Gemini 4 Carbon Scores 88.2% on Finding Security Flaws: What the $2 Model Means, and Why You Cannot Try It Yet

Google announced Gemini 4 Carbon on 28 October 2026, just two weeks after Gemini 4 Argon, and called it its strongest model, with state of the art cybersecurity and long horizon capabilities. The announcement came from Google DeepMind, and it was reported the same day by Reuters and other major outlets. Carbon is not a small update to Argon. It is a new frontier model in the same Gemini 4 family, built for harder engineering problems that take a long time to solve, and for the full cybersecurity defence lifecycle: finding vulnerabilities, checking whether they are real, and patching them at the root cause.

The timing is part of the story. Two frontier models in two weeks is a pace that even Google noted in its own announcement, crediting researchers and models working together to move faster. For readers, the pace creates a practical problem. Argon only reached general developer availability on 13 October, and many teams are still testing it. Carbon arrives before most teams have finished that test, with a different strength, a restricted rollout, and a price that matches Argon's introductory price. This article separates what Carbon actually does, what it costs, who can use it now, and what a normal developer or security team should do while they wait.

What do the security scores actually mean?

Carbon's security claims cover three stages, and Google reports a separate benchmark for each stage. For finding real vulnerabilities, Carbon scores 88.2% on SEC-bench Pro, which tests whether a model can autonomously uncover complex flaws buried in real world software. For validating risk through exploitation, it scores 54.8% on ExploitGym, which tests whether a model can check if a vulnerability is actually exploitable in a controlled test. For patching at the root cause, it scores 71.0% on CWE-bench, which tests whether a model can turn a validated finding into a working code fix. Google describes all three as state of the art, and says the external benchmarks were evaluated without guardrails, which is an important detail: the scores measure raw capability, not the behaviour of a guarded product.

Those numbers need context before they become a buying decision. A high vulnerability finding score does not mean a model finds every flaw in your code, and a 54.8% exploitation score means that in almost half of the tested cases, the model did not validate the flaw by exploitation. That is still the leading score Google reports, but it is a reminder that security work is a pipeline, not a single score. A team that uses Carbon, when it becomes available, will still need a human to confirm the finding, decide whether the risk matters for their system, test the patch, and ship it through their normal review process. The model can speed up the first draft of that pipeline. It cannot sign off on it.

Google also reports internal benchmark gains that are harder to check independently. On internal tests, Carbon achieves more than twice the success rate of Argon for generating secure code. The Chrome team reported that Carbon performed more than ten times better than another lab's large frontier model when generating high quality patches, although Google did not name the other model. The Wiz cloud security platform also observes Carbon leading on benchmarks for web penetration testing, as part of its Scan for Good initiative. Treat the internal figures as Google's claims, not as independent verification, and wait for independent tests on your own codebase before you judge the model on your work.

What else improved besides security?

Carbon is not only a security model. Google reports significant gains across coding and agentic tasks, and it ranks number 1 on version 5.0 of the Artificial Analysis Intelligence Index with a score of 59, ahead of the other frontier models in that ranking at the time of launch. In web development, Carbon jumps 89 Elo points to land at number 4 on WebDev Arena with a score of 1,768, which suggests better output quality and artefacts for full stack web work. Google also says internal teams have run Carbon for days to persist through dead ends on complex, multi step engineering tasks, such as root causing and patching subtle bugs across large codebases and low level systems. That long horizon claim is the second half of Carbon's pitch: it is built to keep going on a hard task, not just to answer a short prompt well.

The safety and alignment claims are also specific, and they matter for a model that will be given access to code and security tools. Google says Carbon cuts unsupported claims by approximately twice over Argon, putting methodological caveats directly into the deliverable or withholding a blocked action with a clear list of what remains required, rather than fabricating missing evidence. In live coding environments with internal teams, high severity misalignment alerts dropped by almost 80%. Carbon reduced successful cheating on Terminal-Bench 4.0 to 0.0%, with attempts to cheat dropping to 0.4%, while improving overall accuracy. It reduced overreach by 26% and under service by 29%, meaning it is less likely to do more than asked and less likely to do too little. On prompt injection resistance, Carbon achieves 0.0% attack success on Gray Swan's Indirect Prompt Injection benchmark, compared with Argon's already low 0.7%. These are Google's internal and benchmark results, not guarantees for your deployment, but they show where Google focused its safety work: honesty about missing evidence, staying in scope, and resisting injected instructions in tool outputs.

What does Carbon cost, and how does caching change the bill?

Carbon launches at the same introductory price as Argon: $2 per million input tokens and $10 per million output tokens, with cached input tokens priced at 95% off the input token price. That cached rate works out to $0.10 per million cached input tokens. Reuters and other outlets report that after the introductory period, the standard price rises to $4 per million input tokens and $20 per million output tokens, matching Argon's standard pricing. Google's own announcement states the introductory price, and the standard rise is reported in the launch coverage, so budget on the standard rate for any long term plan, and treat the introductory rate as a window, not a permanent price.

Caching is the cost lever that matters most for security and agent work. A security review or a long coding agent will often reread the same codebase, the same documentation, and the same prior findings many times. If those repeated inputs are cached, they cost $0.10 per million tokens at the introductory rate, instead of $2 per million for fresh input. That is a 95% saving on the repeated part of the bill, and it is why agent loops and code review workflows can be affordable even on a frontier model. The output tokens, at $10 per million at launch, remain the expensive part, because every patch, report, and code change the model writes is billed as output.

Those examples are illustrations on the published per million rates, not quotes for a real project, because real jobs mix fresh and cached input, and output length varies with the task. The useful takeaway is simpler: at launch, Carbon costs the same as Argon did at launch, output costs five times input, and caching is the difference between a bill that scales with every reread and a bill that scales mainly with what the model writes.

Who can use Carbon now, and what should everyone else do?

Access is deliberately limited at launch. Google says that starting this week, Carbon will be made available to a subset of cyber defenders, and will gradually be phased to additional trusted partners through the Fairwind Program. Google is also engaged in the United States government's voluntary process for pre release model testing, and says it is gathering feedback and iterating on guardrails before making Carbon available to developers, businesses, and consumers through its product surfaces as soon as possible. There is no general public date in the announcement, no consumer app launch, and no developer self serve signup described for Carbon on day one.

That restriction is also a warning. When a powerful model is announced but not publicly available, fake access pages, fake API keys, and fake download links appear quickly. Do not pay for Carbon access from a third party site, do not enter your Google credentials into a page that claims to unlock Carbon, and do not install a tool that claims to be Carbon. The only access routes described by Google are the Fairwind Program for trusted partners and, later, Google's own product surfaces. If you are a cyber defender, check the Fairwind Program through Google's official pages. If you are not, the honest action is to prepare, not to chase a shortcut.

Preparation means three things. First, if you already use Gemini through the API, test Argon now, because Carbon's pricing matches Argon's introductory pricing and its strengths build on Argon's base. A workflow that works well on Argon, with clear prompts, cached context, and human review of patches, will transfer more easily to Carbon than a workflow built from scratch on launch day. Second, build the security review checklist that Carbon will feed into: what counts as a finding, who confirms it, how a patch is tested, and what evidence is kept. A faster model without a review process just produces faster unreviewed patches. Third, track the rollout from Google's blog and the Gemini API pricing page, not from social media screenshots, and note the date the standard $4 and $20 rates take effect, because that date changes the long term cost of any Carbon workflow.

Carbon's launch tells you where Google thinks the next frontier competition will be fought: not only on chat quality, but on secure code, long horizon engineering, and honest behaviour under pressure. The 88.2% vulnerability finding score is the headline, but the more useful numbers for a working team are the patching score, the caching discount, and the safety figures on scope and injection resistance. Those are the numbers that decide whether a model can be trusted inside a real codebase. For now, most readers cannot test Carbon directly. They can test Argon, prepare their review process, and be ready when Google opens Carbon beyond cyber defenders. That is a slower answer than a launch day signup, and it is the honest one.

Key takeaways:

• Google launched Gemini 4 Carbon on 28 October 2026, two weeks after Argon, as its strongest model for cybersecurity and long horizon engineering.
• Carbon scores 88.2% on SEC-bench Pro, 54.8% on ExploitGym, and 71.0% on CWE-bench, and ranks number 1 on Artificial Analysis Intelligence Index v5.0 with a score of 59.
• Launch pricing is $2 per million input tokens and $10 per million output tokens, with cached input at 95% off, which is $0.10 per million, and standard pricing is reported at $4 and $20 after the introductory period.
• Access starts with a subset of cyber defenders through the Fairwind Program, then trusted partners, with developers, businesses, and consumers to follow, with no general public date in the announcement.
• Google reports internal gains including more than twice Argon's secure code success rate, an almost 80% drop in high severity misalignment alerts, and 0.0% prompt injection attack success on the Gray Swan benchmark, all as Google's claims to be tested on your own work.
• Do not pay a third party for Carbon access, and prepare by testing Argon, building a human patch review process, and tracking the official rollout and standard pricing date.

Sources: Google blog, Introducing Gemini 4 Carbon, 28 October 2026; Reuters via Channel News Asia and The Hindu BusinessLine, Google launches Gemini 4 Carbon AI model with cybersecurity focus, 28 to 29 October 2026; Business Today, Google launches Gemini 4 Carbon AI model for cybersecurity and coding, limits initial access, 29 October 2026; Interesting Engineering, Google's Gemini 4 Carbon AI finds 88.2% of security flaws, 28 to 29 October 2026.

Affiliate disclosure: No affiliate link is used in this article. Links to Google and to TopUseAI posts earn no commission.