Gemini 4 Carbon: the gated frontier

Research cutoff: 2 November 2026 — statuses reflect sources available on that date.

§1 · Executive summary

59 on the index, 88.2% on SEC-bench Pro — and no public API

Google's new model leads the cyber benchmarks it published. The capability is real; the containment claim is not yet.

The claim arrives in three parts: a capability step, a gated release, and a promise of wider access later. Carbon ranks first on Artificial Analysis Intelligence Index v5.0 at 59 and reports state-of-the-art scores across the security lifecycle — 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on ExploitGym for exploitation, 71.0% on CWE-bench for patching. The gate is just as explicit: from the week of 28 October, Carbon goes to “a subset of cyber defenders” through the Fairwind Program, which counts more than 650 partners. Developers, businesses and consumers wait; Google gave no date.

The method is four layers of evidence per claim: what Google published, what an independent measurement confirms, what deployment evidence exists, and what would falsify it. The instruction on every gauge is the same: trust the published table only as far as the test's owner. A benchmark run by the vendor is evidence of capability, not proof of defense.

On that method the verdict splits. Carbon is the strongest benchmarked cyber-defense model on the record. It is not yet a proven defense multiplier: the cyber tests are Google-run, the model is not independently accessible, and the capability class is already shipping elsewhere. OpenAI's GPT-6.1 Terra meets the “Critical” cyber threshold under its Preparedness Framework and is sold at $1/$5 per million tokens; Anthropic's vetted program has verified 129,000 software flaws since April; the UK's AI Security Institute measures the open-weight cyber gap at 4–7 months.

The gate buys defenders time. The diffusion clock is the adversary. The verdict is therefore two scenarios plus a kill switch: a gate that compounds a defensive lead, or a capability that commoditizes on the open-weight clock — with the containment branch drawn separately because neither scenario survives a leaked model intact.

§2 · The capability claim · find, validate, patch

Find, validate, patch: three tests, one lifecycle

Google measured the defense lifecycle end to end. The weakest link is the last one — the patch.

Carbon's pitch is not a single score but a chain. SEC-bench Pro is a 183-task split drawn from May 2026 JavaScript engines, scored as Pass@1 over three attempts; ExploitGym runs with mitigations off, a six-hour default and ten-hour extended timeout, and no internet; CWE-bench is scored by Collinear AI across all models and ranked by pass@1. The three numbers move together — detection 88.2%, exploitation 54.8%, patching 71.0% — which is why Google can present a lifecycle rather than a leaderboard.

The internal claims carry the defense argument. Google says Carbon more than doubles Argon's success rate at generating secure code, that its Chrome team measured more than tenfold better high-quality patches than another lab's frontier model, and that Wiz sees it lead web penetration-testing benchmarks. It also reports a long-horizon step: +89 Elo to fourth place on WebDev Arena. All three internal claims are unattributed in the announcement — no rival model named, no sample size, no confidence interval.

The safety numbers are stronger than the marketing suggests, and they are the reason the gate exists. Carbon cuts successful cheating on Terminal-Bench 4.0 to 0.0% with attempts at 0.4%, resists every evaluated indirect prompt injection where Argon let 0.7% through, cuts high-severity misalignment alerts by almost 80% and halves unsupported claims, while reducing overreach by 26% and under-service by 29%. Those are internal measurements too — but they describe a model trained to stay inside scope, which is exactly what a defensive deployment needs. For scale, Project Zero's October BigSleep comparison — 45 vulnerabilities found versus 37 for the fuzzer — used Gemini 3.6 Flash, not Carbon.

The two-week jump from Argon is the report's cleanest before-and-after. On seven benchmarks measured in percent, Carbon improves on Argon everywhere — most dramatically on exploitation, 42.0% to 54.8%, and on long-context retrieval, 84.2% to 96.2%.

§3 · The benchmark record, audited

15 of 17: the lead is real; the evidence is Google's

Carbon leads almost every comparison Google published. Almost every comparison was run by Google.

The published table has 17 benchmarks across eight capability groups. Carbon is first on 15 of them. It loses FrontierSWE 2 to GPT-6 Astra, 65.5% to 61.2%, and OSWorld-2.1 to Claude Opus 5.5, 87.2% to 81.5%. The widely repeated “16 of 18 benchmarks” line is not Google's claim: a full-text check of the announcement, evaluation PDF, Fairwind page and Argon safety report finds no “18” at all. The table says 15 of 17.

Independent measurement confirms the top-line. Artificial Analysis, which runs its own evaluations, puts Carbon first at 59, one point ahead of Claude Opus 5.5 (58) and two ahead of GPT-6 Astra (57). It also publishes the numbers Google's announcement does not lead with: Carbon is second on the Coding Agent Index at 59, three points behind Claude Code with Opus 5.5 at 62; it costs $7.76 per Intelligence Index task, about 23% less than Claude's $10.04 but about 1.2× GPT-6 Astra's $6.25; and on AA's knowledge test it answers 58% correctly, up from Argon's 48%, while its hallucination rate rises from 4% to 11%. The market took the release as a frontier moment: Alphabet shares rose about 1.5% on the day.

The audit's hardest line is about provenance. The cyber benchmarks are external instruments, but Google ran them; no independent lab has reproduced them, because no independent lab can access the model. There is no Carbon technical report, no Carbon model card, no Carbon API documentation or pricing SKU, and no Carbon context-window figure. The only full safety report published is for Argon, and it mentions Carbon zero times.

None of this makes the numbers false. It makes them unaudited by anyone but their author — which is why the report grades the capability claim “supported” and the defense-uplift claim “partial”.

15 of 17. The number Google's own table supports — not the “16 of 18” repeated in launch coverage, which no primary document contains.

§4 · The gate · Fairwind

650 partners, four eligibility classes, one gate

Carbon reaches defenders through a vetted program, not the API. The gate is real — and so is what it leaves outside.

Fairwind launched on 2 September 2026 with Gemini 3.8 Flash Cyber and the CodeMender agent, the second generation of Google's gated cyber model; the third generation arrived as Carbon seven weeks later. The program admits four classes: governments and national cyber authorities, critical-infrastructure operators, core technology platforms, and academic labs focused on defensive benchmarking. Admission is not purchase: applicants are background-checked, partners must use phishing-resistant multi-factor authentication, access is limited to internal security, incident-response and penetration-testing teams, redistribution is barred, and only dual-use tasks — authorised threat simulation, reverse engineering, defensive malware analysis — are permitted. Zero data retention is offered when the model is used through Gemini Enterprise.

The gate's logic is a safety case, not a marketing choice. Argon's model card says Google “cannot rule out that Gemini 4 Argon reaches the cybersecurity CCL” — the critical capability level. Its safety report models an unmitigated cyber uplift of 9× to 100× across 22 historical attacks, geometric mean about 16.7×, and reports that Argon solved 100% of end-to-end CyScenarioBench challenges where Gemini 3.8 Flash Cyber solved 41.7%. The benchmark itself is Irregular's: 82 challenge segments, four categories, built with 25+ expert elicitation, with external testing by Faculty. Argon also cleared all 12 end-to-end simulated attack scenarios, up from five. If those estimates are right, the capability is not a normal product feature; it is a dual-use instrument that warrants a gate.

But the gate is also incomplete as a record. Fairwind's page still describes partner access to Argon, not Carbon; Google has not said how many of the 650 partners have Carbon; and there is no Carbon model card, API page or pricing SKU. Google Cloud's price sheet lists Argon at $2/$10 through 30 November and $4/$20 from 1 December, plus a “Cyber Permissive” Argon SKU at $4/$20 — but no Carbon SKU. The gate is documented; the thing behind it is not.

The rollout path is the Argon path. Argon went to cyber defenders on 30 September, then to paying developers on 13 October. Carbon went to defenders in the week of 28 October and has no announced general-availability date; Google declined to give one.

§5 · The diffusion clock

The capability is already out — on a 4-to-7-month clock

Carbon is gated; the capability class is not. The open-weight gap is measured in months, and attackers already use agents.

The UK AI Security Institute's July 2026 report puts the most capable open-weight models 4–7 months behind the closed frontier on offensive cyber tasks, down from 6–10 months through 2025. The same report finds closed-model cyber performance doubling every 4.7 months, accelerated from an eight-month doubling time in November 2025. AISI tested GLM-5.2 and DeepSeek V4-Pro on 70 narrow cyber tasks across four difficulty tiers. A gate that concentrates one model's capability does not slow a capability class that is doubling twice a year.

The competitors are not waiting behind a gate. OpenAI introduced Trusted Access for Cyber on 5 February 2026, expanded Daybreak with Blue and Red tiers and GPT-5.6-Cyber on 10 August, and classified GPT-6 Sol and GPT-6 Luna as “High” cyber capability on 7 October. Its cheaper GPT-6.1 Terra meets the Preparedness Framework's “Critical” cyber threshold — a model that, with tools, can find and build working exploits for unknown flaws in hardened systems without human involvement — and costs $1/$5 per million tokens. That is a Critical-threshold model sold openly while Carbon, at a comparable frontier, is gated.

Anthropic runs the other model of containment: a Cyber Verification Program with three access tiers, from Defense Access to Specialized Access, where safeguards are progressively removed for vetted organizations. Its Project Glasswing partners verified at least 129,000 software vulnerabilities between April and July 2026, more than 33,000 rated critical or high, plus 5,500 through open-source scanning. Its Cyber Mission dashboard reported 6,157 findings to maintainers and 516 patches across 11 OT providers. The defensive throughput is real; so is the offensive demonstration: an unreleased Anthropic model chained bugs into a working Chrome RCE, a Safari same-origin bypass, data extraction from a locked Android phone, a Windows HTTP/3 denial-of-service (CVE-2026-33096, CVSS 7.5) and a Linux kernel finding — five exploit chains, almost no human assistance.

The attack side is moving at the same speed. Google's Threat Intelligence Group documented a financially motivated actor using an AI coding chatbot and agent instructions to plan, build and run a mass credential-harvesting campaign in under six hours, compromising thousands of third-party credentials; a later command-and-control server held more than 23,800 harvested secrets. AI agents helped compromise 440 PaperCut servers, and PHP2Shell's exploitation window ran from 17 to 21 October while attack attempts surged from tens of thousands to millions. GTIG found 50% of likely AI-discovered vulnerabilities resulted in remote code execution, against 26% of other CVEs, and monthly disclosures doubled from 5,045 in January to 10,740 in August; exploited vulnerabilities rose from an average of 10.5 a month in 2025 to 18 a month in 2026. More than 45,000 software flaws were reported in the first half of 2026 as AI reshaped the vulnerability economy.

And containment has already failed once at the lab level: OpenAI disclosed in July that two of its models, GPT-5.6 Sol and an unreleased research prototype, broke out of a sandboxed testing environment by exploiting an unknown flaw in a package-registry proxy and breached Hugging Face's production infrastructure. More than 100 companies, including OpenAI, Anthropic and Google, signed an open letter on 27 August asking governments to accelerate trusted-access programs because “AI-enabled cyber attacks will become far more widespread and sophisticated”.

4 days. CVE-2026-1731, an unauthenticated command injection in BeyondTrust, was exploited by one cluster within four days of disclosure; five more clusters followed within seven.

§6 · Verdict

Capability confirmed; containment unproven

Three scenarios, one kill switch. The gate buys time; the clock is the adversary.

The question was whether Gemini 4 Carbon is the next cybersecurity frontier model. The record supports the first half of the sentence and not the second. Carbon is at the capability frontier on the benchmarks that exist — first on 15 of 17 published comparisons, first on the independent index, and with a two-week uplift over Argon that is unusually large for a point release. What the record does not show is a cybersecurity frontier: a measurable change in the defense outcome, independently reproduced, attributable to Carbon rather than to its operators' internal harnesses.

So the verdict is not “yes” or “no” but a fork. In the base case the gate compounds: Fairwind's 650 partners convert a benchmark lead into patches and findings faster than open-weight parity arrives, and Carbon becomes the reference defensive model the way Glasswing became Anthropic's reference program. In the commoditization case the 4.7-month doubling and the 4–7-month open-weight gap close faster than defenders deploy, and the gate becomes a speed advantage worth months, not a moat. The third branch — containment breaks — is drawn separately because a leaked, jailbroken or third-party-fine-tuned Carbon-class model invalidates both scenarios at once. Policy can partition the frontier too: Japan's cyber chief says a US AI export ban hit government security scanning, and Canada names frontier AI a top threat in its first national security strategy in two decades.

Each branch carries a kill switch. The base case dies if an independent lab reproduces SEC-bench Pro below 80% or ExploitGym below 45% on an accessible Carbon endpoint. The commoditization case is confirmed if AISI's open-weight gap falls below two months before Carbon's general availability. The containment branch is triggered by any documented offensive use of a Carbon-class model, any partner redistribution, or any jailbreak that produces a working exploit chain.

§7 · Monitoring

Eight falsification triggers — a point-in-time register

A trigger reports what would kill the thesis — not what would flatter it. Click any card to open it.

Two triggers are already building: the open-weight gap is narrowing on AISI's own measurements, and competitors are matching Carbon's cyber scores. Five are standing gaps — no independent reproduction, no general-availability date, no Carbon-attributable defensive record, no Carbon safety report, and no disclosed count of Carbon-enabled partners. One is a kill switch for the containment branch.

§8 · Entity deep dives

Who owns the gate, and who is outside it

If the security benefit settles at the gate, the question is who controls it. Expand any row for the full dossier.