Google has built the most capable model it has ever shipped, put it at the top of the benchmark charts, and then handed the keys to a room full of cybersecurity professionals while everyone else presses their nose against the glass. Say hello to Gemini 4 Carbon, announced on October 28, and say goodbye to any chance of actually using it this month.
This is not a normal launch. There is no waitlist you can game with a burner Gmail account, no free tier to abuse at three in the morning, and no API key for your weekend side project. Carbon is a frontier model with a velvet rope, and the bouncer is the United States government.
Google's blog post is refreshingly blunt about it. Carbon is described as the company's strongest model, with state of the art cybersecurity and long horizon capabilities, and the rollout is deliberately narrow. Cyber defenders first. Everybody else, eventually, maybe, when the guardrails have had a few more conversations with lawyers.
What Carbon does, in numbers that do not need a hype filter
Artificial Analysis updated its Intelligence Index to v5.0, a harder version of the test, and Carbon landed at 59, which is first place. Google gets to say "number one on a benchmark that got harder this week," which is the most defensible kind of bragging in this industry. It helps that Argon, the model launched two weeks earlier, set the previous bar.
The interesting part is where Carbon spends its extra intelligence. On SEC-bench Pro it scores 88.2% at finding real vulnerabilities in real software. On ExploitGym it hits 54.8% at determining whether a discovered flaw can actually be exploited. On Collinear's CWE-bench it reaches 71.0% at turning a validated finding into a working patch for the root cause.
Google's internal numbers are even more pointed. Carbon shows more than double the success rate of Argon at generating secure code, and the Chrome team reported patches ten times better than another lab's large frontier model. Wiz, which runs a web penetration testing program, says Carbon leads the benchmarks it tracks.
There is also the long horizon pitch. Google says internal teams have watched Carbon run for days, persisting through dead ends to root cause and patch subtle bugs across large codebases. Days. Most coding agents give up when a build fails twice.
The part where you cannot have it
Starting this week, Carbon goes to a subset of cyber defenders, then gradually to more trusted partners through something called the Fairwind Program. Google says it is participating in the US government's voluntary pre-release testing process, which is the modern way of saying the model has to show its homework before it gets to play outside.
Ars Technica summarized the announcement better than any press release could, with a headline calling Carbon "its latest frontier model that you can't use." That is the whole story in nine words. The best model on the planet is currently a museum piece with a security clearance.
Developers, businesses and consumers will get access "as soon as possible." In Google calendar math, that phrase has historically meant anywhere from three weeks to one full product cycle, and nobody should plan a startup around it.
Why the velvet rope is not entirely stupid
A system that autonomously finds real vulnerabilities at 88.2% and validates exploitability at 54.8% is not a toy, and shipping it to every curious teenager with a credit card would be an interesting experiment in applied chaos theory. The people who want this model most are, roughly, the people you least want holding it.
So Google stacked the safety numbers, and they are genuinely good. On Terminal-Bench 4.0, successful cheating dropped to 0.0% while attempts fell to 0.4%, meaning the model stopped looking for loopholes in the exam and started answering the questions. High severity misalignment alerts in internal live coding environments fell by almost 80%. Unsupported claims were cut roughly in half versus Argon. Overreach dropped 26% and under-service dropped 29%, which in plain language means Carbon stopped both inventing extra work and quietly skipping the boring parts.
The headline safety stat is indirect prompt injection. On Gray Swan's benchmark, Argon scored a 0.7% attack success rate, which was already the best in class. Carbon scored 0.0%, resisting every evaluated attack attempt. That is the AI equivalent of a bouncer who has never once been fooled by a fake ID, or a very good liar. Google insists it is the first one.
Web development got attention too. Carbon jumped 89 elo points to fourth place on WebDev Arena at 1768, a large single generation move for a model that is ostensibly about security, and Google says it now surfaces discrepancies to the user instead of guessing when a request is ambiguous.
The price, when access finally opens, is the same introductory rate as Argon: two dollars per million input tokens, ten dollars per million output tokens, with cached input at 95% off. That is a reasonable number for frontier capability, and it is also currently the best deal in AI that no one is allowed to purchase.
Which brings us to the strange shape of this launch. Google shipped a model, topped the leaderboard, published the numbers, set the price, and then politely declined to sell it. Rivals get a target. Security teams get a very expensive new colleague. Everyone else gets a blog post and a promise.
For now, Carbon exists mostly as a threat to the model you are using today. It will reach your products eventually, probably with a quieter announcement, and by then the benchmark it just won will look quaint.
Until then, the most capable model in the world is the one you cannot call. Somewhere in a security operations center, a defender is watching Carbon chew through a vulnerability backlog in an afternoon and thinking the same thing the rest of us are: cool, can I have one?
Comments