Google Says Gemini 4 Carbon Tops the Charts but Only Cyber Defenders Can Use It

Google has a new frontier model, and you cannot have it. Gemini 4 Carbon landed on Wednesday, just two weeks after its predecessor Gemini 4 Argon, and Google is handing it first to a hand-picked group of cybersecurity defenders instead of developers or the public.

The reason is the pitch. Google says Carbon is unusually good at finding software flaws, proving they can be exploited and writing the patch. That is a gift to defenders and, on paper, a tempting toolkit for attackers. So the gatekeeping is the story as much as the model.

Google grades its own homework

Nearly every number here comes from Google. In its launch post, Google says Carbon ranks first on version 5.0 of the Artificial Analysis Intelligence Index with a score of 59. It also claims a "firm lead" on three security tests: 88.2 percent on SEC-bench Pro for finding vulnerabilities, 54.8 percent on ExploitGym for exploitation and 71.0 percent on CWE-bench for patching. Google notes those external benchmarks were run without guardrails.

Google adds that its own tests show Carbon is more than twice as likely as Argon to generate secure code. It also says its Chrome team found Carbon more than 10 times better than another lab’s model at producing high quality patches. Google names no rival, so treat that as a company claim.

Outside coverage adds some cold water. Ars Technica reports that Carbon beats Argon "by slim margins in every test Google has given it" and that the gap to GPT-6 Astra and Claude Opus 5.5 is only a few points, with every frontier model scoring in the same neighborhood. The Verge confirms the top Artificial Analysis spot, with Opus 5.5 and Astra trailing. Neither outlet has independently verified Google’s security numbers.

"We’re taking a deliberate approach to rollout" Koray Kavukcuoglu, Google DeepMind chief AI architect, in the launch post

Deliberate is the word of the week. Google says it is taking part in the US government’s voluntary pre-release testing process and will make Carbon available "to a subset of cyber defenders" this week. It will then phase in more trusted partners through its Fairwind Program. Only after that does it plan to open Carbon to developers, businesses and consumers "as soon as possible." No date is given for any of it.

Ars Technica raises a fair question. Google presents Carbon as a distinct model, but the outlet writes that "for all we know, it could be a post-training upgrade of Argon." That is Ars speculation, not something Google has said, and Google has not described how Carbon was built. A new frontier name two weeks after the last one does invite the question.

The safety claims deserve the same caution. Google says Carbon resisted every attack in the Gray Swan prompt injection benchmark, a 0.0 percent success rate against 0.7 percent for Argon. Ars adds Google’s figures for Opus 5.5 at 1 percent and GPT-6 Astra at 8.5 percent. Google also says it cut unsupported claims by roughly half versus Argon. All of that is Google testing Google, and a perfect score on one benchmark says little about what clever attackers will try next.

Developers who eventually get access will see an introductory price of $2 per million input tokens and $10 per million output tokens, the same as Argon, with cached input tokens at 95 percent off. Google says the price rises to $4 and $20 once the introductory period ends. It has not said when that is, and Ars reports Google declined to give an end date when asked.

For now Carbon is a claim, not a product you can test. If the cyber results hold up outside Google’s own labs, a model that can find and fix flaws for days on end will matter a great deal. Until independent researchers get their hands on it, the most honest read is that Google built something it believes is powerful enough to keep on a leash, and wants you to trust that judgment.