Gemini 4 Carbon: Cyber defense performance, limited rollout

1. Stronger defense from vulnerability discovery to fixes

Google DeepMind said Carbon delivered state-of-the-art performance across cyber defense, from finding vulnerabilities to validating exploitability and fixing them. According to the company, it ranked first with 59 on the Artificial Analysis Intelligence Index v5.0, an overall performance measure.

According to the company, evaluations without safeguards yielded 88.2% on SEC-bench Pro for vulnerability detection and 54.8% on ExploitGym for exploitability validation.

The company reported 71.0% on CWE-bench, a patch generation test also evaluated without safeguards. The three tests measure different tasks, so they cannot readily be combined into a single success rate.

Exploitability validation checks whether a discovered flaw can be used in an actual attack, helping prioritize fixes. Generating patches to fix root causes then extends its use from finding problems to preparing fixes for security teams.

The company reported that its secure code generation success rate on an internal benchmark, a standardized performance test, was more than twice that of its predecessor, Gemini 4 Argon. Google said the Chrome team reported Carbon performed more than 10 times better than another lab's large frontier model when generating high-quality patches.

2. Coding work that runs for days through dead ends

Carbon is designed to work for extended periods on complex, multistep engineering tasks. Google's internal teams reported seeing it run for days despite dead ends while tracing and patching subtle bugs in large codebases and low-level systems operating close to hardware.

Improvements also covered agentic tasks, in which programs autonomously perform multiple steps, scientific work, and web development. The company reported a gain of 89 Elo points on WebDev Arena, a web development evaluation, reaching fourth place at 1769. Elo quantifies ability through head-to-head results. Google said the quality of web development output improved.

3. Retaining safety layers while reducing off-task behavior

Carbon inherits Argon's multilayered safety and security framework, combining model training, real-time misuse defenses, and monitoring of reasoning. It also addresses prompt injection, where instructions hidden in external documents or other sources steer models toward improper actions. Training was strengthened to keep behavior aligned with intent on complex or high-pressure tasks.

The company reported a 0.0% success rate and a 0.4% attempt rate for cheating that exploits evaluation loopholes on Terminal-Bench 4.0. In internal teams' real coding environments, alerts for behavior substantially deviating from intent fell by nearly 80%.

According to the company, unsupported claims in internal tests fell to about half of Argon's level. Actions exceeding the requested scope fell by 26%, while actions falling short fell by 29%. Google said it improved the model to consult relevant material and flag inconsistencies to users before acting on ambiguous requests.

The company reported that attack success on Gray Swan's indirect prompt injection evaluation fell from 0.7% for Argon to 0.0% for Carbon.

4. Starting with select defenders, then expanding to partners

Google said it is participating in the US government's voluntary pre-release model testing process and will provide Carbon to select cyber defenders this week. It will then gradually expand access to trusted partners through the Fairwind Program. Access through products for developers, businesses, and general users is planned after feedback on safeguards is incorporated.

5. Accounting for costs after introductory pricing

Pricing matches Argon's introductory rates: $2 per 1 million input tokens and $10 per 1 million output tokens. Cached input, content stored for reuse, receives a 95% discount on the input price. After the introductory period, the rates rise to $4 and $20, respectively.

For security teams, the benefit is being able to delegate extended workflows for validating vulnerabilities and preparing fixes. Organizations considering adoption need to plan for availability and higher input and output costs once the initial discounted rates end.

Carbon's adoption value emerges when the length of defense work it can handle is weighed alongside access timing and ongoing costs.