Google presented Gemini 4 Carbon on October 28, a new AI model intended for complex programming tasks, work carried out across multiple stages and cyber defense. Access begins this week for a limited group of security specialists, with gradual expansion to additional trusted partners through the Fairwind program.
At the time of the announcement, Carbon is at the stage of controlled distribution to cyber defenders. Google is preparing subsequent access for developers, businesses and consumers through its products, after collecting feedback and refining safeguards. The company is also participating in the U.S. government's voluntary process for testing models before release.
Finding vulnerabilities and checking fixes
According to Google, Carbon improves the model's ability to pursue difficult engineering problems, including investigating the causes of bugs and preparing fixes in large software projects. The company reports that its teams have observed runs continuing for several days, in which the model revisits unsuccessful approaches and works through technical tasks involving many steps.
The security evaluations presented cover three distinct activities: finding vulnerabilities, checking exploitability and patching code. Google reports 88.2% on SEC-bench Pro, 54.8% on ExploitGym and 71% on CWE-bench. The company specifies that the listed external evaluations were run without the model's guardrails to measure its technical capabilities.
In the CWE-bench evaluation published by Collinear, Carbon appears with a 71% programmatic score for a single attempt and 81% when four attempts are considered. The tests use the Antigravity harness for this model. The scores describe the results of the evaluated configuration, comprising the model and its agent environment, on the benchmark's tasks.
The current CWE-bench set comprises 120 audit-and-patch tasks covering 73 weakness types. The agent receives an open-source project and instructions to audit and fix it, without the flaws being identified in advance. Programmatic verification checks that the vulnerability is closed and existing functionality remains intact; the public evaluation also separately includes a panel of three agent judges.
Each evaluated configuration completes four runs per task at a high reasoning level. A run has a one-hour limit; when that limit is reached, the code is assessed in its current state. Projects in the set cover C/C++, Go, Java, JavaScript and TypeScript, Python and Rust, so testing spans several software ecosystems.
Web development and sustained programming tasks
Google says it has improved the model for coding, agentic tool use, scientific tasks, full-stack web development and multimodal understanding. In WebDev Arena, the company reports an increase of 89 Elo points and fourth place, with a score of 1,768, at the time of the announcement. That evaluation concerns web development outputs presented within that system.
For secure code generation, Google reports a success rate more than twice that of Gemini 4 Argon in its internal tests. The comparison concerns those company evaluations. Google also mentions Wiz testing the model on web penetration benchmarks, a capability used in the Scan for Good initiative.
Carbon continues the direction of the Argon model introduced earlier in the same month, but initial access is focused on cyber defense. At this stage, its announced use centers on verified partners investigating and repairing software problems as part of the controlled introduction of new capabilities.
Monitoring actions and resisting malicious instructions
The model uses the multilayer safety system built for Argon: training, request screening, misuse defenses and reasoning monitoring. Carbon received additional training for complex situations or those in which pressure to finish a task could encourage shortcuts and departure from the instructions it was given.
On Terminal-Bench 4.0, Google reports a 0.4% rate of attempts to circumvent the evaluation and 0% successful attempts, alongside improved accuracy. In the coding environments used by its teams, alerts concerning serious deviations from the required behavior fell by almost 80%, according to the company's internal observations.
Other internal evaluations indicate an approximately twofold reduction in unsupported claims compared with Argon. Google also reports reductions of 26% in overstepping a task's scope and 29% in leaving it incompletely served. These indicators concern behavior measured in the tests presented by the company, each addressing a distinct objective.
For malicious instructions encountered in content consulted by the agent, Google reports a 0% attack success rate in the Gray Swan Indirect Prompt Injection evaluation, compared with 0.7% for Argon. The result describes the evaluated set of attacks. The protection is intended to prevent a task being diverted by instructions inserted into web pages, documents or code.
Fairwind access and announced pricing
Fairwind prioritizes organizations involved in defending infrastructure and essential services, including public authorities, healthcare providers, telecommunications operators and technology platforms. The program vets applicants and their record of ethical operations. Its rules provide for managed access, individual authentication and measures against redistributing or reselling access to models.
Google announced introductory Carbon pricing of $2 per million input tokens and $10 per million output tokens. Cached input receives a 95% discount against the input price. After the introductory period, announced prices are $4 and $20 respectively for the same volumes. The release to the wider public follows the initial phase with security partners.
