Gemini 4 Carbon: Our next frontier model

Google DeepMind announced Gemini 4 Carbon, two weeks after Gemini 4 Argon, and called it its strongest model. Google says it ranks first on the Artificial Analysis Intelligence Index v5.0 with a score of 59, and leads on three cyber benchmarks: 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on ExploitGym for exploitation, and 71.0% on CWE-bench for patching.

Carbon is not broadly available yet. Google is giving it first to a subset of cyber defenders, then trusted partners through its Fairwind Program, while participating in the U.S. government's voluntary pre-release testing process. Developers, businesses and consumers come later.

We want to give Google credit where it is due. A model that can find a bug, prove it is exploitable, and write the fix is exactly what overstretched security teams need. Google says Chrome's team found Carbon more than 10 times better than another lab's large frontier model at producing high-quality patches, and that internal tests show more than double the success rate at writing secure code compared with Argon. If that holds up outside Google, defenders get a genuine edge.

The flip side is right there in the benchmark list. Exploitation is an offensive skill. Google notes these external benchmarks were run without guardrails, which is the honest way to measure raw capability, and also a reminder of what the model can do if those guardrails fail or get bypassed. That is why the staged rollout is the most important part of this announcement. Defenders first is the right order. Our question is how long that window lasts and how Google decides who counts as trusted.

The safety claims are notable and deserve outside scrutiny. Google says Carbon cut successful cheating on Terminal-Bench 4.0 to zero, reduced high-severity misalignment alerts in internal coding by almost 80%, roughly halved unsupported claims versus Argon, and resisted every attack in Gray Swan's indirect prompt injection benchmark. Those are self-reported numbers. Zero on a benchmark is not zero in the wild, and prompt injection in particular has a long history of new attacks beating old tests.

The pace is the other thing I'm watching. Two frontier releases in two weeks, with Google saying its researchers and models are working together to move faster. Speed is good for users. It also compresses the time for independent testers, regulators, and the security community to catch up.

Our read: this looks like a serious defensive tool released with more care than usual. The test is whether the gates hold when commercial pressure to open it up arrives.

Carbon builds on Argon's safety stack, which Google describes as model training, real-time misuse defenses, prompt-injection resilience and chain-of-thought monitoring. Google says Carbon can run for days on long, multi-step engineering tasks such as tracing and patching subtle bugs in large codebases. It also jumped 89 Elo points to fourth place on WebDev Arena.

Introductory pricing matches Argon at $2 per million input tokens and $10 per million output tokens, rising to $4 and $20 after the introductory period.