Gemini 4 Carbon Launch Limited to Cyber Defense Teams

On Wednesday, October 28, Google DeepMind announced Gemini 4 Carbon, which the company describes as its strongest model for programming, long-duration tasks, and cybersecurity. The release has a particularity that directly interests CISOs: in this initial phase, the model is not available to developers, companies, or the general public, but rather to a select group of cyber defense teams chosen by Google's Fairwind program.

Carbon arrives two weeks after the Gemini 4 Argon, which also debuted with limited access. A broad availability has been promised, but with no date, according to coverage of the announcement by Investing.com and Interesting Engineering.

Security Metrics

According to Google, Carbon scored 88.2% on the SEC-bench Pro, a test for discovering vulnerabilities in real code; 54.8% on ExploitGym, which measures the ability to turn a flaw into a functional exploit; and 71.0% on CWE-bench, aimed at remediation. These three results were measured and reported by the company itself.

In the overall intelligence index from Artificial Analysis, version 5.0, the model ranks first, scoring 59 points. It is the closest external metric for a neutral comparison with models from OpenAI and Anthropic, though the index aggregates reasoning and programming tests, not security.

The launch price is $2 per million input tokens and $10 per million output tokens, the same as charged for Argon. For comparison, OpenAI released GPT-6.1 Terra on October 26 for $1 and $5 per million tokens, half the price, positioned as a faster and cheaper option for programming and computing tasks.

For a security team, the difference is significant due to volume. A scan of an entire codebase with a long-duration model consumes tokens at scale, and each execution on Carbon costs double what it would on Terra based on the launch table. The choice between the two depends on how much of Google's claimed advantage holds up in the organization's own code, a test that no benchmark table can replace.

Why Restricted Access Matters

The design of the launch reveals the problem Google is trying to manage. A model that scores 88.2% in flaw discovery and 54.8% in exploitation serves both defenders and attackers. Releasing it first to verified defenders gives these teams a window to scan their own code before the model, or an equivalent competitor, lands in less careful hands.

The counterargument also carries weight. Controlled access programs favor large companies and governments, which have the structure to pass the verification, leaving out most medium-sized organizations, particularly those with fewer personnel to fix flaws. This week highlighted the cost of this asymmetry: two critical vulnerabilities in PHP, CVE-2026-109618 and CVE-2026-109619, entered the CISA's catalog of exploited vulnerabilities on October 26, with active exploitation observed since October 21, according to watchTowr and Rapid7.

Europe and India

In the European Union, the launch arrives two weeks after the AI Office announced its first oversight measures against vendors of general-purpose models under the AI Act. A model with a declared ability to exploit vulnerabilities enters the center of the risk assessment obligations that the AI Act imposes on general-purpose models with systemic risk, and Google has not indicated whether broad release will have a different timeline for the region.

In India, which hosts security operations centers for global managed service providers, the effect is of another order. These centers serve clients in the United States, Europe, and Latin America, including Brazil, and the ability to utilize a model like Carbon depends on the provider being accepted into Fairwind. The end client, who outsources security operations, now has a new question to ask the vendor during contract renewal: who in the chain that protects their systems has access to the most capable model available, and who does not.

For corporate buyers, the launch shifts the criteria for evaluating AI models in security. Until now, the question was which model finds more flaws. With Carbon and Argon released by invitation, the preceding question now becomes whether the organization, or the partner that manages its security, is on the list.