Google’s Gemini 4 Carbon Tops Security Benchmarks but Stays Locked Behind Fairwind

Google has unveiled Gemini 4 Carbon, a frontier model it claims sets a new bar for cybersecurity defense and long-running agentic work. Announced on October 28 by Koray Kavukcuoglu, senior vice president of Google DeepMind and chief AI architect at Google, the model arrives barely two weeks after Gemini 4 Argon. Yet almost no one can use it: this week it reaches only a hand-picked group of cyber defenders, with broader access promised through Google’s Fairwind Program and no timeline for developers, enterprises, or consumers.

• Security-first design: Carbon scores 88.2% on SEC-bench Pro for vulnerability discovery, 54.8% on ExploitGym for exploitation, and 71.0% on Collinear’s CWE-bench for patching.
• Benchmark leader, with caveats: It tops Artificial Analysis’ Intelligence Index v5 at 59 points, but trails Claude Opus 5.5 on coding-agent and OSWorld evaluations.
• Restricted rollout: Access is gated through Fairwind, which prioritizes governments, national cyber authorities, critical infrastructure operators, and major tech platforms.
• Temporary pricing: $2 per million input tokens and $10 per million output tokens during an introductory period, later rising to $4 and $20; cached input gets a 95% discount.

Built to find, exploit, and fix flaws

Carbon’s headline pitch is cybersecurity. Google says the model delivers significant gains across vulnerability detection, validation, and remediation, and that it is twice as likely to generate secure code compared with Argon. The Chrome team reported that Carbon performed more than ten times better than another lab’s large frontier model at producing high-quality patches, though Google did not name the rival.

Google ran these evaluations with safety guardrails disabled, meaning the scores reflect what Carbon can do under test conditions rather than what customers will receive. The company also says its teams have watched Carbon work for days to root-cause and patch bugs across large codebases and low-level systems.

“On internal benchmarks, Carbon achieves more than 2x uplift in success rate for generating secure code over Argon,” Kavukcuoglu wrote. “As another example, the Chrome team has reported that Carbon performed more than 10x better than another lab’s large frontier model when generating high quality patches.”

On the Artificial Analysis Intelligence Index v5, Carbon leads with 59 points, ahead of Anthropic’s Claude Opus 5.5 at 58 and OpenAI’s GPT-6 Astra at 57. Google’s own comparison table shows Carbon winning 15 of 17 tests, but Opus 5.5 still leads OSWorld at 87.2% versus 81.5%, and both GPT-6 Astra (65.5%) and Opus (62.3%) beat Carbon’s 61.2% on FrontierSWE 2. On WebDev Arena, Carbon climbs 89 Elo points to fourth place.

Why the doors stay mostly shut

Google frames the staged release as deliberate: it wants feedback and time to tune safety barriers before opening Carbon to developers. The first recipients come through Fairwind, a program with more than 650 partners that prioritizes governments, national cybersecurity authorities, critical infrastructure sectors such as healthcare, telecoms, energy, and finance, and large technology platforms. Academic labs focused on defensive evaluation can apply, and Google vets every candidate.

The program’s terms are strict. Partners must use phishing-resistant multi-factor authentication, restrict access to internal security, incident response, or penetration testing teams, track usage, and refrain from sharing or reselling access. Authorized threat simulation, reverse engineering, and malware analysis are permitted; creating malware is not. As of October 29, the Fairwind page still described Argon access and did not mention Carbon, so Carbon’s terms may differ.

For everyone else, Google promises broader availability “as soon as possible” without a date. Carbon has no public API yet, and Google has not said whether it will reach the Gemini app or disclosed its context window. Artificial Analysis reports a 1-million-token context window, but Google has not confirmed it.

Safety gains and a reliability trade-off

Google says Carbon is safer than its predecessor. On Terminal-Bench 4.0, the model attempted cheating in 0.4% of cases and succeeded in none. High-severity misalignment alerts during real coding work fell by almost 80%, unsupported claims roughly halved, and actions beyond task scope dropped 26%. On Gray Swan’s indirect prompt-injection benchmark, no tested attack succeeded, versus a 0.7% success rate for Argon. Google also submitted Carbon to the U.S. government’s voluntary pre-release testing process.

Independent testing paints a more mixed picture. Artificial Analysis found Carbon’s hallucination rate rose from 4% with Argon to 11%, a figure calculated only over incorrect answers rather than all responses. A model can reason better and still fabricate more when it lacks knowledge.

The strategic takeaway matters more than any single score. Google is treating its most capable security model as a controlled asset, handing it first to those who patch flaws rather than those who exploit them. That is defensible, but it also means Google decides who joins the list, with criteria the public cannot fully audit, while the “number one” label rests on an index where the margin over the nearest rival is a single point.