Google Gemini 4 Carbon: The Cyber Defence AI You Can’t Use Yet

Direct answer: Google has announced Gemini 4 Carbon, its strongest frontier AI model to date, built to find, validate and fix software security flaws and to stay on track through long, complicated coding jobs. The headline twist is that almost nobody can use it yet: Google is releasing it in stages, starting with a small group of cyber defenders, while developers, businesses and ordinary users wait for a date that has not been given.

What happened

On 28 October 2026, Google DeepMind announced Gemini 4 Carbon in a blog post written by Koray Kavukcuoglu, Google DeepMind’s chief technology officer. The announcement came just two weeks after the wider rollout of Gemini 4 Argon, the previous model in the Gemini 4 family, which had itself been announced on 30 September. That pace is the story in miniature: Google says its researchers and its models are now “working hand in hand” to push the frontier forward faster, and Carbon is the latest evidence of that quickening cadence.

Carbon is not a chatbot upgrade you will find in the Gemini app this week, and it is not a new consumer feature. It is a frontier model, the most capable class of AI system a lab builds, aimed first at the people who defend software rather than at the general public. Google calls it “our strongest model with state-of-the-art cybersecurity and long horizon capabilities”. In plain terms, it is designed for two hard jobs: the full cycle of defensive security work, from spotting a weakness in code to proving it matters and then fixing it at the root cause, and long-running tasks that take hours or even days rather than a single prompt and answer.

The timing matters for another reason. Carbon arrived on the same day Alphabet reported its third-quarter results, in which chief executive Sundar Pichai said the Gemini app had reached one billion users, and a day after Google DeepMind released Genie 4, its model for interactive simulated worlds. It is a busy week for Google’s AI division, and Carbon is its most technically serious release of the three, aimed at engineers and security teams rather than consumers.

What Gemini 4 Carbon actually does

To understand Carbon, it helps to break down the defensive security cycle it is built around, because Google’s pitch is organised around exactly those stages.

First, detection. A modern business runs on a stack of software: a website, a booking system, a payment flow, an app, plus all the libraries and tools underneath them. Flaws hide in that stack. Carbon is trained to read code and find vulnerabilities, the weaknesses an attacker could exploit. Google’s benchmark for this stage is SEC-bench Pro, where Carbon scored 88.2% for finding vulnerabilities, a result Google describes as a firm lead over rivals.

Second, validation, or exploitation. Finding a possible flaw is only half the job. Security teams need to know whether the flaw can actually be abused, and how badly. Carbon is built to test that, safely and in a controlled way, by attempting to exploit the weakness it found. On ExploitGym, the benchmark Google cites for this stage, Carbon scored 54.8%.

Third, patching. Once a flaw is confirmed, it has to be fixed, and fixed properly, at the root cause rather than papered over. This is where many security fixes fail: a patch that stops one symptom while leaving the underlying weakness intact. On CWE-bench, the benchmark for patching, Carbon scored 71.0%. Google also says its Chrome team found Carbon more than ten times better than another lab’s large frontier model at producing high-quality patches, and that on internal benchmarks Carbon generates secure code at more than twice the success rate of Argon.

Running through all three stages is the second headline capability: long-horizon work. Most AI tools are good at short tasks and get worse the longer a job runs, losing track of the goal, repeating themselves, or drifting off course. Google says Carbon is built to persist through dead ends and keep working towards the root cause of a subtle bug, with its own internal teams watching it run for days. That matters for security work, where the interesting flaws are rarely the obvious ones, and for complex engineering jobs generally, where a task can span hundreds of steps.

Google also points to improvements in how the model behaves when it does not know something. On internal testing, Carbon cut unsupported claims by roughly half compared with Argon, stated methodological caveats directly rather than inventing missing evidence, retrieved relevant sources, and surfaced discrepancies to users when facing ambiguity. During multi-step workflows it reduced task overreach by 26% and under-service by 29%. In other words, it is less likely to confidently make things up, and less likely to either do too much or too little when asked to carry out a job. Those are the kinds of reliability gains that matter more in a business setting than a few extra points on a leaderboard, because a confident wrong answer in security work is worse than no answer at all.

The benchmark picture, honestly presented

Benchmarks are the currency of model launches, and Google’s announcement leans heavily on them. They deserve a careful read, because they are a mix of independent rankings, Google’s own tests, and results from labs Google paid or partnered with.

The headline independent result is the Artificial Analysis Intelligence Index, version 5.0, where Google says Carbon ranks first with a score of 59. That puts it ahead of Anthropic’s Claude Opus 5.5 at 58, OpenAI’s GPT-6 Astra at 57, and Argon itself at 50. On the Coding Agent Index from the same evaluator, Carbon scores 59, three points behind Claude Code with Opus 5.5. On WebDev Arena, a leaderboard for full-stack web development, Carbon jumped 89 points to fourth place with a score of 1769 Elo.

The security benchmarks, all reported by Google, are where Carbon’s lead looks widest: 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on ExploitGym for exploitation, and 71.0% on CWE-bench for patching. Google also reports that Carbon resisted every attack in Gray Swan’s indirect prompt-injection benchmark, where hidden instructions planted in content try to steer the model, compared with 0.7% attacker success against Argon, 1% against Claude Opus 5.5, and 8.5% against GPT-6 Astra. Internal testing also showed Carbon cutting high-severity misalignment alerts in live coding work by almost 80%.

It is worth stating the caveats plainly, because Google itself notes some of them. External benchmarks were run without guardrails, which is not how the model will behave in products. Several of the most eye-catching figures, including the ten-times-better patching claim and the doubling of secure-code generation, come from Google’s own teams and internal benchmarks, not independent testing. And independent coverage has noted that Carbon’s lead over rivals is a few points, not a chasm: every frontier model now scores in the same neighbourhood, and Carbon beats Argon by slim margins in most of the tests Google provided. One independent report also noted that Carbon’s rate of hallucinated answers, while still among the lowest measured, rose from 4% for Argon to 11% on one evaluation, a reminder that benchmark suites measure different things and can disagree.

None of that makes Carbon uninteresting. It makes it a model to watch with interest rather than a revolution to buy into on day one, which is convenient, because day one access is not on offer anyway.

Key facts at a glance

Why you cannot use it yet, and why that is deliberate

The staged rollout is the most unusual part of this launch, and Google is unusually open about the reason. A model that is genuinely good at finding and exploiting software flaws is a dual-use tool: the same capability that helps a defender patch a system could help an attacker break into one. Google says Carbon’s strength in agentic coding and cybersecurity requires a “deliberate approach” to release, and that it is actively engaged in the United States government’s voluntary process for pre-release model testing.

The rollout order follows from that logic. Starting this week, Carbon goes to a subset of cyber defenders, the people whose job is to patch the software everyone else relies on. Access then phases out to additional trusted partners through the Fairwind programme, Google’s channel for vetted defenders. Only after further feedback and iteration on guardrails will it reach developers, businesses and consumers through Google’s product surfaces. Ars Technica’s coverage notes that if Carbon follows Argon’s pattern, wider availability could come within a couple of weeks, with AI Ultra subscribers and Gemini API developers likely first, but Google itself has promised nothing, and has not said when Carbon will reach the Gemini app.

There is a second, quieter reason for caution that applies to every frontier launch: the gap between benchmark performance and real-world reliability. Google’s own note that external benchmarks ran without guardrails is a reminder that the model people eventually use will behave differently from the model that topped the rankings. The staged release gives Google time to close that gap, and to learn from defenders using the model on real code before it reaches a much larger audience.

How Carbon compares with its rivals

The frontier race in late 2026 has three main contenders, and Carbon’s announcement is best read as Google’s latest move in it rather than as a standalone event.

Against its own predecessor, Argon, Carbon is an incremental but meaningful step. It builds on Argon, improves full-stack web development, scientific tasks and multimodal understanding based on user feedback, and makes its biggest gains in security and reliability. The pricing is identical, which suggests Google sees Carbon as Argon’s successor rather than a premium tier above it.

Against Anthropic’s Claude Opus 5.5, Carbon edges ahead on the general intelligence index, 59 to 58, but trails on agentic coding, where Claude Code with Opus 5.5 leads the Coding Agent Index by three points. That split matters: Anthropic’s strength is in coding tools used day to day by engineering teams, and its recent results, including an operating profit in the second quarter and very high revenue retention from existing customers, show that strength is commercial as well as technical. Carbon’s security focus is a different bet, aimed at a different buyer.

Against OpenAI’s GPT-6 Astra, Carbon leads on the general index, 59 to 57, and on most security measures, but Astra stays ahead on some coding benchmarks, including FrontierSWE 2, where it scores 65.5% against Carbon’s 61.2%. OpenAI’s model is also the one most ordinary users will actually meet first, since it ships in products people already use, while Carbon remains behind a velvet rope.

The honest summary is that the frontier has compressed. The top models are separated by a handful of points, each leads on some benchmarks and trails on others, and the practical differences for most businesses will come down to price, availability, integration with tools they already use, and reliability on their specific work, not to a single leaderboard number.

What it means for UK small businesses

If you run a small business in the UK, Gemini 4 Carbon will not change your week. You cannot buy it, install it, or switch it on. But the launch still carries several practical implications, and they are worth working through now, while the model is still behind its staged rollout, rather than later, when its capabilities arrive in products you already use.

First, the security bar is about to rise, and that affects you whether or not you ever touch Carbon. When the best models get much better at finding flaws, the flaws in unpatched software get found faster, by defenders and by attackers alike. The single most valuable response has not changed in years, but it has become more urgent: keep your software, plugins, and systems updated, retire tools that no longer receive security patches, and make sure someone, whether an employee or a supplier, actually owns patching. A small business that patches promptly is a harder target than one that does not, and that gap widens as automated flaw-finding improves.

Second, ask your IT supplier or web developer a direct question: how is AI-assisted code review used on your systems, and who checks its output? Carbon’s pitch is that AI can now do a credible job across the whole defence cycle, and that capability will filter into the tools your suppliers use, from code review to vulnerability scanning. That is good news, provided a human still reviews what the model produces. The model’s own reported improvements, fewer unsupported claims, fewer misaligned actions, better handling of ambiguity, are encouraging, but they are not a substitute for human oversight, especially when a patch touches a payment flow or customer data.

Third, think about your own software supply chain. If your business depends on a booking platform, an e-commerce plugin, or a bespoke tool built by an agency, the security of that software is partly your risk. When you renew a contract or commission new work, it is reasonable to ask what secure coding practices the supplier follows, how quickly they ship security patches, and whether they test their code with modern AI-assisted tools. You do not need to name Carbon to ask those questions; the launch simply makes them more timely.

Fourth, do not let a model launch distract from the basics that actually cause most small-business breaches. The majority of incidents still start with phishing, reused passwords, unpatched systems, and overly broad access, not with exotic zero-day flaws. Multi-factor authentication on email and admin accounts, unique passwords managed properly, regular backups that you have actually tested restoring, and least-privilege access for staff and contractors will protect you more than any frontier model announcement. Carbon is a story about the future of defence; those basics are the defence you have today.

Fifth, watch the price. When Carbon does reach developers, its introductory $2 and $10 per million tokens, doubling later, will set a reference point for what high-end AI-assisted security work costs. For a small business buying through a supplier rather than directly, the token price matters less than the supplier’s fee, but it is a useful anchor: if a vendor quotes a large premium for “AI security” features, you can ask what model and what volume sits behind the price.

Finally, keep an eye on the UK angle. Google’s rollout is framed around a US government voluntary testing process and a defender programme, with no UK-specific detail yet. UK businesses should watch for announcements from the UK’s own AI and cyber institutions, and for whether UK defenders and researchers get access through similar channels. The UK government has previously invested in AI safety and cyber defence capacity, and a model of this kind will eventually feature in that conversation. For now, the practical UK implication is the same as everywhere else: patch promptly, and ask better questions of your suppliers.

Honest limits / what to watch

Several things about this launch deserve scepticism, and a careful reader should hold them in mind alongside Google’s claims.

The benchmarks are mostly Google’s. The independent ranking from Artificial Analysis is genuinely useful, but many of the security figures come from Google’s own testing or from evaluations Google commissioned. Independent researchers have not yet had broad access to Carbon, because broad access does not exist yet. Until they do, the numbers are claims to test, not settled facts.

The margins are slim. Carbon beats Argon and its rivals by a few points on most tests. That is consistent with a field where the top models have converged, and it means switching models for a few benchmark points is rarely worth the disruption. What matters more is reliability on real work, and that can only be judged once the model is widely used.

The hallucination picture is mixed. Google reports that Carbon roughly halves unsupported claims compared with Argon on internal tests, yet at least one independent evaluation recorded a higher hallucination rate for Carbon than for Argon. Different tests measure different things, and both findings can be true, but the contradiction is a reason to wait for broader testing before trusting the model with anything where a wrong answer is costly.

Access is genuinely uncertain. Google has given no date for general availability, no end date for introductory pricing, and no detail on which products Carbon will reach first beyond the staged plan. If your planning depends on Carbon specifically, you are planning around a date that does not exist. Plan around the capability, secure coding assistance and AI-assisted defence, not the model name.

The dual-use question is real and unresolved. A model this good at finding flaws will eventually be available to attackers as well as defenders, whether Carbon itself or a rival’s equivalent. That is not a reason to panic, but it is a reason to treat patching speed as a competitive advantage rather than an administrative chore. The defenders-first rollout is designed to give the good side a head start; use that head start.

What to watch, in order: first, the first independent evaluations once researchers beyond the defender group get access; second, any announcement of a general availability date or a Gemini API release; third, whether UK cyber and AI bodies comment on or gain access to the model; fourth, what happens to Argon’s introductory pricing at the end of November, since that will hint at Carbon’s pricing timeline; and fifth, whether rival labs answer with security-focused models of their own, which would confirm that defensive AI has become the new front in the model race.

FAQs

What is Google Gemini 4 Carbon?

Gemini 4 Carbon is Google DeepMind’s newest frontier AI model, announced on 28 October 2026. Google describes it as its strongest model so far, with state-of-the-art ability in cybersecurity work and in long, multi-step coding and agentic tasks.

Can I use Gemini 4 Carbon today?

Almost certainly not yet. Google is releasing Carbon in stages, starting with a subset of cyber defenders through its Fairwind programme, then trusted partners. Developers, businesses and consumers will get access later, but Google has given no date.

How much will Gemini 4 Carbon cost?

Google has set an introductory price of $2 per million input tokens and $10 per million output tokens, with cached input tokens at 95% off. That price doubles to $4 and $20 once the introductory period ends, though Google has not said when that happens for Carbon.

Is Gemini 4 Carbon better than Gemini 4 Argon?

On Google’s own numbers, yes, but by modest margins in most tests. The clearest gains are in cybersecurity: Google says Carbon generates vulnerability-free code at more than twice Argon’s success rate and leads on finding, exploiting and patching security flaws.

What should a UK small business do about Gemini 4 Carbon?

Nothing urgent. You cannot buy it yet, and it is not a product you install. The practical move is to tighten the basics it is built to defend: keep software patched, use supported tools, and ask your IT supplier how AI-assisted code review fits your current setup.

Will Gemini 4 Carbon replace human security experts?

No, and Google does not claim it will. Carbon is built to help defenders find and fix flaws faster, but the judgement calls, deciding what a flaw means for a particular business, what to fix first, and whether a patch is safe to deploy, still need experienced people. The realistic near-term effect is that security teams get a faster, more thorough assistant, not a replacement.

Sources and further reading

• Google DeepMind’s announcement, “Introducing Gemini 4 Carbon”, blog.google, 28 October 2026: https://blog.google/innovation-and-ai/models-and-research/gemini-models/introducing-gemini-4-carbon/
• Ars Technica, “Google announces Gemini 4 Carbon, its latest frontier AI model that you can’t use”, 28 October 2026: https://arstechnica.com/ai/2026/10/google-announces-gemini-4-carbon-its-latest-frontier-ai-model-that-you-cant-use/
• Reuters, “Google launches Gemini 4 Carbon AI model with cybersecurity focus”, 28 October 2026, via KTWB: https://ktwb.com/2026/10/28/google-launches-gemini-4-carbon-ai-model-with-cybersecurity-focus/
• For context on the previous model, see our earlier coverage: https://weblifyai.co.uk/gemini-4-argon-rollout/
• And for how Gemini compares with ChatGPT for smaller firms: https://weblifyai.co.uk/chatgpt-vs-gemini-small-business-uk/

CTA: Get a Free AI Consultation