Gemini 4 Carbon: Google's Cybersecurity AI Model Explained

Short answer: Gemini 4 Carbon is a new Google AI model announced on October 28, 2026. Google calls it its strongest model, with a focus on cybersecurity (finding, confirming and fixing software flaws) and long, multi-step coding tasks. It is not open to the public yet: only selected cyber defenders get access first.

The key facts at a glance

• Announced: October 28, 2026, on Google's blog
• Focus: cybersecurity defense and long-running coding work
• Access: a subset of cyber defenders first, then trusted partners through the Fairwind Program
• Public release: "soon," with no date given
• Launch price: $2 per million input tokens, $10 per million output tokens (introductory)

A "token" is a small chunk of text, roughly three quarters of a word. AI services charge per million tokens sent in and generated.

What Google says Carbon can do

Google reported these results on security tests. Each test measures one step of handling a vulnerability (a flaw an attacker could abuse).

Test	What it measures	Carbon's reported score
SEC-bench Pro	Finding vulnerabilities	88.2%
ExploitGym	Proving a flaw can be exploited	54.8%
CWE-bench	Writing a correct patch	71.0%

Google also said its Chrome team found Carbon did more than 10 times better than "another lab's large frontier model" at writing high-quality patches. The other model was not named.

Two caveats matter. These are Google's own reported numbers, and Google says the outside security tests were run "without guardrails," meaning without the safety filters users would normally have. Real-world results on your software may differ.

Who can use it, and when

Google says it is starting with "a subset of cyber defenders" and will "gradually phase access to additional trusted partners through our Fairwind Program." It has not published how organizations are chosen.

For everyone else, Google says it is gathering feedback and refining guardrails before releasing Carbon to developers, businesses and consumers. No date and no specific product (such as the Gemini app or API) was named.

Where sources disagree

• Gap since Gemini 4 Argon: Google's blog says Argon launched "two weeks ago." The Hacker News says Carbon arrived "less than a week" after Argon. Google's own post is the primary source.
• Rankings against rival models: The Hacker News lists scores for other companies' models on an independent leaderboard. Those comparisons are not in Google's post, so check the leaderboard yourself before repeating them.

What this means for website owners

Step 1: assume flaws are found faster now

Models like Carbon are built to find bugs at scale. Defenders get them first, but attackers use AI too. The window between a flaw becoming known and being exploited keeps shrinking, as the PHP2Shell vulnerability showed this month.

Step 2: keep your software updated

Update your CMS, plugins, PHP version and server software as soon as security releases come out. This is the single most effective defense, whatever tools attackers use.

Step 3: watch vendor advisories, not headlines

Follow the security pages of the software you run. A model announcement does not change what you need to patch today.

Step 4: be careful with "AI security scan" offers

If someone offers you a scan "powered by Gemini 4 Carbon," be skeptical. Access is limited to selected partners right now.

Common mistakes

• Thinking Carbon is available in the Gemini app today. It is not.
• Quoting the introductory price as permanent. Google says it rises to $4 and $20 per million tokens later.
• Treating Google's benchmark numbers as independent results.
• Assuming an AI model will fix your site for you. Patching is still your job or your host's.