Appearance
What Is Gemini 4 Carbon? Google's Cybersecurity-Focused Frontier Model Explained
Gemini 4 Carbon is Google DeepMind's cybersecurity-focused frontier model, announced on 28 October 2026 — exactly two weeks after Gemini 4 Argon. Google says it ranks first on the Artificial Analysis Intelligence Index v5.0 at 59, and leads 12 of the 14 evaluations in its own comparison table.
That timing matters as much as the scores. Google shipped one frontier model, then another fourteen days later with a different specialisation and a higher headline number — a cadence that shows how fast any "best model" pick expires.
There is a catch: almost nobody can use Carbon yet. Access starts with a subset of cyber defenders and expands slowly through Google's Fairwind Program, with no public date. So the useful question is not how good it is, but what it changes for your work — and what to do this month instead. On Nolvia, the practical answer already sits in the model picker, because Argon and 40+ other models are usable today.
Table of Contents
- What Gemini 4 Carbon Actually Is
- Carbon vs Argon: Specialist Against Generalist
- Gemini 4 Carbon Benchmarks, Row by Row
- Why the Find-Validate-Patch Chain Matters
- Pricing and Who Can Actually Get Access
- What This Means for Security Teams
- What This Means for Model Selection
- Where Carbon Still Falls Short
- FAQs
- Related Articles
What Gemini 4 Carbon Actually Is
Carbon is the second model in the Gemini 4 family. Koray Kavukcuoglu, SVP of Google DeepMind and Google's Chief AI Architect, framed the launch around two claims: state-of-the-art cybersecurity capability and state-of-the-art long-horizon work.
"Long horizon" is the vaguer claim, so it is worth pinning down. Google says its own teams have watched Carbon run for days on multi-step engineering tasks — root-causing subtle bugs across large codebases and low-level systems, then patching them. That is a different profile from a model that answers a prompt well: holding a plan across many tool calls and not abandoning the task halfway. Artificial Analysis lists a 1M-token context window and multimodal input covering text, image, video and speech, with text output.
The alignment numbers are the part most people skim past. Google reports that Carbon cut successful cheating on Terminal-Bench 4.0 to 0.0%, with attempts down to 0.4%, and scores 0.0% attack success on Gray Swan's indirect prompt injection benchmark where Argon managed 0.7%. A model that stays inside scope and admits uncertainty beats one that scores two points higher and invents things — the property to test first when these models reach a workspace like Nolvia.
Carbon vs Argon: Specialist Against Generalist
They are easy to confuse: both arrived together and share a pricing sheet, but target different buyers.
Gemini 4 Argon was positioned as Google's general-purpose technical flagship — strong across software engineering, enterprise domains like legal and financial analysis, and cyber defence. Carbon narrows that. It is built around the defensive security lifecycle and long-running agentic engineering, and the rollout is gated precisely because the capability is dual-use: the same model that proves a vulnerability is exploitable can help write the exploit.
The naming is a hint. Google moved from version numbers to element names, which lets it ship specialised variants of one generation without implying a strict ladder. Argon and Carbon are siblings, not ranks. Argon remains the model you can build on; Carbon previews where the next tier lands.
Our breakdown of what Gemini 4 Argon is and what it changed covers the earlier model's positioning and limits.
Gemini 4 Carbon Benchmarks, Row by Row
Google's evaluation table compares Carbon against Argon, GPT-6 Astra and Claude Opus 5.5 across 14 evaluations. Carbon leads 12 of them. The rows below come directly from that table.
| Benchmark | Gemini 4 Carbon | Gemini 4 Argon | GPT-6 Astra | Claude Opus 5.5 |
|---|---|---|---|---|
| AA Intelligence Index v5.0 | 59 | 50 | 57 | 58 |
| SEC-bench Pro (find vulnerabilities) | 88.2% | 83.4% | 85.4% | n/a |
| ExploitGym (validate exploitability) | 54.8% | 42.0% | 42.4% | 34.5% |
| CWE-bench (patch the root cause) | 71.0% | 68.0% | 68.0% | 67.0% |
| Terminal-Bench 4.0 (AA) | 65.2% | 57.1% | 59.1% | 59.6% |
| FrontierSWE 2 | 61.2% | 55.0% | 65.5% | 62.3% |
| OSWorld-2.1 (offline subset) | 81.5% | 74.7% | 80.9% | 87.2% |
| GraphWalks (256k–1M, BFS F1) | 96.2% | 84.2% | 71.8% | 66.8% |
Read the gaps, not the ranks. Against Argon the improvement is broad, usually five to twelve points, and the biggest jumps land where Google chose to compete: ExploitGym up 12.8 points, GraphWalks up 12. Against the other two labs the picture is messier. Carbon's Intelligence Index lead is 59 versus 58 and 57 — a margin a different harness could erase. GPT-6 Astra is clearly ahead on FrontierSWE 2 at 65.5% against 61.2%, and Claude Opus 5.5 leads the offline OSWorld subset by 5.7 points.
Two caveats matter. Google says the security evaluations ran without guardrails, so the shipped product may behave differently from the tested one. And no independent lab has reproduced these results; they are vendor claims from a table Google assembled. Our explainer on what AI model benchmarks actually measure covers how to read numbers like these, and running one task through two models on Nolvia is the cheapest way to sanity-check a claim yourself.
Artificial Analysis adds a figure Google omits: $7.76 per Intelligence Index task at standard pricing — 23% below Claude Opus 5.5, 20% above GPT-6 Astra. On intelligence per dollar, Carbon is competitive rather than dominant.
Why the Find-Validate-Patch Chain Matters
Most coverage treated 88.2% on SEC-bench Pro as the headline. The more important detail is that Google reports three benchmarks mapping onto three consecutive stages of real defensive work.
Finding. SEC-bench Pro measures whether a model can autonomously surface real vulnerabilities buried in real software, rather than spotting patterns in toy examples. False-positive volume is what breaks security programmes: a scanner returning hundreds of plausible findings nobody can triage trains the team to ignore alerts.
Validating. ExploitGym asks the model to write a working exploit against a real target to prove a finding is genuinely reachable. This step separates a scary-looking code pattern from a fix-this-now ticket. Carbon's 54.8% against Argon's 42.0% is the largest relative gain in the table, and the most consequential for triage.
Patching. CWE-bench, from Collinear, credits a fix only if the original exploit no longer works and existing functionality still passes its tests. Carbon's 71.0% over Argon's 68.0% is modest in absolute terms and still the difference between an AI that files tickets and one that closes them.
Doing all three in sequence is not a smarter scanner; it changes the shape of the work. Vulnerability management is bottlenecked on the middle stage — somebody has to decide which of two hundred findings matter this week — and that judgement is expensive, slow and hard to scale. Automate validation and the queue shortens. Automate patching and the headcount maths changes.
The dual-use problem is real. A model best-in-class at proving exploitability is also best-in-class at building exploits, which is why access is gated, why evaluations ran without guardrails, and why defenders go first. Treat the safety framing as genuine and incomplete at once.
Pricing and Who Can Actually Get Access
Carbon launches at the same introductory rate as Argon: $2 per million input tokens and $10 per million output tokens, with cached input billed at 95% off the input rate. That is a 50% launch discount on the standard $4 / $20 per million. Google has not published an end date, so the number to plan around is $4 / $20.
Availability is the harder constraint. From launch week Carbon goes to a subset of cyber defenders, then gradually to trusted partners through the Fairwind Program. Google says it is participating in the US government's voluntary pre-release testing process and will bring Carbon to developers, businesses and consumers "as soon as possible". No date has been given, and there is no public commercial endpoint today. That pricing describes where Google intends to land, not something you can buy this week.
So build on Argon. It is generally available, shares the pricing structure, and Google's own framing is that Carbon builds on it. Keep prompts, tool definitions and evaluation harnesses portable and the eventual move is closer to a model-name change than a rewrite. Running those workloads through Nolvia has the same effect: switching models is a dropdown, not a procurement cycle.
What This Means for Security Teams
For anyone running product security, vulnerability management or an open-source project, the implications are concrete.
Triage stops being a human-only bottleneck. If validation quality holds up outside Google's harness, "is this exploitable" becomes a first-pass automated check and engineers spend their time on findings that survive it. Bug bounty programmes feel this first, because duplicate and non-reproducible reports are the main cost centre.
Patch velocity becomes the differentiator. Most organisations are decent at finding issues and slow at fixing them. A model that reliably produces root-cause patches against real test suites attacks the actual constraint. The Fairwind Program is the realistic access path for the next few months; if your team does defensive security work, that is the queue worth joining now.
The usual caution applies harder here. Autonomous agents on live codebases need scoped permissions, review gates and an audit trail, and anything involving proprietary source deserves a look at how the platform handles your data — our piece on whether it is safe to put proprietary code into AI aggregators covers the questions to ask. That holds for Nolvia as much as any other platform: the review gate is yours to set.
What This Means for Model Selection
The temptation is to rewrite a roadmap around Carbon. Resist it: a gated preview with vendor-only benchmarks is a signal, not a dependency.
Three things are worth doing instead. Keep a second model in the loop for anything high-stakes, because no model wins every row — Astra leads FrontierSWE 2, Opus 5.5 leads computer use, Carbon leads security and long-context retrieval. Build the habit of switching models per task rather than standardising on one, the pattern our three-way comparison of GPT-6.1 Sol, Claude Sonnet 5.5 and Gemini 4 Argon works through. And keep a cheap fast model for the 80% of work that does not need frontier reasoning — Gemini 3.7 Flash exists for exactly that.
On Nolvia that structure is the default rather than something you assemble. One subscription covers the frontier models and the fast ones, so a security review can start in Argon, get cross-checked in a second model, and finish in whichever produced the better output — without three contracts and three billing cycles. Carbon will be added when Google makes it broadly available; until then, build the workflow and wait for the model.
Where Carbon Still Falls Short
The launch was strong, and the gaps still deserve naming.
It is not the best coding model. GPT-6 Astra beats it on FrontierSWE 2 by 4.3 points, and Artificial Analysis ranks Carbon second on its Coding Agent Index behind Claude Opus 5.5. Google has historically been weaker here, so second is progress rather than failure — but "best model" claims need the qualifier.
Hallucination went up. On AA-Omniscience v1.1, accuracy rose 10 points to 58% while the hallucination rate rose from 4% to 11%. That is still the second-lowest measured, behind Argon, and far below the 50% reported for Claude Opus 5.5 and GPT-6 Astra on the same evaluation. Better recall with more confident errors is a trade-off, not a free win.
Still unverified. Every headline number is Google's, from Google's harness. Normal for launch day, and the biggest reason to wait.
Try Every Major AI Model in One Workspace
Nolvia gives you GPT, Claude, Gemini, Grok and 40+ models in a single subscription — no API keys, no juggling five tabs.
Start Free on Nolvia