Google has just released its most capable AI model yet — and most businesses cannot use it. On October 28, 2026, Google DeepMind announced Gemini 4 Carbon, a frontier model built for cybersecurity and long, multi-step engineering work. Within hours it topped a major independent index, posted record scores on vulnerability-finding benchmarks, and then — deliberately — went almost nowhere. The first users are a small group of vetted cyber defenders, admitted through a programme called Fairwind, while everyone else waits.

That combination is the story. Carbon is not another general chatbot upgrade. It is a model powerful enough that Google is treating wide release as a safety decision, not a marketing moment. For business owners, developers, and anyone responsible for a website, the announcement matters less for what you can try today and more for what it signals: machines that find flaws, prove they are real, and fix them — working for days without stopping.

This article explains what Google actually announced, what the benchmark numbers do and do not prove, why access is gated, and what your business should do this week while Carbon is still behind closed doors.

What Google actually announced

In its announcement post, Google DeepMind calls Carbon “our strongest model with state-of-the-art cybersecurity and long horizon capabilities.” It arrives just two weeks after its predecessor, Gemini 4 Argon, which shows how fast Google is now iterating at the frontier. Carbon builds on Argon’s safety stack — model training, real-time misuse defences, prompt-injection resilience, and monitoring of the model’s chain of thought — and adds stronger alignment work on top.

Two capabilities define the model. The first is cybersecurity across the full defence lifecycle: finding vulnerabilities, validating whether they can actually be exploited, and patching them at their root cause. The second is long-horizon engineering: sustained, agentic work on hard, multi-step problems. Google says its internal teams have watched Carbon run for days, persisting through dead ends to trace and patch subtle bugs across large codebases and low-level systems.

That persistence is where earlier models typically failed. A model that can write a function is common. A model that can spend days inside an unfamiliar codebase, recover from failed builds, and finish a fix is something else.

The numbers that matter — and what they actually measure

Google’s headline figures come from a mix of independent benchmarks and its own internal tests. The broadest result: Carbon ranks first on version 5.0 of the Artificial Analysis Intelligence Index with a score of 59.

The cybersecurity scores are more specific, and more interesting. Google reports them from evaluations run without guardrails — that is, from a research checkpoint with its safety restraints removed, so the raw capability can be measured. Here is what each benchmark tests:

Benchmark Carbon’s score What it measures
SEC-bench Pro 88.2% Finding complex vulnerabilities buried in real-world software
ExploitGym 54.8% Validating a vulnerability by testing whether it can actually be exploited
CWE-bench (Collinear) 71.0% Patching vulnerabilities at their root cause, turning findings into working fixes

Read together, the three scores describe a pipeline, not a party trick. Finding a flaw is only step one: many reported vulnerabilities turn out to be unexploitable or too minor to prioritise, which is why defenders use exploitation testing to decide what to fix first. And a patch that papers over a symptom without addressing the root cause leaves the door open. A single model that can do all three — find, prove, fix — compresses work that currently takes security teams days or weeks.

Google’s internal results point the same way. On its own benchmarks, Carbon more than doubles Argon’s success rate at generating secure code. Its Chrome team reports that Carbon performed more than ten times better than another lab’s large frontier model when generating high-quality patches — though Google does not name the rival model, so that comparison cannot be independently checked. Wiz, Google’s cloud security platform, reports that Carbon leads benchmarks for web penetration testing.

Outside cybersecurity, Carbon gained 89 Elo points on WebDev Arena to reach fourth place with a score of 1,768. Google also reports safety gains: successful cheating on Terminal-Bench 4.0 fell to 0.0%, high-severity misalignment alerts in live coding dropped by almost 80%, unsupported claims were cut by roughly half versus Argon, and Carbon resisted every evaluated attack on Gray Swan’s Indirect Prompt Injection benchmark, improving on Argon’s already low 0.7% attack success rate.

One honest caveat: these are Google’s numbers, published by Google, and not yet independently reproduced. Treat them as a credible signal of direction, not as settled fact.

Why you cannot use Carbon yet — and why that is deliberate

Carbon’s rollout is the opposite of a public launch. Starting this week, Google is making it available to a subset of cyber defenders, then gradually phasing access to additional trusted partners through its Fairwind Program. Google says it is also participating in the U.S. government’s voluntary process for pre-release model testing, and that it will keep gathering feedback and iterating on guardrails before making Carbon available to developers, businesses, and consumers through its product surfaces.

The reason is dual use, and Google is unusually open about it. The same capability that lets a defender find and patch a flaw in their own system lets an attacker find and exploit a flaw in someone else’s. Evaluating the model without guardrails shows what the raw model can do in the wrong hands as well as the right ones. Gating access to vetted defenders first is Google’s attempt to get the defensive benefit out ahead of the offensive risk.

For ordinary users, the practical consequence is simple: there is no waitlist to join today and no consumer product to try. If a website or social post claims to offer you Gemini 4 Carbon access right now, treat it with suspicion.

Carbon vs. Argon: what changed in two weeks

Gemini 4 Argon Gemini 4 Carbon
Launched Two weeks before Carbon October 28, 2026
Positioning Frontier general model with a safety stack Strongest model; cybersecurity and long-horizon specialist
Intelligence Index (v5.0) Below Carbon #1 at 59
Secure code generation Baseline More than 2x Argon’s success rate (Google internal benchmarks)
Prompt-injection resistance 0.7% attack success (Gray Swan) 0.0% attack success (Gray Swan)
Introductory API price $2 per million input tokens / $10 per million output tokens Same introductory price; cached input tokens 95% off
Availability General Gated: cyber defenders first via Fairwind, then trusted partners

Pricing is worth noting even before general availability. Carbon launches at the same introductory price as Argon — $2 per million input tokens and $10 per million output tokens, with cached input tokens priced 95% below the input rate. Independent coverage reports that standard pricing will later rise to $4 and $20 per million tokens respectively, so the introductory rate is best read as an early-adopter window, not a permanent price.

What this means for your business

Most readers will not touch Carbon for months. That does not make the announcement irrelevant. It changes the security environment you already operate in, in four concrete ways.

1. Patching speed is about to become a competitive gap

When defenders can find, validate, and patch vulnerabilities in hours instead of weeks, the window between a flaw becoming known and it being fixed shrinks — for everyone. Attackers benefit from the same acceleration, so slow patching becomes more dangerous, not less. If your business runs a website, a web app, or any internet-facing system, updating promptly matters more with every model generation. Our recent guide to the PHP2Shell flaws showed how quickly a disclosed vulnerability turns into mass exploitation attempts; Carbon-style tooling will compress that timeline further.

2. Security teams will change shape before they shrink

Carbon does not replace security professionals. It changes what they spend their time on: less triage of false positives, more judgement about which findings matter, and more oversight of automated fixes. Organisations that treat AI-generated patches as ready to deploy without review are taking a risk — a plausible-looking patch that misses the root cause is worse than no patch, because it creates false confidence. The winning setup is human review over machine speed: let the model find and draft, let people verify and approve.

3. Your website is already in the crossfire

AI agents are already crawling, probing, and scraping the web at scale — so much so that, as we covered recently, many websites are now blocking AI agents outright. Carbon adds a sharper edge to that trend: automated vulnerability discovery against public-facing sites. If you run WordPress, keep core, themes, and plugins updated and remove unused plugins. These unglamorous basics are exactly what automated probing punishes when neglected.

4. AI costs keep falling — but the capable tier stays gated

The broader market has seen dramatic AI model price drops in recent months, and Carbon’s introductory pricing continues that pattern. But the most capable models are increasingly released behind gates and partnerships rather than open to all. Businesses should plan on a two-tier market: cheap, general models for everyday work, and restricted, premium models for specialised tasks.

What to do this week

You cannot buy Carbon today, but you can prepare for the world it signals. Five actions, in order of impact:

  • Audit your patching cadence. How long, honestly, between a critical update being released for your site or stack and it being applied? If the answer is measured in weeks, close that gap first.
  • Inventory what is internet-facing. List every public site, app, API, and admin panel. You cannot defend what you have forgotten exists, and automated discovery tools do not forget.
  • Put a human in front of AI-generated code. If your team already uses AI coding tools, make review of security-sensitive changes explicit: no AI-written authentication, payment, or access-control code ships without a human check.
  • Revisit your AI tooling budget. Introductory pricing rarely lasts. When evaluating models and platforms, compare standard rates, not launch rates — and favour tools that make token usage visible. Our WebReOn Tools hub and WebReOn Chat are built around that kind of transparent, everyday AI use.
  • Train the team on the new phishing surface. Models that reason better also impersonate better. Verify unusual requests through a second channel, especially when money or credentials are involved.

Students and early-career developers wondering how to keep up should start with the free tier of the ecosystem: our guide to the best free AI tools for students covers capable, no-cost options for learning the fundamentals that models like Carbon are built on.

FAQ

Can I use Gemini 4 Carbon today?

Almost certainly not. Initial access is limited to a subset of cyber defenders through Google’s Fairwind Program, expanding gradually to trusted partners. Google has said it will bring Carbon to developers, businesses, and consumers after further feedback and guardrail work, but has not given a date.

Does Carbon replace penetration testers and security teams?

No. It automates large parts of finding, validating, and drafting fixes for vulnerabilities, but prioritisation, business context, and approval of fixes still need human judgement — especially when a patch touches production systems.

How much will Carbon cost?

Introductory API pricing matches Argon at $2 per million input tokens and $10 per million output tokens, with cached inputs 95% off. Independent coverage reports standard pricing rising to $4 and $20 per million tokens after the introductory period, so plan budgets around the higher figure.

Is Carbon safe, given it can build exploits?

That is precisely why access is gated. Google evaluated the model without guardrails to measure raw capability, then restricted early access to vetted defenders while participating in voluntary U.S. government pre-release testing. The safety case rests on that staged rollout holding — which is something to watch, not assume.

Should WordPress site owners worry specifically?

WordPress sites are frequent targets of automated probing regardless of which model is newest, because they are numerous and often under-maintained. Keep everything updated, minimise plugins, and monitor for unusual activity. Carbon raises the general speed of discovery; it does not single out WordPress.

Conclusion

Gemini 4 Carbon is a significant model and a revealing launch. Google has built something it believes leads the field at finding, proving, and fixing software flaws — and then decided that most of the world should not have it yet. That restraint is the most important signal in the announcement: frontier AI capability in cybersecurity has crossed a threshold where deployment itself is a safety decision.

For your business, the takeaway is not to wait for Carbon. It is to act on what Carbon implies: patch faster, review AI-generated code, inventory your exposure, and budget for a market where the best models arrive gated and priced as premium tiers. The organisations that do that work now will be best placed when Carbon — and the models that follow it — finally reach everyone else.

Sources