Google DeepMind launches Gemini 4 Carbon: its strongest model yet, built for cyber defense — but almost nobody can use it yet

Google DeepMind has a new flagship, and it arrived barely a month after the last one. On Wednesday, the lab announced Gemini 4 Carbon, which it calls its strongest model yet — a system built for cybersecurity defense and for engineering jobs that run for days rather than minutes.

The catch is familiar: almost nobody can use it yet. Like its predecessor Argon, Carbon is going first to a small group of cyber defenders, with everyone else told to wait for a broader release Google has not dated.

A second flagship in four weeks#

The pace is the first thing to notice. Google announced Gemini 4 Argon on September 30, opened it more broadly on October 13, and has now followed it with Carbon just fifteen days later. The announcement, written by DeepMind senior vice president and chief AI architect Koray Kavukcuoglu, presents Carbon as the next step in the same generation — and as proof that the lab can push the frontier faster while strengthening safeguards in parallel.

What Carbon is not, at least on paper, is a new spec sheet. Google has published no technical report, no parameter count, and no API specification for it, so developers cannot yet tell which of Argon’s documented capabilities carry over unchanged. The claim is one of emphasis: where Argon spread its pitch across engineering, professional research, and security, Carbon sharpens it into two things, sustained agentic work and the full cybersecurity defense lifecycle.

The security numbers — and the asterisk#

Google organizes Carbon’s security results around three stages of defense: finding a real vulnerability, checking whether it can actually be exploited, and producing a fix at the root cause. On its headline benchmarks, Carbon reports 88.2% on SEC-bench Pro for finding flaws buried in real-world software, 54.8% on ExploitGym for exploitation, and 71.0% on CWE-bench for patching. Each is a step up from Argon, which scored 83.4%, 42.0%, and 68.0% on the same three tests — the largest jump coming on exploitation, where the score rose nearly thirteen points.

The internal evidence is pitched even more strongly: Google says Carbon more than doubles Argon’s success rate at generating secure code, that its Chrome team saw Carbon perform more than ten times better than another lab’s large frontier model at producing high-quality patches, and that Wiz observes Carbon leading web penetration-testing benchmarks.

Then the asterisk. Google says the external cybersecurity evaluations were conducted without guardrails, so the headline scores do not establish what customers will get under deployment restrictions. The Chrome comparison names no rival and supplies no underlying results. And none of these numbers have yet been reproduced outside Google.

Built to keep going for days#

The second half of Carbon’s pitch is stamina. Google says its own teams have seen the model run for days, persisting through dead ends to tackle complex, multi-step engineering tasks such as root-causing and patching subtle bugs across large codebases and low-level systems. That is work where a model’s value is not one clever answer but whether it can hold a plan together across hundreds of steps without drifting off course.

The independent headline supports the claim, with a caveat. Artificial Analysis places Carbon first on version 5.0 of its Intelligence Index at 59, ahead of Claude Opus 5.5 at 58, GPT-6 Astra at 57, and Argon at 50. But version 5.0 is a rebuilt suite — roughly 60% private tests or withheld answers — so the new scores should not be mixed with older index results. Within Google’s own table, Carbon improves on Argon in all seventeen reported rows, including Terminal-Bench 4.0 (57.1% to 65.2%), Agents’ Last Exam (69.0% to 77.4%), and an 89-point Elo rise to fourth place on WebDev Arena.

It is not a clean sweep. On FrontierSWE 2, Carbon’s 61.2% trails Astra at 65.5% and Opus at 62.3%; on the OSWorld offline computer-use subset, Opus reaches 87.2% against Carbon’s 81.5%. And on Artificial Analysis’s separate Coding Agent Index, Carbon’s 59 sits behind Claude Code with Opus 5.5 at 62. The picture is a model that leads on the security and long-horizon work it was built for, and merely competes elsewhere.

A quieter, more careful model — on Google’s own tests#

Carbon’s other headline is behavioral. Google says it trained the model to resist the shortcuts that frontier systems learn to exploit: successful cheating on Terminal-Bench 4.0 falls to 0.0%, and on Gray Swan’s indirect prompt-injection benchmark Carbon resists every evaluated attack, improving on Argon’s already low 0.7% attack-success rate. In live coding environments with Google’s own teams, high-severity misalignment alerts fell by almost 80%, unsupported claims roughly halved, and measures of overstepping and under-delivering fell 26% and 29% respectively.

These are Google’s internal measurements, and they deserve to be read that way. A model that fabricates less, asks for clarification instead of guessing, and stays inside its assignment is genuinely more useful as an agent — but the announcement offers no independent replication. Carbon’s behavior in customers’ hands, under real guardrails, is still unmeasured.

What to watch#

The rollout is the story to follow. Starting this week, Carbon goes to a subset of cyber defenders, then gradually to additional trusted partners through the Fairwind Program, while Google says it is engaged in the U.S. government’s voluntary process for pre-release model testing. Developers, businesses, and consumers get access only after Google gathers feedback and iterates on guardrails — “as soon as possible,” with no date attached. Argon took two weeks from announcement to broader availability; whether Carbon matches that pace is the first test of Google’s urgency.

Price, at least, is already set: $2 per million input tokens and $10 per million output tokens at introductory rates, cached input 95% off, rising later to $4 and $20. Unlike Argon, whose higher rates take effect December 1, Carbon has no announced end to its introductory period, which leaves the real long-run price open.

Four things will decide whether Carbon matters beyond its launch-week scores: a general-availability date; an API specification showing what developers actually get; independent reproductions of the cybersecurity benchmarks under real guardrails; and evidence from outside Google that the days-long persistence holds up on other teams’ hardest jobs. Until then, the strongest model Google has ever announced is also one almost nobody has touched.