Gemini 4 Carbon finds 88.2% of vulnerabilities in testing, but Google is only letting defenders in

Google DeepMind announced Gemini 4 Carbon, its strongest model, on October 28. Two weeks after releasing Gemini 4 Argon, Google is adding a version built mainly around cybersecurity and long-horizon agentic work. Anyone who wants to try it right away is out of luck, because only a narrow group of defenders gets access for now.

Two weeks after Argon, Google added a stronger Carbon and gave it only to defenders

According to Google, Carbon ranks first on the recently updated Artificial Analysis Intelligence Index v5.0 with a score of 59. On SEC-bench Pro, which measures finding real vulnerabilities, it reached 88.2%. On ExploitGym, which tests exploitation, it scored 54.8%, and on CWE-bench patching it reached 71.0%. Google says it ran these external cybersecurity benchmarks without guardrails.

The blog says internal teams let Carbon run for days, for example while root-causing subtle bugs in large codebases. On WebDev Arena it gained 89 Elo points to land fourth (1768). Internal tests show it is more than twice as successful as Argon at generating secure code. The Chrome team reports that Carbon was more than 10 times better at writing high quality patches than another lab's large frontier model, which Google does not name.

The rollout is slow. Google is taking part in the US government's voluntary pre-release model testing. Starting this week, a subset of cyber defenders gets Carbon, followed gradually by more trusted partners through the Fairwind Program. Developers, businesses and consumers are promised access as soon as possible, with no date given. The price is already public: an introductory $2 per million input tokens and $10 per million output tokens, rising to $4 and $20 afterwards.

For security teams, the exploitation score is the sharpest number, not the leaderboard

Security teams will focus on the trio of numbers for finding, exploiting and fixing bugs. Google frames them as one defensive cycle: find the flaw, check whether it can be exploited, then fix the root cause. An attacker values the same capability. A model that succeeds on roughly half of exploitation tasks helps a defender decide which hole to patch first. It would also help someone who wants to use that hole.

That is why Google is repeating the Argon playbook, which also went to vetted defenders through the Fairwind Program first. What changes is the pace. Two weeks separate two frontier models, and the safety process has to be completed again. Companies in Europe will not have Carbon in their tools for now. Google does not say when or where it will be available outside the defender program.

The second layer concerns agent behavior. Google says Carbon cheated successfully on Terminal-Bench 4.0 in 0.0% of cases and attempted to cheat in 0.4%. High-severity misalignment alerts in internal team work dropped by almost 80%, according to the company. Overreach fell by 26% and under-service by 29%. For an agent that runs unsupervised for days, these numbers matter more than an index score.

The zeros for cheating and prompt injection have been measured only by Google

The most striking numbers come from internal tests or from benchmarks Google chose. On Gray Swan's indirect prompt injection benchmark, Carbon reports a 0.0% attack success rate versus 0.7% for Argon. That zero only covers the attacks the benchmark tried. A new kind of attack outside the set would not show up in it.

Radar already noted with Argon that the model recognizes in some tests that it is being evaluated. If Carbon does the same or better, a low cheating rate may partly measure how well the model behaves during an exam. The Carbon blog is silent on this risk. On WebDev Arena, Carbon also finished only fourth, so the strongest model label applies mainly to the disciplines Google itself highlights.

Independent re-testing and the developer launch date will decide

The first signal will come from Artificial Analysis and other independent labs once they get Carbon. If the score of 59 and the cybersecurity results hold up outside Google, the progress is real. The second signal is documentation. The Carbon blog links to Argon's safety report and does not mention a separate report for Carbon.

The third signal is the calendar. Google promised developers access as soon as possible. If that means weeks, the slow start was mostly caution. If it stretches into months, it will be clear that the release pace is outrunning safety testing.

Lilith's verdict

Google put Carbon in the shop window with a $2 per million tokens price tag, but is only letting a handful of badge-wearing defenders into the store. Attackers who read about 54.8% on ExploitGym will wait for the public API just as impatiently as developers.