What Google announced about Gemini 4 Carbon
Google announced Gemini 4 Carbon on October 28, 2026, presenting it as a frontier model focused on coding, long-running tasks and cybersecurity. Its most concrete proposition is to cover several stages of software defense: finding vulnerabilities, assessing whether they can be exploited, and generating patches. These capabilities and the associated results are claims made by Google, not an independent verification of the model.
The distinction between these stages matters. Detecting a possible flaw does not prove that it can be exploited in real-world conditions; confirming exploitability does not prove that a patch fixes the root cause without introducing other problems. The tests Google cites measure different tasks, so their scores should not be combined as if they formed a single measure of security or quality.
What the cited cybersecurity tests measure
Google reports a score of 88.2% on SEC-bench Pro for vulnerability detection, 54.8% on ExploitGym for exploitation, and 71.0% on CWE-bench for remediation. The company describes these as external evaluations and says they were conducted without the model’s safeguards. The results therefore do not necessarily describe how a commercial version will behave with its protections enabled, or what users will be able to do with it.
These are scores on specific tests, not a general cybersecurity success rate. The information available here does not provide enough detail to reconstruct every evaluation condition, independently compare the results, or estimate performance across arbitrary codebases. Google’s stated CWE-bench figure is 71.0%; it should not be replaced with a different figure reported elsewhere.
Three tasks, three distinct results
The figures are results reported by Google for specific evaluations. They are not guarantees of detection, exploitation or remediation in real systems.
| Test | Task described by Google | Reported result |
|---|---|---|
| SEC-bench Pro | Vulnerability detection | 88.2% |
| ExploitGym | Assessing whether flaws can be exploited | 54.8% |
| CWE-bench | Vulnerability remediation | 71.0% |
What the announcement says about coding and long-running tasks
Google says Carbon is designed for engineering workflows that require multiple steps and that, in internal testing, its teams have seen it work on complex problems for days. The company gives as examples tracing root causes and fixing subtle bugs in large codebases and low-level systems. These internal observations describe the company’s experience; they do not establish that the model can reliably complete any long-running task without supervision.
For web development, Google says Carbon gained 89 Elo points and placed fourth on WebDev Arena, with a score of 1,768. It also says Carbon ranks first in version 5.0 of the Artificial Analysis Intelligence Index, with a score of 59. These are placements in particular evaluations, not a universal ranking of capabilities: results depend on the task set, methodology and index version.
How to assess AI-assisted engineering work
A long-running workflow still needs human and technical checks, even if the model can maintain context for an extended period.
- 01Define the scope and acceptance criteria before starting the task.
- 02Test changes in a controlled environment and keep a way to roll them back.
- 03Review the code, dependencies and tests; do not assume that a long run means the solution is correct.
- 04Validate functional behavior and possible security effects separately.
Model safety and the limits of the claims
Google says Carbon reduces certain unwanted behaviors compared with Gemini 4 Argon in internal evaluations. The figures it reports include a nearly 80% reduction in high-severity misalignment alerts in internal coding environments and an approximately twofold reduction in unsupported claims. The announcement also reports a 0.0% attack success rate on the evaluated Gray Swan indirect prompt-injection benchmark.
A 0.0% result on a specific test suite means that no successful attacks were recorded under the conditions tested; it does not establish resistance to every possible attack. Likewise, internal improvements over Argon do not show that errors, unsupported claims or behavioral vulnerabilities are absent in other contexts. The announcement describes layers of protection, including misuse defenses and prompt-injection resistance, but does not guarantee absolute security.
Initial access and announced prices
Google said access would begin with a subset of cybersecurity specialists and gradually expand to other trusted partners through the Fairwind program. The company said it would continue collecting feedback and adjusting safeguards before making Carbon available to developers, businesses and consumers. The announcement does not detail Fairwind’s admission criteria or set a date for general access; availability to the public has not been confirmed.
The announced introductory price is $2 per million input tokens and $10 per million output tokens. Google says cached input tokens receive a 95% discount from the input-token price and that, after the introductory period, the planned rates will be $4 per million input tokens and $20 per million output tokens. The announcement does not specify when that period ends. These figures alone are not enough to calculate the total cost of an application, which also depends on usage volume and how each request is processed.
Announced access and prices
These terms and prices reflect what Google stated in its announcement. It does not give a date for general access or say when the introductory pricing period ends.
| Aspect | Information announced |
|---|---|
| Initial access | A subset of cybersecurity specialists |
| Planned expansion | Trusted partners through Fairwind, followed by developers, businesses and consumers |
| Introductory input price | $2 per million tokens |
| Introductory output price | $10 per million tokens |
| Planned rates after the introductory period | $4 per million input tokens and $20 per million output tokens |
| Cached input tokens | 95% discount from the input-token price |
What can be concluded so far
The confirmed news is that Google announced a model aimed at coding and several stages of software defense, along with specific results, a limited initial rollout and stated prices. The most important point for assessing its capabilities is that the published scores come from the company itself: Google’s official pages in Spanish and English repeat the same announcement and are not independent checks of one another.
The available information does not establish independent validation of the reported results, Carbon’s performance on systems beyond those evaluated, or the practical terms of the Fairwind program. For a security team, the figures are initial reference points for particular tasks and tests, not substitutes for expert review, authorization to test systems, local testing, or assessment of changes before deployment.
A cautious way to read the results
Scores can inform an evaluation, but they need to be understood within their limits.
- 01Identify what task each test measures and what configuration was used.
- 02Distinguish provider-reported results from independent validation.
- 03Check capabilities in an authorized environment that reflects the intended use.
- 04Review findings manually and validate patches before incorporating them.
Open questions
- The verified sources available do not establish independent validation of the scores reported by Google.
- The announcement does not detail Fairwind admission criteria or set a date for general availability.
- Google does not specify when the introductory pricing period ends.
- Results on specific tests do not establish performance on every system or configuration.
Keep exploring
Sources consulted
Corrections and transparency
If you spot incorrect or outdated information, send us a correction with the page and source we should review.
Submit a correction