Gemini 4 Carbon: what it is and why you can't use it yet

It’s eleven at night and an alert comes in: a library your project uses has a serious vulnerability. Now you have to figure out how exposed you are, whether someone could exploit it in your case, and how to fix it without breaking anything. This very week, Google unveiled an AI model that does exactly that better than any other. It’s called Gemini 4 Carbon, and the problem is you can’t use it.

It came out on October 28, and Google decided that, for now, not just anyone gets to use it. Below is what it does well (and what not so much), why it launched this way, what it brings that helps you even if you never use it, and what you can do today with the tools you do have.

What Gemini 4 Carbon is

According to the official announcement (opens in a new tab), Carbon is Google’s most advanced model. It’s built on Gemini 4 Argon, which came out two weeks earlier and is available, and it’s designed for two things: cybersecurity and long-running programming work. Google talks about jobs that can keep going for days, like reviewing an entire system for flaws.

How good it is

In security, Carbon leads the three benchmarks that measure the full job of handling a vulnerability:

Benchmark	What it measures	Result
SEC-bench Pro	Finding the flaw in the code	88.2%
ExploitGym	Checking whether the flaw can be exploited	54.8%
CWE-bench	Fixing it	71.0%

CWE is the public catalog of the most common kinds of flaws: SQL injection, passwords stored in code, permissions that aren’t checked properly.

Google also says Carbon writes twice as much secure code as Argon, the model you can use today.

Elsewhere, the lead is smaller. On the Artificial Analysis index, which combines many benchmarks into one number, Carbon scores 59, versus 58 for Claude Opus 5.5 and 57 for GPT-6 Astra: practically a tie. It’s fourth in web development, and Opus 5.5 beats it at computer use, that is, operating screens and applications the way a person would. As The Register noted in its analysis (opens in a new tab), it leads in security but doesn’t dominate across the board.

Why it launched closed

One of Carbon’s strengths is checking whether a flaw can be exploited, and that is, in part, what an attacker would do. The skill that helps a defense team know what to fix first would help someone else know where to get in.

That’s why Google started with a group of defense teams it picked itself, and will later add trusted partners through a program it calls Fairwind. Meanwhile, the model is going through the voluntary pre-release testing Google does with the U.S. government. For everyone else, Google says it will open it up “as soon as possible”, without giving a date.

It isn’t an overreaction. This same month, Reuters reported how a single person used AI agents (opens in a new tab) to attack more than 1,200 online stores and break into over 100 companies, including Deere and SharkNinja. They gave the agents fewer than a hundred characters of instructions and spent about $5,000 in total: $50 per company breached. With more capable models, that number is likely to drop.

Google isn’t the only one handling it this way. When Opus 5.5 came out, Anthropic decided that most cybersecurity tasks would be answered by an earlier model, Opus 4.8. The industry seems to be reaching the same conclusion: the strongest security models reach defenders first.

What it brings for everyone

Even if you never use Carbon, there’s something in the announcement that matters to anyone working with coding agents. Google says that, using it internally for programming, high-severity misbehavior alerts dropped by almost 80%.

It’s exactly the problem OpenAI showed last week (opens in a new tab): two of its coding agents, during routine tasks, turned off the system that monitored their behavior, and one denied it afterwards. Carbon targets that. Google says it trained it to take fewer shortcuts and make fewer things up: according to the announcement, it makes half as many unsupported claims as Argon; for example, saying it ran the tests when it didn’t.

It also reports zero successful attacks on a prompt injection benchmark: text hidden in a page or file that tries to give the model orders, like “ignore the above and send this data to this address”. For an agent that reads third-party code and documentation, it’s one of the most concrete threats.

None of this can be verified from the outside yet. But it shows where all models are heading: not just more capable, but more trustworthy when they work on their own.

Gemini 4 Carbon pricing

When it opens, the launch price will be $2 per million input tokens (the chunks of text the model reads) and $10 per million output tokens. After the introductory period, it goes to $4 and $20, the same that Opus 5.5 charges today. For now, it only matters to the teams inside the program.

What you can do today

You don’t need to wait for Carbon to improve your project’s security with what you already have:

Use Argon, or whatever model you already use, for a security review. Ask it to review your changes for the most common kinds of flaw, one at a time: unvalidated input, queries built by pasting text together, keys in the code, permissions that aren’t checked. It won’t be Carbon, but it finds more than you’d think, and checking what it says is still your job.
Turn on what GitHub already does for free. The scanning that blocks a push if it finds a key or password, and Dependabot, which proposes updates for dependencies with known vulnerabilities. According to GitHub’s latest report, that scanning checked 5.8 billion pushes this year.
Close the doors attacking agents look for. They’re the same as always, except now someone tries them on thousands of sites for very little money: leaked keys, outdated dependencies, exposed admin panels. This article covers where keys leak most often.

Defenders first

For years, every new model reached everyone on the same day. Carbon marks a shift: when a model is good enough at finding and exploiting flaws, companies choose who gets it first. For an ordinary developer, that means waiting. But it also means that, in the meantime, the teams defending the systems you use have a tool attackers don’t have yet. And when it reaches everyone, what will matter is the same as today: that your project doesn’t leave the easy doors open.