your own code. Anthropic's advice applies whichever model you use: "scanning your own code is more important than ever." If AI can find bugs this well, assume attackers will find yours.

3. Plan for patch volume. Models that find hundreds of real bugs mean more fixes landing faster. Anthropic's Chrome work alone produced 62 CVEs patched as of Chrome 156. Make sure your patching process can keep up.

And remember what's at stake when an AI agent has real permissions in your environment. ByteMuni's analysis of AI agents as insider threats explains why the model's reasoning and its permissions need to be separated.

What we still don't know

• Competitor scores. Google says Carbon leads, but the public materials don't give GPT-6 Astra's or Claude's scores on SEC-bench Pro, ExploitGym or CWE-bench.

• Independent verification. The security, alignment and Chrome patch figures are Google's own. Outside testing will come once access widens.

• Exact release date. Google says "as soon as possible," with no date.

• How it performs at scale. Early hands-on impressions, like the video review above, are useful but come from a handful of prompts.

• When the price rises. The end of the introductory pricing period hasn't been announced.

Hands-on: what an independent video review found

Benchmarks only tell part of the story, so it's worth seeing how Gemini 4 Carbon behaves on real, open-ended tasks. In a 47-minute hands-on video, an independent YouTube reviewer compared Carbon with Gemini 4 Argon, Claude Opus 5.5, GPT-6.1 Sol and several other models on the same prompts, mostly 3D scenes, interactive web pages, visual explanations and website designs. The video doesn't say how the reviewer got early access, and these are one person's side-by-side impressions, not a formal benchmark.

Here's what the reviewer found:

The cost gap with Opus was the recurring theme. In the reviewer's runs, one 3D scene cost about $2.70 with Carbon versus $27.50 with Opus, a complex Golden Gate Bridge prompt cost about $3.50 versus $63, and a visual explanation of how lightning works cost about $0.50 versus $8.76. Opus usually won on detail. The reviewer's question was whether that extra polish is worth 10 to 20 times the price, and the honest answer was "it depends on the job." For a detailed map or a client-facing website, maybe. For brainstorming or everyday tasks, probably not.

Creativity was Carbon's biggest strength. The reviewer singled out scenes such as an explorable world stitched together from Van Gogh paintings, Monet paintings morphing from one season to the next, and a London scene moving from Roman times to the modern city. They described Carbon's results as richer, more immersive and more varied than GPT-6.1 Sol's, which felt "more sterile" in comparison. The reviewer argued this matters even if you never build 3D scenes: a model that approaches problems differently is more useful for brainstorming, writing and design.

Finishing the job was its biggest weakness. The same pattern came up repeatedly: Carbon sometimes didn't complete every detail. People were often simple "stick figures," a car drove into a mountain in one scene, a cathedral had gaps in its structure, and some website layouts felt heavy, with information that was harder to find than in the GPT or Opus versions. The reviewer said this kind of incompleteness is something you basically never see from Sol models.

The verdict: a big jump from Argon, not quite at Opus 5.5 on polish or explanations, roughly level with GPT-6.1 Sol with different strengths, and clearly "solidly in that top three." That lines up well with the one-point gap at the top of the Artificial Analysis Intelligence Index.

My take

Gemini 4 Carbon is a strong release, and the most interesting part isn't the 59 on the leaderboard. It's how openly Google now markets exploitation as a feature. Not long ago, a major lab advertising a model's ability to write working exploits would have been very unusual. Today, Google, OpenAI and Anthropic all describe frontier models as serious offensive security tools and are racing to put them in defenders' hands first.

I think the staged rollout through Fairwind is the right call. A model that scores 54.8% on an exploitation benchmark with no guardrails shouldn't be one API key away from everyone on day one. The safety numbers are also genuinely encouraging, especially the focus on asking for help instead of guessing, which matters more for long-running agents than any benchmark.

But I'd keep two caveats in mind. Almost every headline figure comes from Google itself, and the lead on general intelligence is a single point. The early hands-on review backs up the overall picture: a big step up from Argon and very creative, but not yet as polished as Claude Opus 5.5 or as reliably complete as GPT-6.1 Sol. Carbon is clearly at the frontier. Whether it stays ahead, and whether its safety claims hold up under independent testing, we'll know in a few weeks, not today.

The bottom line

Gemini 4 Carbon is Google's new frontier model and its clearest bet yet on AI for cybersecurity. Google reports state-of-the-art results on finding (88.2%), exploiting (54.8%) and patching (71.0%) vulnerabilities, a narrow #1 spot on the Artificial Analysis Intelligence Index and meaningful safety improvements over Argon. An early independent review rates it in the top three, more creative than GPT-6.1 Sol and far cheaper per task than Claude Opus 5.5 in the reviewer's tests, though less polished. It's rolling out first to vetted cyber defenders through the Fairwind Program, at an introductory price of $2 and $10 per million input and output tokens.

For now, most developers can only watch. Security teams should check Fairwind eligibility, scan their own code and get ready for a world where AI finds bugs faster than humans can patch them. More coverage is in ByteMuni's cyber security section.

This is a developing story. Figures are as published by Google, The Hacker News, SecurityWeek, Artificial Analysis and Anthropic on October 28–29, 2026.

Sources

• Gemini 4 Carbon: our next frontier model — Google, Oct 28, 2026

• Google's Gemini 4 Carbon leads benchmarks for finding, exploiting and patching vulnerabilities — The Hacker News, Oct 29, 2026

• Google touts powerful cybersecurity capabilities in Gemini 4 Carbon model — SecurityWeek, Oct 29, 2026

• Gemini 4 Carbon model page — Artificial Analysis

• Fairwind Program — Google DeepMind

• Discovering vulnerabilities with Claude — Anthropic Frontier Red Team, Oct 27, 2026

• Introducing GPT-6.1 Terra — OpenAI

• Google unveils new Gemini 4 Carbon AI model — Deccan Herald

• Gemini 4 Carbon hands-on review and comparison — YouTube