Google has released Gemini 4 Carbon, a frontier model it says outperforms rival systems at finding, exploiting and patching software vulnerabilities, to a limited group of cyber defenders ahead of any public release.
The company announced the model on October 28. Access starts this week with a subset of defenders and will expand gradually to other trusted partners through Google’s Fairwind Program. Google said it is taking part in the US government’s voluntary process for testing models before release and will keep refining guardrails before a wider launch, for which it gave no date. Carbon will carry the same introductory price as Gemini 4 Argon: $2 per million input tokens and $10 per million output tokens.
Google reported a score of 88.2 percent on SEC-bench Pro, a test of finding real vulnerabilities, against 85.4 percent for OpenAI’s GPT-6 Astra in its chart. On ExploitGym, which measures whether a model can write a working exploit, Carbon solved 54.8 percent of tasks with a 10-hour limit per task and 53.5 percent with six hours. The highest rival score shown is 42.4 percent, for GPT-6 Astra with no time limit, while Anthropic’s Claude Opus 5.5 scored 34.5 percent with six hours. On CWE-bench, which tests patching, Carbon scored 71.0 percent, three points ahead of the next models.
The comparisons are not like for like. Google ran SEC-bench Pro and ExploitGym itself and took competitors’ scores from their own published reports. Its ExploitGym runs used a single attempt per task, with mitigations switched off and no internet access, and Google says the cyber benchmarks were evaluated without guardrails. CWE-bench scores come from the benchmark’s public leaderboard, where Collinear AI evaluates every model.
Google also said Carbon resisted every attack in Gray Swan’s indirect prompt injection benchmark, for an attack success rate of zero after 15 attempts. Its chart puts Argon at 0.7 percent and Claude Opus 5.5 at 1.0 percent. Indirect prompt injection hides instructions in material an agent reads, such as a web page or document, and the result covers the attacks in that test set.
According to Google, Carbon tried to cheat on the Terminal-Bench 4.0 coding test in 0.4 percent of attempts and never succeeded, and high-severity misalignment alerts during internal coding work fell by almost 80 percent. The announcement links to the safety and security report Google published for Argon rather than to a separate report for Carbon.
Fairwind gives early access to governments, critical infrastructure operators and core technology platforms, and Google says it works with more than 650 partners. The program’s terms, which its web page still describes for Argon, limit partners to permitted dual-use work such as authorized threat simulation, reverse engineering and malware analysis. Partners must use phishing-resistant multifactor authentication, may give access only to internal security, incident response and penetration testing teams, and may not share or resell it. Google says it runs background checks on applicants.
Google followed the same path with Argon, which it released to vetted defenders first on September 30 before opening it to developers.
Sources: Google, Google DeepMind evaluation methodology, Google DeepMind Fairwind Program
–
By the Control Plane Editorial Team