Google Introduces Gemini 4 Carbon With Major Advances in Cybersecurity and AI Coding
 |
| Image: Google |
Google has announced Gemini 4 Carbon, its latest frontier artificial intelligence model, with a focus on advanced cybersecurity, software engineering and complex tasks that require sustained reasoning over extended periods. The model represents another step in Google's effort to develop AI systems capable of handling more demanding technical work, including identifying software vulnerabilities, validating security risks and helping engineers implement fixes.
Announced on October 28, 2026, Gemini 4 Carbon follows the introduction of Gemini 4 Argon earlier in the month. Google describes Carbon as its strongest model and says it delivers improvements across coding, agent-based workflows, scientific tasks, full-stack web development and multimodal understanding.
One of the announcement's central points is the model's cybersecurity performance. Google reports strong results across several security evaluations, including tests for discovering vulnerabilities, determining whether they can be exploited and developing patches. The company is also highlighting improvements in secure code generation and the model's ability to work through complicated engineering problems.
However, Gemini 4 Carbon is not immediately available to everyone. Google is beginning with a limited rollout to selected cybersecurity defenders before gradually expanding access to additional trusted partners.
A New Frontier Model Focused on Complex Engineering
Gemini 4 Carbon is designed for tasks that require more than producing a short answer or completing a single coding request. Google says the model can work through long-running engineering problems, including investigating subtle bugs across large codebases, identifying their underlying causes and developing software patches.
These tasks can involve multiple stages. An AI system may need to examine a large amount of code, understand how different components interact, identify the source of a problem, test possible solutions and revise its approach when an initial attempt fails.
Google says its internal teams have observed Carbon working on difficult engineering tasks for days, continuing through dead ends rather than stopping after an unsuccessful attempt.
This approach reflects the broader development of AI agents. Instead of simply responding to individual prompts, agent-based systems are intended to carry out sequences of actions toward a defined objective. In software development, that can mean investigating a problem, editing files, running tests and refining a solution.
The practical value of such capabilities will depend on how reliably the model performs in real development environments, particularly when working with unfamiliar codebases and systems where mistakes can have significant consequences.
Gemini 4 Carbon's Cybersecurity Capabilities
Cybersecurity is one of the main areas Google is emphasizing with Gemini 4 Carbon. The company says the model delivers improvements across three important stages of defensive security work: discovering vulnerabilities, validating whether those vulnerabilities can be exploited and fixing the underlying problems.
Finding a potential weakness is only part of the process. Security teams must also determine whether it creates a genuine risk, understand how it could affect a system and identify an effective way to resolve it.
Google reports that Carbon achieved the following results across three cybersecurity evaluations:
| Evaluation | What it measures | Google's reported result |
|---|---|---|
| SEC-bench Pro | Finding real-world software vulnerabilities | 88.2% |
| ExploitGym | Validating vulnerabilities through exploitation | 54.8% |
| CWE-bench | Developing fixes for software weaknesses | 71.0% |
Google says these results establish state-of-the-art performance on the respective evaluations. The company also notes that the external cybersecurity benchmarks were conducted without guardrails, an important qualification when interpreting the results.
The scores demonstrate performance on specific testing tasks. They should not be treated as a guarantee that Carbon can identify every vulnerability, prevent cyberattacks or independently secure an entire software environment.
Improved Secure Code Generation
Google also reports a substantial improvement in Carbon's ability to generate secure code.
According to the company, Carbon achieved more than twice the success rate of Gemini 4 Argon on its internal benchmarks for generating secure code. Google's Chrome team also reported that Carbon performed more than 10 times better than an unnamed competing frontier model when generating high-quality patches.
These comparisons come from Google's internal testing and should be understood in that context. The company has not identified the competing model in the Chrome comparison.
If the improvements translate into practical development work, AI systems could become more useful for helping engineering teams review code, investigate security issues and address vulnerabilities earlier in the software development process.
Improvements in Coding and AI Agent Workflows
Beyond cybersecurity, Gemini 4 Carbon is intended to improve performance across several technical and knowledge-based tasks.
Google says it has worked on coding, agentic tasks, scientific work, full-stack web development and multimodal understanding. These areas increasingly overlap as AI systems are used to interpret information, write code, operate software tools and produce complete digital outputs.
For web development, Google reports that Carbon gained 89 Elo points on WebDev Arena, reaching fourth place with a score of 1,768.
WebDev Arena evaluates web-development outputs through human preferences. Its ranking therefore provides a different perspective from traditional coding tests, which generally assess whether a model can complete a predefined programming task.
The improvement suggests that Google is targeting not only the ability to generate code but also the quality of the resulting web-development work.
For developers, the larger question is how consistently the model can handle complete projects. Generating an individual component is different from understanding an existing application, coordinating changes across multiple files and producing a working result.
Google's emphasis on long-running tasks suggests that Carbon is intended to address more of these demanding workflows.
Google Reports Improvements in AI Safety and Reliability
As AI models become more capable of carrying out multi-step actions, their reliability and ability to follow instructions become increasingly important.
A model that can operate for extended periods must do more than produce technically correct output. It also needs to respect the limits of a task, avoid taking unintended actions and communicate clearly when information is missing or an action cannot be completed.
Google says Gemini 4 Carbon builds on the multi-layered safety and security approach introduced with Argon. This includes model training, real-time protections against misuse, prompt-injection resistance and chain-of-thought monitoring.
The company also reports several improvements from its internal evaluations.
According to Google, Carbon reduced successful cheating on Terminal-Bench 4.0 to 0.0%, while attempted cheating fell to 0.4%. Google also observed an almost 80% reduction in high-severity misalignment alerts in its live coding environments.
The company reports that Carbon reduced overreach in multi-step plans by 26% and under-service by 29%. These measures relate to how the model handles tasks without exceeding its intended scope or failing to provide the requested assistance.
Google also says Carbon achieved a 0.0% attack success rate on the Gray Swan indirect prompt-injection benchmark, compared with 0.7% for Argon.
These figures are based on Google's reported evaluations and should not be interpreted as proof that the model is immune to prompt injection or other security risks. Real-world deployments involve different tools, data and operating conditions, making continued testing important.
Gemini 4 Carbon Availability: Cyber Defenders First
Despite the announcement, Gemini 4 Carbon is not being released immediately to the general public.
Google is starting access with a subset of cybersecurity defenders through its Fairwind Program. The company plans to gradually extend access to additional trusted partners while collecting feedback and continuing to refine the model's safeguards.
Developers, businesses and consumers are expected to receive access through Google's product offerings at a later stage. However, Google has not provided a confirmed date for general availability.
This staged approach is particularly relevant because of the model's cybersecurity capabilities. AI systems that can identify vulnerabilities and validate exploitation scenarios can be useful for defensive security teams, but the same capabilities also require careful evaluation and safeguards.
By initially limiting access, Google can gather feedback from selected users and assess how the model performs in security-focused environments before expanding its reach.
For developers and businesses waiting to test Carbon, the announcement provides an indication of Google's direction, but it does not yet offer a generally available model to integrate into everyday workflows.
Gemini 4 Carbon Pricing
Google says Gemini 4 Carbon will launch with the same introductory Gemini API pricing as Gemini 4 Argon.
| API usage | Introductory price |
|---|---|
| Input tokens | $2 per 1 million tokens |
| Output tokens | $10 per 1 million tokens |
| Cached input tokens | 95% below the input-token price |
The introductory pricing will not remain permanent. Google states that after the introductory period, the price will increase to $4 per million input tokens and $20 per million output tokens.
The company has not specified in its announcement when Carbon's introductory pricing period will end.
These prices relate to API usage rather than a confirmed consumer subscription price. Google has not yet detailed which consumer or business plans will include Gemini 4 Carbon when wider access begins.
What Gemini 4 Carbon Means for Google's AI Strategy
The announcement of Gemini 4 Carbon comes as competition among major AI developers increasingly extends beyond general-purpose chatbots.
Companies are working to build models that can perform more complicated tasks, assist with software development, operate tools and contribute to specialized technical workflows. Cybersecurity is becoming an important part of this competition because AI can potentially help security professionals examine software at a scale and speed that would otherwise require substantial human effort.
Carbon's reported results show Google's interest in combining advanced coding capabilities with security-focused reasoning and longer-running agent workflows.
However, benchmark performance alone does not establish how a model will perform in every professional environment. Its usefulness will ultimately depend on reliability, access to appropriate tools, the quality of its output and how effectively its safeguards work outside controlled evaluations.
For now, Gemini 4 Carbon is an important announcement for Google's AI development, but its limited initial rollout means most developers and businesses will have to wait before evaluating it directly.
The Bigger Picture
Gemini 4 Carbon places cybersecurity and complex engineering tasks at the centre of Google's latest AI announcement. Its reported results across vulnerability discovery, exploitation testing and software patching indicate that Google is working to make its models more useful for specialized technical work.
The model also highlights the growing importance of AI agents capable of handling extended workflows rather than responding only to individual prompts.
Whether Carbon's reported improvements translate into a meaningful advantage for developers and security teams will become clearer as access expands and more independent evaluations become available. For now, Google's announcement offers an early look at a model designed to move beyond conventional chatbot interactions and take on more demanding engineering and cybersecurity work.
