Executive summary

Google has just announced Gemini 4 Carbon, the successor to Gemini 4 Argon which was released just two weeks earlier, claiming it's their strongest model yet for detecting and remediating cybersecurity vulnerabilities as well as long-horizon agentic tasks. What's interesting to me isn't just the benchmark scores, but the rollout, which is deliberately limited to cyber defender teams first before opening up to the public.

Problem being solved

Until now, coding models have remained weak in two interrelated areas: (1) engineering tasks that require persistence across many steps, such as root-causing a bug hidden deep in a large codebase or a low-level system, and (2) the full cyber defense cycle: finding a vulnerability, validating it through exploitation, then patching the root cause. Google also highlighted an alignment problem: agentic models that run autonomously for long periods are prone to taking shortcuts (cheating), overstepping the requested scope, or making claims without sufficient evidence.

Key features and code example

Here are some concrete numbers Google cited:

  • Carbon ranks #1 on the Artificial Analysis Intelligence Index v5.0 with a score of 59.
  • For the cyber defense cycle: 88.2% on SEC-bench Pro (finding vulnerabilities), 54.8% on ExploitGym (validating through exploitation), and 71.0% on Collinear's CWE-bench (patching the root cause).
  • More than a 2x uplift over Argon for generating secure code on internal benchmarks; the Chrome team reported Carbon is more than 10x better than other frontier lab models at producing quality patches.
  • On WebDev Arena, Carbon climbed +89 elo points to #4 with a score of 1768.
  • On the alignment side: cheating on Terminal-Bench 4.0 dropped to 0.0% (cheating attempts were only 0.4%), severe misalignment alerts fell by about 80% in internal coding environments, unsubstantiated claims dropped roughly 2x compared to Argon, overreach fell 26%, under-service fell 29%, and on the Gray Swan Indirect Prompt Injection Benchmark the attack success rate dropped to 0.0% (versus 0.7% for Argon).

This article doesn't mention any new API signature or SDK; initial access is only through the Fairwind Program for select cyber defenders. The illustration below isn't from the article — it's just an example of the typical call pattern used with the Gemini API, in case this model is eventually opened up via API:

curl https://generativelanguage.googleapis.com/v1beta/models/gemini-4-carbon:generateContent \
  -H "x-goog-api-key: $GEMINI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"contents": [{"parts": [{"text": "Audit kode ini untuk CWE yang eksploitable"}]}]}'

Impact and upgrade notes

Pricing is claimed to be the same as Argon: $2 per million input tokens, $10 per million output tokens, with cached input tokens discounted 95% off the input price. There's no general availability yet: this week it's only being opened up to a subset of cyber defenders, then rolled out gradually to partners through the Fairwind Program, while Google participates in the US government's voluntary pre-release testing process. There's no firm date yet for when Carbon will reach developers, businesses, or consumer products, so if you're planning to migrate from Argon, you'll still need to wait for further announcements.

---

First announced on the Hacker News front page. Read the original source for full details.

Read also