Gemini 4 Carbon – state-of-the-art for cybersecurity

Google has announced Gemini 4 Carbon, its strongest model yet, with state-of-the-art cybersecurity and long-horizon capabilities. Carbon ranks #1 on the recently updated v5.0 of the Artificial Analysis Intelligence Index, where it scores 59. It follows Gemini 4 Argon, which launched two weeks earlier, and Google says the pace shows how quickly it is pushing the frontier forward while strengthening safeguards alongside capability gains.

Carbon shows significant gains across coding and agentic tasks, as well as in the capabilities that matter for cyber defense. It takes a firm lead on three security benchmarks: SEC-bench Pro (88.2%) for finding vulnerabilities, ExploitGym (54.8%) for exploitation, and CWE-bench (71.0%) for patching. On Google's internal benchmarks, Carbon produces a strong uplift in generating secure code. In live coding environments with Google's own teams, it shows reduced misalignment and fabrication rates.

Long-horizon coding and reasoning

Carbon is designed for much harder, long-horizon engineering problems and for sustained agentic workflows. Google's internal teams have seen it run for days, persisting through dead ends to tackle complex, multi-step engineering work. Examples include root-causing and patching subtle bugs across large codebases and low-level systems.

Building on user feedback, Google focused on improving performance across coding, agentic, and scientific tasks, as well as full-stack web development and multimodal understanding. Improved output quality and artifacts in web development lifted Carbon up 89 Elo points, placing it at #4 with a score of 1769 on WebDev Arena.

Cybersecurity performance

Google says Carbon delivers a significant leap in cybersecurity and achieves state-of-the-art performance across the defense lifecycle: vulnerability detection, validation, and remediation.

• Finding real vulnerabilities: Carbon achieves a state-of-the-art 88.2% on SEC-bench Pro, autonomously uncovering complex flaws buried in real-world software.
• Validating risk through exploitation: Defenders increasingly rely on models to check which vulnerabilities are exploitable, so they can prioritize fixes. Carbon sets a new state-of-the-art on ExploitGym at 54.8%.
• Patching at the root cause: Carbon reaches 71.0% on Collinear's CWE-bench, turning validated findings into working code fixes.

Google also reports real-world signals. On internal benchmarks, Carbon achieves more than 2x uplift in success rate for generating secure code over Argon. The Chrome team reported that Carbon performed more than 10X better than another lab's large frontier model when generating high-quality patches. Wiz, Google's cloud security platform, observes Carbon leading on benchmarks for web penetration testing, a core capability for its Scan for Good initiative. These external results are evaluated without guardrails.

Safety and alignment

Carbon uses the same multi-layered safety and security stack as Argon, which combines model training, real-time misuse defenses, prompt-injection resilience, and chain-of-thought monitoring. Google says it went a step further on alignment, training Carbon to respond to complex or high-pressure tasks in the right way. Details are in its Safety and Security report.

• Shortcuts and loophole exploitation: Successful cheating on Terminal-Bench 4.0 fell to 0.0%, and attempts to cheat dropped to 0.4%, while overall accuracy improved. In live coding environments, high-severity misalignment alerts dropped by almost 80%.
• Honesty: In internal testing, Carbon cuts unsupported claims by about 2x over Argon. It places methodological caveats directly in deliverables, or withholds blocked actions with a clear list of what remains required, rather than fabricating or hedging around missing evidence.
• Ambiguity: Rather than guessing, Carbon retrieves relevant sources and surfaces discrepancies to the user before acting.
• Scope: Carbon reduced overreach by 26% and under-service by 29%, making multi-step plans more reliable end to end while respecting project constraints.
• Prompt injection: Argon previously led the Gray Swan Indirect Prompt Injection (IPI) Benchmark with a 0.7% attack success rate. Carbon achieves 0.0%, resisting every evaluated attack attempt.

Key Features at a Glance

Availability

Carbon is rolling out in phases. Starting this week, Google is making it available to a subset of cyber defenders, and it will gradually expand access to additional trusted partners through its Fairwind Program. Google says it is still gathering feedback and iterating on guardrails before releasing Carbon to developers, businesses, and consumers through its product surfaces as soon as possible. Google is also engaged in the U.S. government's voluntary process for pre-release model testing.

Carbon will launch at the same introductory price as Argon: $2 per million input tokens and $10 per million output tokens. Cached input tokens are priced at 95% off the input token price.