Gemini 4 Carbon: Can Google’s AI change cyber defense?

A leader on one index is not a universal winner

Gemini 4 Carbon scores 59 on the Artificial Analysis Intelligence Index v5 in its High configuration, placing it at the top of the published comparison. This is an external multi-task evaluation, not an AgentenCode hands-on test and not proof that Carbon wins every software engineering workload.

Methodology matters: model settings, the precise benchmark and measurement date can change the order. Google's specialist cybersecurity numbers come from its launch material and should not be presented as if the Artificial Analysis ranking independently reproduced those particular tests.

Finding flaws, developing exploits, writing patches

Google reports results on three distinct security benchmarks: SEC-bench Pro measures vulnerability discovery, ExploitGym tests exploitation under controlled conditions, and CWE-bench evaluates patching. These are bounded benchmark outcomes, not universal success rates for enterprise networks.

The useful opportunity is linking these stages in a traceable workflow. A suspected vulnerability needs reproduction; an exploit demonstrates impact; a fix still needs testing for regressions and unintended changes. Those steps are also precisely where unrestricted autonomous access becomes risky.

Source: Google's announcement, 28 October 2026. Values are vendor-reported; setup and safeguards affect comparability. Official source ↗

Long-horizon engineering raises the stakes

Google designed Carbon for sustained, multi-step engineering work. An agent can plan a sequence of inspections, run tools, examine failures and propose code changes. Longer tasks may reduce repetitive work, but they also multiply the consequences of an unchecked assumption.

Production adoption still calls for scoped permissions, isolated environments, code review, repeatable tests and human approval for sensitive actions. A foundation model is not a turnkey agent service. Carbon support in Gemini CLI, Antigravity or specific Google products should not be assumed without product-level confirmation.

Promising safety numbers still have boundaries

Google says internal tests found approximately half as many unsupported claims as with Argon and nearly 80% fewer high-severity misalignment alerts in its own live coding environments. On one reported Gray Swan indirect-prompt-injection evaluation setting, Carbon recorded a 0.0% attack success rate.

No finite test rules out future attacks. Prompt-injection resilience depends on deployment controls, tools, instruction boundaries and the attack distribution. Performance on an intelligence index and reliability under real security conditions are different questions.

Fairwind access comes before general availability

Google says access begins with a limited set of cyber defenders, then expands to reviewed partners through the Fairwind Program. It has not published a firm date for broad developer, business or consumer access.

That phased launch reflects a dual-use problem: the same techniques that help defenders find weaknesses may help attackers. Partner vetting, access restrictions and authorized-use policies are relevant to the release, but they are not independent proof of flawless risk control.

Announced token pricing, not unrestricted access

Google lists introductory pricing of $2 per million input tokens and $10 per million output tokens, rising to $4 and $20 after the introductory period. Cached inputs are advertised at a 95% discount to the relevant input-token price.

Prices should be treated as launch terms, not a guarantee that every developer can purchase access now. Real operating costs may also include reasoning tokens, tool execution, retries, test environments and human review.

Our view: the hard problem is governable autonomy

Carbon is an important sign of the shift from chat systems towards AI that can work through difficult technical problems. Security teams stand to benefit from reproducible findings and reviewable fixes, provided the model is deployed with careful controls.

The crucial question is not who tops the latest leaderboard. It is whether an agent can remain within a defined mandate over many steps, expose uncertainty and safely undo bad changes. Until independent field results and wider access exist, Carbon is a consequential but restricted frontier-model announcement, not an independently certified autonomous security product.