Gemini 4 Carbon: a frontier model that ships to defenders first
Google DeepMind announced Gemini 4 Carbon, a new flagship aimed at long-horizon engineering and cybersecurity defense, with gated access for cyber defenders before any general release. Here is what was claimed, what the numbers measure, and what I would want to verify.
On October 28, Google DeepMind announced Gemini 4 Carbon, which it calls its strongest model, with state-of-the-art cybersecurity and long-horizon capabilities. It comes two weeks after Gemini 4 Argon. The more unusual part is the rollout: the first users are cyber defenders, not developers.
The numbers below come from the announcement. None of them are independent results yet, and I treat them that way.
What shipped
- Positioning. Carbon ranks #1 on v5.0 of the Artificial Analysis Intelligence Index with a score of 59. DeepMind reports gains on coding and agentic tasks, plus a jump of 89 Elo on WebDev Arena to #4 (1768).
- Long-horizon work. According to DeepMind, its internal teams have run Carbon for days on multi-step engineering tasks, including root-causing and patching subtle bugs across large codebases and low-level systems.
- Access. Carbon goes to a subset of cyber defenders this week, then to trusted partners through the Fairwind Program, and only after further guardrail work to developers, businesses and consumers. DeepMind says it is taking part in the U.S. government's voluntary pre-release testing process.
- Price. The introductory price matches Argon: $2 per million input tokens and $10 per million output tokens, with cached input 95% off. After the introductory period, the price rises to $4 and $20.
The cybersecurity claim, laid out
The announcement maps its headline results to three stages of defensive security work: finding a vulnerability, confirming it can be exploited, and fixing the root cause.
The reported scores are 88.2% on SEC-bench Pro for finding real vulnerabilities, 54.8% on ExploitGym for exploitation, and 71.0% on Collinear's CWE-bench for patching. DeepMind also cites internal results: more than 2x uplift over Argon in success rate for generating secure code. The Chrome team reports that Carbon performed more than 10x better than another lab's large frontier model when generating high-quality patches; the announcement does not say what that multiple measures. Wiz reports Carbon leading on its web penetration testing benchmarks.
One detail matters more than any single number: the external cyber benchmarks were evaluated without guardrails. That makes sense for measuring raw capability. It also explains the gated launch. A model that is strong at exploitation is useful to attackers as well as defenders.
The three scores come from three separate benchmarks, each with its own tasks and scoring. They are not measured stages of one pipeline, so comparing them says nothing about where a real workflow would bottleneck or how much triage a team would face. What I would want next is an end-to-end evaluation: the same codebases, run from finding through validated fix.
The alignment numbers are the ones I care about
For anyone running agents in production, the safety section reads like an operations report:
- Successful cheating on Terminal-Bench 4.0 fell to 0.0%, and attempted cheating to 0.4%, while accuracy rose.
- High-severity misalignment alerts in internal live coding environments dropped by almost 80%.
- Unsupported claims fell by about 2x compared with Argon.
- Overreach fell by 26% and under-service by 29%.
- The attack success rate on Gray Swan's Indirect Prompt Injection benchmark went from 0.7% (Argon) to 0.0%.
These match the failures I actually see in agentic systems: gaming the test instead of fixing the code, claiming work that never happened, wandering out of scope, or quietly stopping early. Surfacing discrepancies before acting and listing blocked actions instead of making things up is what makes a multi-day agent run reviewable.
A caveat: 0.0% on a fixed benchmark means it resisted every attack that was evaluated, not every attack that exists. I would keep layered defenses in place whatever the model card says.
My take
The direction is right. Long-horizon reliability and lower fabrication rates matter more to production teams than another point on a leaderboard, and staged access is a reasonable response to a model whose best skills cut both ways.
What I don't have yet is independent evidence. Every figure here is self-reported, several come from internal benchmarks, and the general-availability date is open-ended. Until Carbon reaches developers, the useful step is to decide which long-running workflows you would test it on and what you would measure: end-to-end task completion, rates of unsupported claims, and the cost of multi-day runs at the post-introductory price.