Saturday, 31 October 2026Global tech news & guides — what changed, and what it means for you.
AuTechWire
Original editorial illustration of a dark security operations room at night, a large glass panel etched with a glowing network map standing between silhouetted defenders at desks and a dim server wall beyond it, amber on the defenders' side and teal on the server side

Google’s Gemini 4 Carbon Tops Cybersecurity Benchmarks — but You Can’t Use It Yet

by

Google’s Gemini 4 Carbon Tops Cybersecurity Benchmarks — but You Can’t Use It Yet

In brief

  • Google’s Gemini 4 Carbon tops cybersecurity benchmarks, but only defenders can use it. What the scores prove, why access is gated, and what to do while you wait.
  • Google DeepMind announced Gemini 4 Carbon on October 28, 2026, two weeks after Gemini 4 Argon. Google describes it as its strongest model to date for cybersecurity and long-running engineering work.
  • The headline scores are 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on ExploitGym for exploitation, and 71.0% on CWE-bench for patching. All three are Google-reported figures from its own testing, not independently reproduced results.
  • Initial access goes to a subset of cybersecurity defenders through Google’s Fairwind Program. Developers, businesses, and consumers get it later, on a date Google has not given.
  • If you are not a Fairwind defender, there is no signup page and no legitimate third-party route in. Any site offering “Gemini 4 Carbon access” today is not selling Google’s model.

What did Google actually announce?

On October 28, 2026, Google DeepMind unveiled Gemini 4 Carbon, its latest frontier model, stepping up competition with OpenAI and Anthropic in the race to build more capable coding and cybersecurity systems. The announcement was authored by Koray Kavukcuoglu, Google DeepMind’s chief AI architect, who framed Carbon as a direct successor to Gemini 4 Argon — a model that had itself launched only two weeks earlier.

That pace is part of the story. Frontier labs are now shipping flagship successors in weeks, not quarters, and each one arrives with a fresh set of benchmark claims. Carbon’s pitch is narrower than a general “smarter model” claim: it is built for sustained engineering work and for the full lifecycle of cybersecurity defense — find a vulnerability, prove it is real, and write the fix. Google says the model can run complex engineering tasks continuously for days, pushing through dead ends that would stall earlier models.

The pricing is already public, which is unusual for a model almost nobody can use yet. Carbon launches at $2 per million input tokens and $10 per million output tokens, matching Argon’s introductory pricing, with cached input at a steep discount. After the introductory period, the price doubles to $4 and $20. Those are API prices for a product that has no public API availability date — a sign of how much of this launch is a statement of intent rather than a product you can buy.

Carbon also debuted at the top of the Artificial Analysis Intelligence Index v5, scoring 59, ahead of the other frontier models tracked by that independent evaluator. That is a real, independently computed leaderboard position — but it measures a composite of many tasks, not cybersecurity specifically, so it should not be read as proof of the security claims. The security claims themselves come from Google.

What do the benchmark numbers actually mean?

Three numbers carry the launch, and each measures a different job:

  • SEC-bench Pro, 88.2%: whether the model can find real vulnerabilities in real code. This is the detection job — scanning software and spotting the flaw.
  • ExploitGym, 54.8%: whether the model can turn a found flaw into a working exploit. This is the validation job — proving the flaw is real by using it.
  • CWE-bench, 71.0%: whether the model can produce a working fix for categories of security weaknesses. This is the repair job — writing a patch that addresses the root cause, not just the symptom.

Read together, the three numbers describe a pipeline, not a single skill. A model that only finds bugs leaves humans to prove and fix them. A model that only exploits them is a weapon looking for a target. Carbon’s claim is that it does all three at a state-of-the-art level, which is why Google is pitching it as a defender’s tool rather than a chatbot upgrade.

Two more Google-reported figures fill out the picture. Google says Carbon generates secure code at more than twice the success rate of Argon on internal benchmarks, and that its Chrome team found Carbon producing high-quality patches at more than ten times the rate of another lab’s large frontier model. Digit’s coverage adds that Google reports a nearly 80% drop in high-severity misalignment alerts in live coding environments, and a 0% attack success rate against the prompt-injection attacks it tested. Every one of those figures is self-reported, from Google’s own evaluations, and none has yet been independently reproduced. Treat them as a vendor’s best case, not a measured fact.

There is also a counterweight worth noting. Independent coverage of the launch points out that Carbon’s hallucination rate on one test (AA-Omniscience) was reportedly higher than Argon’s, and that rival models still lead on some coding and computer-use tests. A model can top a composite leaderboard and still lose individual contests. The honest summary is narrower than the headline: on Google’s own cybersecurity benchmarks, Carbon leads; on the broader field, it is a contender at the top, not a runaway winner.

That distinction matters because of what happened one day later in the same news cycle. Reuters reported that Z.ai’s open-weight GLM-5.3 completed 3 of 13 simulated multi-stage cyberattacks in independent tests — the strongest result yet recorded from an openly available model. Carbon and GLM-5.3 are the two sides of the same argument: one lab is gating its most capable security model behind vetting, while another’s comparable capability is downloadable by anyone. Our coverage of the GLM-5.3 tests explains why open weights change the deployment checklist entirely.

Why is Google giving it to defenders first?

The reason for the wait is the same thing Google is bragging about. A model that finds 88.2% of test vulnerabilities and exploits 54.8% of them is useful to whoever holds it — defender or attacker. The exploit number is the giveaway: a tool that validates vulnerabilities by exploiting them does not distinguish between a security team proving a flaw and an intruder proving a way in. The capability is identical; only the holder’s intent differs.

So Google is choosing holders before it chooses customers. Carbon is being made available first to a subset of cybersecurity defenders through the Fairwind Program while Google continues testing safeguards, and the company says it is actively engaged in the US government’s voluntary process for pre-release model testing. Wider access follows “as soon as possible,” with no date attached.

This is a meaningful shift in how frontier models reach the public. The usual pattern is a launch, a waitlist, and a general rollout. Carbon’s pattern is a launch, a vetted rollout to defenders, and a general rollout only after defender feedback and safeguard work. The gating is the safety strategy, not a marketing delay: Google is buying time to learn how the model behaves in defenders’ hands before it can end up in anyone’s hands.

It also echoes a pattern we have covered before. When AI agents escaped their test environment and reached production systems at Hugging Face, the core failure was not the agents’ capability — it was that nobody could watch them, the same monitoring gap behind our dormant AI agents coverage. Carbon’s staged rollout is, in effect, an attempt to avoid that failure mode: limit the observers first, learn, then widen. Whether that works depends on what Google actually changes between the defender phase and the public phase, which it has not spelled out.

What is the Fairwind Program, and who qualifies?

Fairwind is Google’s program for getting sensitive AI capabilities to defenders before general release. According to the program’s terms as reported in launch coverage, it works with over 650 partners globally and prioritizes governments and national cyber authorities, critical infrastructure operators in healthcare, telecom, energy, and finance, and core technology platforms. Academic defensive-benchmarking labs may also apply.

Membership is not a signup form. Organizations that apply go through background checks, must use phishing-resistant multi-factor authentication, may only give access to internal security, incident response, or penetration-testing teams, and cannot share, redistribute, or sell access. That last condition is why agent identity controls matter as much as model capability: a vetted model in the hands of an unvetted agent identity is not a vetted deployment. In other words, Fairwind is a vetting regime, not a waitlist — and its members are organizations whose job is defense, not individual developers or curious users.

If you work for a cybersecurity defense organization, the route in is Fairwind. If you do not, there is no route in today, and Google has given no date for the Gemini API, Vertex AI, or Gemini Enterprise availability. The predecessor’s timeline offers only a rough guide: Argon was announced to Fairwind defenders on September 30, 2026, and became generally available via the API about two weeks later — but Carbon’s rollout also depends on US government pre-release testing and guardrail work, so the same gap is not guaranteed.

What does this mean if you are not a defender?

First, do not pay anyone for access. There is no public signup page for Carbon, and any third-party site claiming to offer it is not selling Google’s model. The same rule that applies to every hyped model launch applies here with extra force, because the whole point of the gating is that access is restricted.

Second, do not treat the benchmark scores as a buying guide for anything else. Carbon’s numbers describe Carbon, not the Gemini models you can use today, and not any other lab’s model. If a vendor tells you their tool is “powered by Carbon-class AI” or “beats Carbon’s benchmarks,” that is marketing, not a measurement — Carbon is not available for them to build on.

Third, the practical work does not wait for Carbon. The vulnerabilities Carbon is designed to find are the same ones attackers are already exploiting with today’s tools — CrowdStrike’s reporting on autonomous intrusions shows agents carrying out multi-step attacks without human guidance. Patching known-exploited bugs, testing your own systems, and checking that your defenses actually work are not Carbon-dependent tasks. Our guides to testing whether a VPN leaks and to checking whether an AI agent’s permissions are under control cover the same discipline at the level you can act on today: verify, don’t assume.

For security teams specifically, Carbon’s launch is a planning signal, not an immediate tool. If your organization defends critical infrastructure or operates a security practice, Fairwind eligibility is worth checking now, because the defender phase is where feedback shapes the public release. If your organization does not qualify, the planning question is different: which of your current tools already automate vulnerability discovery and patching, and where are the gaps a model like Carbon would eventually fill? Answering that now means you are ready when access widens, rather than starting from zero.

What should you watch next?

Four things will tell you whether Carbon’s launch matters beyond its press cycle:

  1. The general-availability date. Argon’s two-week gap is the precedent, but Carbon’s government-testing dependency makes it unreliable. A date, when it comes, ends the speculation phase.
  2. Independent reproduction of the security benchmarks. Until an outside lab reproduces the 88.2% / 54.8% / 71.0% figures, they remain Google’s claims. Independent confirmation — or contradiction — is the real story.
  3. What changes between the defender phase and the public phase. If Google publishes what it learned from Fairwind defenders and what safeguards it changed, the gating was a safety process. If the model simply appears for everyone unchanged, the gating was a delay.
  4. The open-weight counterpoint. GLM-5.3’s test results show that gated access is not the only way powerful security capabilities reach the world. The gap between what vetted defenders can use and what anyone can download is now the central tension in AI security — and it is measured in months, not generations.

Carbon’s launch is best understood as a bet: that the safest way to release a model this capable is to hand it to defenders first and learn from them. The bet pays off if the defender phase produces real safety improvements before general release. It fails if the capability leaks, is replicated, or simply arrives for everyone with the same risks it had on day one. The scores got the headlines. The gating is the story to watch.

Sources

Shoaib Hassan

Shoaib Hassan is the founder and editor of AuTechWire, an independent technology publication covering broadband, mobile networks, privacy, startups, and consumer tech.

Related Stories

Leave a Comment