Google launches Gemini 4 Carbon for specialized cybersecurity tasks

A targeted security launch

Google recently introduced Gemini 4 Carbon, a new model tailored for advanced cybersecurity and software engineering tasks. Unlike general-purpose models, Carbon is built to perform specific actions like identifying software vulnerabilities and validating whether those flaws can be exploited. It is also capable of generating patches to fix the issues it discovers.

The company is not releasing this model to the general public immediately. Instead, Google is following a phased rollout that prioritizes security defenders. This strategy aims to provide high-level tools to those who can use them responsibly while managing the risks associated with such powerful capabilities.

As TechRepublic reported, the model is currently being shared with selected partners through the Fairwind Program. This means that while the technology exists, most developers, businesses, and standard Gemini subscribers do not have access to it yet. There is currently no confirmed date for a broader release to the public.

Who gets the first look

The Fairwind Program is the primary gateway for accessing Gemini 4 Carbon at this stage. This program focuses on high-priority sectors that manage critical infrastructure, such as healthcare, telecommunications, energy, and financial services. It also includes national cybersecurity authorities and government entities.

Google has more than 650 partners within the Fairwind Program globally. However, being a partner does not automatically grant every organization access to Carbon. Organizations must request consideration through their Google Cloud account teams, where they will undergo checks regarding their security history and ethical operations.

For those who do not qualify for the Fairwind Program, Google offers a different model called Gemini 4 Argon. While Argon was expanded to eligible paid subscribers and enterprises on October 13, it does not include the specialized cybersecurity capabilities found in Carbon. This distinction ensures that the most potent security tools remain in the hands of vetted defenders.

Performance and benchmarks

To measure the effectiveness of the new model, Google conducted several evaluations. In these tests, Carbon achieved a score of 88.2% on the SEC-bench Pro, which measures the model's ability to discover vulnerabilities. It also scored 71% on the CWE-bench, which specifically looks at the model's ability to generate patches for those vulnerabilities.

Independent testing has also provided a broader view of the model's intelligence. On October 28, the evaluator Artificial Analysis ranked Carbon first on its Intelligence Index v5.0 with a score of 59. While this puts it at the top of that specific index, the report noted that it did not lead in every single category, including knowledge-work and coding.

It is important to note that these benchmark results are not a guarantee of how the model will perform in real-world production environments. Google emphasizes that while the scores are promising, the actual success rate of the model may vary depending on the specific complexity of the software and the environment in which it is deployed.

Balancing utility and risk

The reason Google is restricting access to Carbon is due to the dual-use nature of the technology. While the model can help defenders work faster to secure systems, it could also be misused by bad actors to find weaknesses in unprotected software. The potential for automated tools to accelerate exploitation is a significant concern for the tech industry.

Recent research has already highlighted these risks, with reports showing that AI agents helped compromise 440 PaperCut servers in September. These incidents illustrate how quickly automated tools can be used to target vulnerabilities at scale. By prioritizing vetted defenders, Google hopes to gather feedback and refine safeguards before a wider release.

Google is also participating in a voluntary pre-release model testing process with the US government. This participation is intended to help shape how these models are used safely, though it does not mean the government has officially certified or approved the model. This collaborative approach suggests a focus on establishing safety standards for high-stakes AI applications.

Pricing and next steps

Google has released introductory API pricing for Gemini 4 Carbon to give organizations an idea of the costs. The current rates are $2 per million input tokens and $10 per million output tokens. These prices are intended to be temporary, as Google plans to double them once the introductory period ends.

However, the publication of these prices does not mean that the API is open to everyone. Organizations must still meet the specific requirements for the Fairwind Program or wait for a general release announcement. For now, most IT teams will need to rely on existing models or traditional security tools for their current projects.

As the rollout continues, Google will likely refine the model based on the feedback from its initial security partners. Organizations interested in the technology should monitor their Google Cloud account teams for updates on program eligibility and any future announcements regarding broader availability for the general public.