Google DeepMind announced Gemini 4 Carbon on 28 October 2026 as its strongest model yet, built for cybersecurity and long-running work: it finds vulnerabilities, exploits them in controlled tests, and patches them, and it can stay on a large codebase for days. For a business, security work that queued behind scarce specialists could soon be handled by an AI agent — if your pipeline is ready.

There is one catch: you probably cannot use Carbon yet. Access is rolling out in stages, first to cyber defenders and then to trusted partners through Google's Fairwind Program, with no public date for general availability. Do not wait — fix your patching pipeline, tidy your codebases and set your guardrails now, so the day access arrives you are ready.

Gemini 4 Carbon: Secure Coding for Business, Explained

What Gemini 4 Carbon is — and why it arrived now

Carbon builds on Gemini 4 Argon, launched two weeks earlier and covered in our guide to Gemini 4 Argon and its 30 November pricing deadline. Where Argon is a general model for coding, finance, legal and science, Carbon is a specialist: Google positions it as state-of-the-art for cybersecurity and long-horizon work.

That specialisation targets a gap most businesses feel directly: vulnerabilities sit unpatched because triage is slow, patches break things, and the people who can do both are in short supply. But Carbon is also dual-use — a model that can find and exploit flaws can be misused, which is why Google is staging its release.

The numbers that matter — and the caveat that comes with them

Carbon ranks first on the Artificial Analysis Intelligence Index v5.0 with a score of 59. Google also reports three security benchmark results, all run without guardrails:

• SEC-bench Pro, 88.2%: finding vulnerabilities in code.
• ExploitGym, 54.8%: exploiting vulnerabilities in a controlled test setting.
• CWE-bench, 71.0%: patching vulnerabilities.

Google adds that secure-code generation more than doubled versus Argon and unsupported claims fell by about half.

State the caveat plainly: these are Google-reported, self-reported results, not independently verified. They describe a model under test conditions, not your codebase. Treat them as a reason to evaluate, not proof. Full details are in Google's Gemini 4 Carbon announcement.

What Carbon changes for secure software builds

The most practical promise of Carbon is secure-by-construction coding: a model that writes code and checks it, in the same pass, for the flaw classes that become breaches. But the value depends on how it is wired into your build.

Security checks inside the development loop

Today, most teams bolt security on at the end: a scan before release, a review when time allows, a patch after a report. Carbon-class models make a different shape possible — a security review on every pull request, a scan on every dependency change, a patch draft the moment a flaw is confirmed. A human still signs off, but the first pass stops being the bottleneck.

This matters most where software is the business: SaaS development, where a flaw ships to every customer at once; custom software development, where each codebase carries its own history; and ecommerce development, where payment and customer data raise the stakes. The model is only half the system.

Long-running coding and agent jobs, done properly

Carbon's long-horizon capability most changes what you can delegate. A model that can work a large codebase for days can take on jobs previously impractical for AI: migrating a legacy module, refactoring across services, or auditing a whole repository against a new standard.

That is also where risk concentrates: a long-running agent with broad access can make broad mistakes, quietly, at scale. Treat agent jobs like staff jobs — a clear brief, bounded permissions, human checkpoints, a rollback plan. Our guide to AI chatbots versus AI agents explains the difference between a tool that answers and an agent that acts.

Three rules for long agent jobs

• Scope the job in writing: repositories, branches, allowed actions, and what is off-limits.
• Checkpoint, don't just launch: human review after triage, after the first patch draft, and before any merge.
• Keep the audit trail: every finding, patch and decision logged, so an incident review can reconstruct what happened.

Security patching workflows: where Carbon pays first

If there is one workflow to prepare first, it is patching. Most businesses have a patching-throughput problem: findings arrive faster than fixes ship. Carbon's reported 71.0% on CWE-bench patching suggests it can draft fixes, but the workflow around the draft decides whether patches land.

A patching pipeline worth building now

1. Triage automatically: severity and blast radius assigned the moment a finding arrives.
2. Draft, then verify: every patch draft needs tests, a review and a staging run before production.
3. Measure time-to-patch: track how long each severity class takes from discovery to deployment.
4. Close the loop: confirmed fixes feed back into coding standards, so the same flaw class stops reappearing.

That pipeline is valuable with today's models and essential with Carbon-class ones — the same discipline behind reliable AI agent development.

The access reality: staged rollout, and why governance is the price of entry

Carbon is not generally available, and Google has given no public date for when it will be. The rollout starts with a subset of cyber defenders, expands to trusted partners through the Fairwind Program, and runs alongside Google's participation in the US government's voluntary pre-release model testing process.

That staging is good news, not a delay to resent. The exploit-side score — 54.8% on ExploitGym — is exactly why access is controlled: the capability that helps your defenders can help an attacker. Expect future general access to carry usage policies and accountability requirements. If you cannot say who approved an AI-generated patch and how it was tested, close that gap first.

What to do now, while access is limited

Waiting for general availability wastes the head start this announcement gives you. Four moves, in order:

1. Audit your patching pipeline this month. Measure time-to-patch by severity, find where findings stall, and fix the handoffs.
2. Prepare your codebases. Current documentation, consistent structure, tests that run.
3. Write the guardrails now. Approval rules for AI-generated patches, permission boundaries for agents, and audit logging.
4. Prototype with an available model. You do not need Carbon to build the triage and verification pipeline — run it with Argon, measure it, and swap the model in when access arrives.

Businesses in the United Kingdom, UAE, Saudi Arabia, USA and Pakistan face the same problem. The same discipline applies to chatbot development, WhatsApp bot development and our AI calling agent: every automated action needs an owner and a log.

Carbon will not fix your security posture on its own; it will multiply the posture you already have — good or bad. Build the pipeline, write the guardrails and start the audit now. If you want help, talk to Coheser about AI automation for your business — from patching workflows to systems like our restaurant ERP and our guide on how to build an AI voice agent.

Frequently asked questions

When will Gemini 4 Carbon be available to my business?

There is no public date for general availability. Access is staged: first cyber defenders, then trusted partners through Google's Fairwind Program. Prepare your pipeline and guardrails now rather than waiting.

What do Carbon's benchmark scores actually mean?

Google reports 88.2% on SEC-bench Pro (finding vulnerabilities), 54.8% on ExploitGym (exploitation in controlled tests) and 71.0% on CWE-bench (patching), plus first place on the Artificial Analysis Intelligence Index v5.0 with a score of 59. These are Google-reported, not independently verified, and run without guardrails.

How much will Gemini 4 Carbon cost?

It shares Argon's introductory pricing: $2 per million input tokens and $10 per million output tokens, cached input at 95% off, rising to $4 and $20 after the introductory period. Long-running jobs consume tokens over days, so budget per task.

Is Carbon safe to use, given it can exploit vulnerabilities?

It is a dual-use tool — exactly why Google is staging access and joining the US government's voluntary pre-release testing process. Safety comes from the system around the model: bounded permissions, human checkpoints and audit logging.

What should we do before Carbon becomes available?

Audit your patching pipeline, measure time-to-patch, clean up your codebases, write agent guardrails, and prototype triage-and-patch with a model you can use today. That preparation pays off immediately.