Gemini 4 Carbon Released: The Strongest Cybersecurity Model, But You Can't Use It Yet

Google has released its next-generation model, Gemini 4 Carbon, just two weeks after the official launch of its predecessor, Argon. Google calls it its strongest model yet, focused on cybersecurity defense and long-running complex task handling. However, ordinary users can't use it for now.

Dominating the Benchmarks: First Place in 15 of 17 Tests

According to the scorecard Google published, Carbon competes head-to-head with its own Argon as well as models like GPT-6, Astra, and Cloud Opus 5.5. Out of 17 tests, Carbon took the top score in 15. Among them, a third-party intelligence index gave it 59 points, ranking first.

Of the two tests it didn't win, one was lost to GPT-6 and Astra, and the other fell behind Cloud Opus 5.5. Although it wasn't a clean sweep, such a high win rate is enough to show Carbon's leading position in overall capability.

The third-party intelligence index (Artificial Intelligence Index) is typically derived by independent evaluation organizations aggregating multiple benchmarks, used to compare the general capabilities of different models side by side. It is not a single-task score but a composite score weighted across dimensions such as reasoning, knowledge, coding, and math. Because vendors' self-reported results may involve selective disclosure, third-party independent indices are often regarded as a more neutral reference. Carbon's 59 points and first-place ranking on this index in the article means its lead is reflected not only in Google's own hand-picked 17 tests but also in the composite ranking of external independent evaluations—though the specific weighting of sub-scores and the composition of the test set still need to be interpreted alongside the full report.

Built for Long Tasks: Running for Days Without Giving Up

Carbon is a model designed specifically for long-running engineering tasks. Google revealed that its internal team once had it run continuously for several days, and it wouldn't give up even when it hit a dead end. For example, locating the root cause of a hidden bug in a massive codebase and fixing it—such tasks place extremely high demands on a model's persistence and reasoning ability.

In web development, Carbon's score on WebDev Arena rose by 89 points, climbing to fourth place. This shows that its performance in code generation and real-world application scenarios has also improved significantly.

Cybersecurity Defense: A Three-Step Loop, Leading on Three Metrics

Google emphasized Carbon's cybersecurity defense capabilities the most. Fully handling a vulnerability requires three steps: find it, confirm it can actually be exploited, and then fix the root cause.

In the vulnerability-finding stage, Carbon reached an 88.2% success rate on SEC Bench Pro; in verifying exploitability, it scored 54.8% on Exploit Gym; and in fixing the root cause, it scored 71% on CWE Bench. Google says these are all the best results currently, and they were measured without any defensive measures in place.

In internal testing, Carbon's success rate in writing secure code was twice that of Argon. The CREME team also said its performance in generating high-quality patches was more than 10 times better than another lab's large model.

SEC Bench Pro, Exploit Gym, and CWE Bench correspond to different stages of the vulnerability-handling workflow. SEC Bench Pro focuses on evaluating a model's ability to locate security flaws in real codebases; Exploit Gym measures whether a model can construct an exploit path that can actually trigger a vulnerability, thereby distinguishing real risk from false positives; and CWE Bench, based on the Common Weakness Enumeration (CWE) classification, examines a model's ability to fix the root cause of a vulnerability rather than merely eliminating surface symptoms. Chained together, the three metrics cover the complete defense loop from discovery to verification to remediation, so they reflect a model's practical value in security operations better than a single vulnerability-detection score.

Better Behaved: Zero Cheating, No Successful Prompt Injection Attacks

Along with improved capabilities, Carbon's behavioral compliance has also clearly improved. On Terminal Bench 4.0, its number of successful cheating attempts dropped to 0. Against indirect prompt injection attacks, Argon still had a 0.7% success rate for the attacker, while Carbon was never fooled once.

In addition, unsupported claims were about half as many as Argon's. In internal coding environments, severe behavioral deviation alerts decreased by nearly 80%.

These improvements are especially important for deploying models in critical business scenarios, particularly in security-sensitive fields.

Indirect prompt injection refers to attackers hiding malicious instructions in external content that the model may read—such as web pages, documents, code comments, or tool return results—rather than directly in user input. When the model processes this content, it may mistakenly treat the hidden instructions as legitimate tasks and execute them, thereby leaking data, invoking tools, or changing behavior. This type of attack is especially dangerous for agents with browsing, file read/write, or code execution capabilities, because the attack surface expands from conversational input to the entire information environment. The "success rate" mentioned in the article is the proportion of times a model is successfully manipulated by such hidden instructions, measuring the model's behavioral safety in real tool-chain scenarios.

Rollout Cadence and Pricing: Defenders First, Priced the Same as Argon

Carbon is not yet available to the public. Google is participating in pre-launch testing with the U.S. government, opening it this week to a small group of cybersecurity defenders first, and then expanding to more trusted partners through the Fairwind program. The initial price for developers, enterprises, and ordinary users is the same as Argon: $2 per million input tokens and $10 per million output tokens.

The iteration pace from Argon to Carbon is getting faster and faster, and the next generation may not be far off either. For those watching the boundaries of AI capabilities and security applications, Carbon's arrival is undoubtedly an important signal.