On October 28, Google announced Gemini 4 Carbon, a frontier model that just took the number one spot on the Artificial Analysis Intelligence Index v5.0. Then, in the same breath, Google told almost everyone they can’t have it. Not developers. Not businesses. Not consumers paying for Google AI Ultra. Access starts with a waitlist called Fairwind, and it’s reserved for cyber defenders — government agencies, critical-infrastructure operators, a handful of major platforms. Everyone else gets “as soon as possible,” which is Google’s phrase, not a date.

That’s a strange way to announce the best model in the world. Unless you look at what Carbon is actually good at, in which case it stops being strange and starts being the point.

Quick Summary: What Happened

Detail	Info
Announced	October 28, 2026, via Google’s official blog and Google DeepMind
Benchmark rank	#1 on Artificial Analysis Intelligence Index v5.0, score of 59
Cybersecurity scores	88.2% on SEC-bench Pro (finding vulnerabilities), 54.8% on ExploitGym (exploitation), 71.0% on CWE-bench (patching)
Public access	None. Initial access limited to vetted cyber-defender teams via Google’s Fairwind Program. No public release date set
Pricing (set anyway)	$2 per million input tokens / $10 per million output, rising to $4/$20 later; cached input discounted 95%
Second launch this month	Follows Gemini 4 Argon, which shipped September 30

Bottom line: Google built a model that’s unusually good at finding and fixing software vulnerabilities, then restricted it to the people defending against the same class of attacker who’d want it most.

What Actually Happened

Google’s own post frames Carbon as its strongest model yet, built around two things: cybersecurity — specifically vulnerability discovery and patching — and what it calls sustained agentic work, meaning it can stay on a complex task for days without losing the thread or needing a human to restart it. 9to5Google covered the launch the same day, and independent reporting from Android Authority, Interesting Engineering, Digital Trends, and Constellation Research all corroborated the core claims independently.

The numbers Google is leading with: 88.2% on SEC-bench Pro, a benchmark for finding vulnerabilities in code; 54.8% on ExploitGym, which tests whether a model can actually exploit a flaw once it’s found one; and 71.0% on CWE-bench, which grades the quality of the patch a model writes for a known weakness class. Google also says its own Chrome team found Carbon generates high-quality security patches more than 10x better than a competing lab’s frontier model — Google didn’t name which one, and neither did the outlets reporting it.

None of that is available to you right now. Carbon’s rollout runs through Google’s Fairwind Program, the same gated-access structure Gemini 4 Argon launched through four weeks earlier. Fairwind prioritizes governments, national cyber agencies, critical-infrastructure operators, and major tech platforms — not individual developers, not startups, not the Google AI Ultra subscribers who’d otherwise be first in line for a new flagship model. Google says general availability is coming “as soon as possible,” which, as phrases go, tells you Google doesn’t know either.

What Can Gemini 4 Carbon Actually Do?

1. Find vulnerabilities — 88.2% on SEC-bench Pro, the benchmark measuring whether a model can locate security flaws in a codebase before anyone tells it where to look.
2. Exploit them — 54.8% on ExploitGym, testing whether the model can turn a found vulnerability into a working exploit.
3. Patch them — 71.0% on CWE-bench, grading the quality of the fix a model writes for a known weakness class.
4. Work for days unattended — Google’s sustained-agent framing, meaning Carbon is built to stay productive on long, multi-step engineering tasks without stalling out or needing a restart.
5. Beat the field — a score of 59 on the Artificial Analysis Intelligence Index v5.0, enough for the #1 spot ahead of GPT-6 Astra and Claude Opus 5.5.

Why This Matters

Here’s the uncomfortable symmetry nobody at Google is going to spell out in a press release: a model that’s elite at finding and exploiting vulnerabilities is, structurally, a model that’s elite at finding and exploiting vulnerabilities. Full stop. SEC-bench Pro and ExploitGym don’t measure two different skills — they measure the same skill pointed at two different purposes. The 54.8% on ExploitGym isn’t a defensive number dressed up to look useful. It’s a model demonstrating it can turn a flaw into a working exploit, which is precisely the capability that makes a cybersecurity model dangerous in the wrong hands and valuable in the right ones.

Google restricting Carbon to vetted cyber-defense teams isn’t an access-control footnote. It’s the company admitting, by action rather than statement, that this capability is dual-use in the way “frontier coding model” usually isn’t. You don’t gate a model behind a program for critical-infrastructure operators and national cyber agencies because you’re worried about server costs. You gate it that way because you’ve concluded the wrong user profile turns a vulnerability-finder into a vulnerability-weaponizer, and the only lever you have at launch is who gets to hold it.

That’s a sharper admission than Argon’s rollout made. Argon launched through the same Fairwind structure, but its headline pitch was coding and enterprise document work — legal drafting, financial research — where restricting access reads more like caution about an unproven model than acknowledgment of a specific risk. Carbon’s pitch is “finds and exploits vulnerabilities better than anything else available,” and the access restriction that follows reads less like caution and more like Google drawing a line it’s not comfortable crossing in public.

Worth comparing this to how an AI model found the PHP2Shell vulnerability before human researchers did — proof that AI-driven vulnerability discovery isn’t theoretical anymore, it’s already finding real flaws in production software. Carbon is a purpose-built, benchmark-topping version of exactly that capability, arriving right as AI agents were reported breaching 100+ companies in a separate incident for comparatively little money. The capability curve and the misuse curve are rising at the same time, and Google’s response is to try to keep the sharpest point of that curve inside a vetted perimeter for as long as it can.

The Bigger Picture

Carbon is Google’s second new frontier model release in a single month — Gemini 4 Argon shipped September 30, and we covered it in a three-way comparison against GPT-6 Astra and Claude Opus 5.5 at the time. Four weeks later, Carbon arrives with a harder benchmark suite, a #1 ranking, and the same access playbook: vetted partners first, everyone else on an undated “soon.”

That pace is itself a signal. Releasing two frontier models a month apart, both gated the same way, suggests Google isn’t treating restricted-access launches as an exception anymore — it’s treating them as the default shape for anything it’s willing to call Critical-tier capable. OpenAI crossed a similar line with Astra back in September, and frontier models in general are now facing a quieter layer of government review before wide release. Carbon fits that pattern exactly: a lab building something powerful enough that the lab itself doesn’t fully trust the open internet with it yet.

Google set pricing anyway — $2 per million input tokens and $10 per million output, climbing to $4/$20 later, with a 95% discount on cached input tokens — despite having no general customer base to sell it to. That’s not an accident. It’s Google pre-committing to a price before the product is actually purchasable, the same intro-to-standard pricing shape Argon used, and a signal that Google expects the waitlist to lift on a timeline it just isn’t saying out loud.

Our Take

I think the benchmark numbers are legitimate and worth taking seriously — an 88.2% vulnerability-finding score and a reported 10x jump in patch quality over a competing lab’s model aren’t small claims, even accounting for the fact that Google is grading its own launch. What’s more interesting than the scores is what Google chose to do with them. A company that just built the best model in the world for security work decided the safest thing to do with that model was not let almost anyone use it.

That’s the right call, and it’s also an admission. You don’t need a Fairwind Program for a model that writes better marketing copy. You need one for a model good enough at exploiting software that handing it to the wrong account is a genuine incident waiting to happen. Google didn’t say that in the announcement. The access list says it for them.

For now, the practical reality is simple: unless you run cyber defense for a government, a utility, or a major platform, Carbon is a benchmark chart you can read, not a product you can buy. Judge the capability claims on their merits. Don’t plan around having access to them anytime soon.

Frequently Asked Questions

What is Gemini 4 Carbon?

Gemini 4 Carbon is Google’s frontier AI model, announced October 28, 2026, built around cybersecurity — finding, exploiting, and patching software vulnerabilities — and sustained agentic work on complex tasks over multiple days. It topped the Artificial Analysis Intelligence Index v5.0 with a score of 59.

Can I use Gemini 4 Carbon right now?

No. Carbon isn’t publicly available. Initial access is limited to select cyber-defender teams through Google’s Fairwind Program, which prioritizes government agencies, critical-infrastructure operators, and major tech platforms. Google hasn’t set a public release date for developers or consumers.

How does Gemini 4 Carbon compare to Gemini 4 Argon?

Carbon is Google’s second new frontier model in a month, following Gemini 4 Argon’s September 30 launch. Both launched through the same Fairwind access program, but Carbon posts higher benchmark scores on a harder test suite and leans even more heavily into cybersecurity, specifically vulnerability exploitation rather than just defense and patching.

How much does Gemini 4 Carbon cost?

Google set introductory pricing at $2 per million input tokens and $10 per million output tokens, rising to $4/$20 later, with cached input tokens discounted 95%. That pricing applies once access expands — it doesn’t currently get you in the door, since Carbon isn’t sold to the general public yet.

Why would Google restrict its best model instead of selling it?

Carbon’s strongest scores are in vulnerability discovery and exploitation — the same skill set that makes a model useful to attackers, not just defenders. Restricting initial access to vetted cyber-defense organizations is Google’s way of managing that dual-use risk before the capability reaches a wider, less-vetted audience.

What is Google’s Fairwind Program?

Fairwind is Google’s vetting pipeline for giving trusted organizations early access to frontier models capable of serious cybersecurity work, before those capabilities reach the general API. It prioritizes governments, national cyber agencies, critical-infrastructure operators, and major technology platforms.

How does Gemini 4 Carbon’s cybersecurity performance compare to other models?

Google says Carbon generates high-quality security patches more than 10 times better than a competing lab’s frontier model, based on internal testing by its Chrome team. Carbon scored 88.2% on SEC-bench Pro, 54.8% on ExploitGym, and 71.0% on CWE-bench — benchmarks for vulnerability finding, exploitation, and patching respectively.

---

Last updated: October 29, 2026. Sources: Google — Gemini 4 Carbon: our next frontier model · 9to5Google — Google announces Gemini 4 Carbon · Android Authority — Gemini 4 Carbon is Google’s second new frontier model this month · Interesting Engineering — Google’s Gemini 4 Carbon AI detects 88.2% of software flaws, works on tasks for days · Digital Trends — Google’s Gemini 4 Carbon is built for complex coding and cybersecurity tasks · Constellation Research — Google rolls out Gemini 4 Carbon.

Related reading: Gemini 4 Argon vs GPT-6 Astra vs Claude Opus 5.5 · AI Found the PHP2Shell Vulnerability Before Hackers Did · OpenAI’s Astra Crosses AI’s First Critical Cyber Line · Frontier AI Models Now Face a Secret Government Review · AI Agents Breached 100+ Companies for $5,000