Table of Contents
Google DeepMind has unveiled Gemini 4 Carbon, a new frontier AI model built for cybersecurity defense and software engineering tasks that can run for days. Access begins this week with a limited group of cyber defenders, ahead of a phased expansion to trusted partners and, later, developers, businesses, and consumers.
Carbon extends Google's work on agents that can investigate problems, use tools, and carry out multi-step projects rather than only respond to individual prompts. Google reports improvements in finding vulnerabilities, validating whether they can be exploited, and fixing their underlying causes, alongside stronger coding performance and fewer failures to follow user constraints.
In Google's launch results, Carbon ranks first on version 5.0 of the Artificial Analysis Intelligence Index with a score of 59. Its initial release will prioritize security teams while Google gathers feedback and refines the model's guardrails.
Engineering Work That Runs for Days
Google's internal teams have used Carbon to trace and patch subtle bugs across large codebases and low-level systems, with some tasks continuing for days. The work requires the model to persist through unsuccessful approaches and keep progressing through a larger engineering problem.
DeepMind says Carbon can work through complex tasks for days without getting stuck or taking shortcuts. Carbon follows a problem across multiple steps and code changes rather than producing a plausible patch in one response.
The improvements also extend to scientific tasks, multimodal understanding, and full-stack web development. Carbon gained 89 Elo points on WebDev Arena, reaching fourth place with a rating of 1,768 in Google's reported results.
Carbon follows Gemini 4 Argon's introduction for coding and cyber defense. Argon subsequently expanded across the Gemini app, Search, Antigravity, and the API, bringing Google's long-running agent workflows into consumer, developer, and enterprise products. Carbon's rollout starts with a narrower group of security users.
From Vulnerability Discovery to Working Fixes
Carbon's cybersecurity results cover three different parts of a defender's workflow. Finding a flaw identifies a potential weakness; testing exploitation establishes whether it can be used; patching addresses the underlying defect. Google evaluated Carbon without guardrails on the external cybersecurity benchmarks reported at launch.
On SEC-bench Pro, which tests vulnerability discovery in real-world software, Carbon scored 88.2%. Google reports that the model can autonomously uncover complex flaws buried in software projects.
On ExploitGym, Carbon reached 54.8%, a result Google reports as a new state of the art. Exploitation testing helps defenders determine which findings represent actionable risks and prioritize remediation.
Carbon scored 71.0% on Collinear's CWE-bench, which evaluates security vulnerability remediation. This stage moves from identifying a problem to producing a working code fix that addresses its root cause.
Google also reports that Carbon more than doubled Argon's success rate at generating secure code on internal benchmarks. In separate internal work, the Chrome team found Carbon performed more than 10 times better than another lab's large frontier model at generating high-quality patches. Google's security business Wiz also observed leading performance on web penetration-testing benchmarks used in its defensive work.
Fewer Shortcuts and Stronger Prompt-Injection Resistance
When an agent works through a long engineering task, correctness includes how it reaches the result. Google trained Carbon to reduce shortcut-taking and loophole exploitation while retaining coding performance.
In Google's tests on Terminal-Bench 4.0, successful cheating fell to 0.0%, and cheating attempts fell to 0.4%. In live coding environments with internal teams, high-severity misalignment alerts dropped by almost 80%.
Google's internal testing also found roughly half as many unsupported claims as with Argon. Carbon reduced overreach by 26% and under-service by 29%, addressing both actions that exceed a project's scope and failures to complete the requested work. Google says the model is better at retrieving relevant sources and surfacing discrepancies rather than guessing when instructions or evidence are ambiguous.
Carbon retains Argon's layered safety system, combining model training, real-time defenses against misuse, prompt-injection resistance, and chain-of-thought monitoring. Prompt injection involves malicious instructions embedded in material an agent encounters, potentially redirecting it away from the user's task.
On Gray Swan's Indirect Prompt Injection benchmark, Carbon recorded a 0.0% attack success rate, down from Argon's 0.7%, resisting every evaluated attack in that test.
Phased Access and Introductory Pricing
Google will gradually extend Carbon access beyond the initial cyber defenders through its Fairwind Program. The company is also participating in the U.S. government's voluntary pre-release model testing process. Feedback from early users will inform changes to guardrails before broader release through Google's products.
Carbon will launch at the same introductory rates as Argon: $2 per million input tokens and $10 per million output tokens. Cached input tokens, which allow previously processed material to be reused, receive a 95% discount on the input price.
After the introductory period, pricing will rise to $4 per million input tokens and $20 per million output tokens.
