On October 28th, when Google announced Gemini 4 Carbon, it highlighted the most impressive figures in its cybersecurity evaluation: SEC-bench Pro was 88.2%, ExploitGym was 54.8%, and CWE-bench was 71.0%. However, ordinary developers could not directly access these figures on the product page that day. The initial access was limited to a group of network security professionals and was gradually expanded to trusted partners through Fairwind Program.
This combination of "high scores and narrow entry requirements" provides a better indication of Carbon's current position than just looking at the rankings alone. Google refers to it as the strongest model currently available, emphasizing its capabilities in long-term tasks, coding, and network security. However, its deployment status remains in the testing, feedback, and protection adjustment phases. Although the model's capabilities have been announced, the product's availability has not been made available simultaneously.
Cybersecurity capabilities are first applied in controlled scenarios.
Carbon continues the model development path after Gemini and Argon, with a focus on complex, multi-step, and time-consuming tasks. Google claims to have made significant improvements in coding and agent tasks, and has reduced instances of misexecution and fabricated content in internal usage. For cybersecurity work, such capabilities can not only help in identifying vulnerabilities, reproducing experiments, and generating patches, but also enable faster organization of attack steps. Therefore, an open approach is inherently part of the product design.
The initial users are limited to network defense personnel, and Google also stated that they are participating in the voluntary pre-release model testing conducted by the U.S. government. This sequence indicates that the company intends to observe the model within a recognizable professional community with feedback channels, rather than directly launching it on a wide scale with high baseline scores.
The three network security indicators provided in the announcement cover different aspects: identifying vulnerabilities, exploiting vulnerabilities, and patching vulnerabilities. They can indicate the performance of the model on a specific test set, but they cannot automatically prove the results in a real corporate environment. The scale of the codebase, permission configurations, dependency versions, business rules, and manual reviews can all affect the final outcome. Especially when both the ability to exploit vulnerabilities and the ability to patch them are enhanced, who has access to the model, how operations are recorded, and which tasks require approval become as important as the model itself.
Less overstepping and less omission are listed on the same table.
Carbon There is also a set of internal results that are more in line with the usage of intelligent agents. Google claims that the model has reduced "out-of-bound executions" by 26% in multi-step plans, and at the same time reduced "insufficient service" by 29%. These two aspects usually pull against each other: if the restrictions are too strict, the model may not dare to complete the task; if the focus is on completion rate, it may exceed its authority by expanding the scope on its own.
Report both items together, indicating that Carbon is not only trying to address the accuracy of answers, but also the boundary judgment during proxy execution. For enterprise users, the truly challenging scenarios are often not about the model's inability to write a piece of code, but whether it can perform only the authorized parts when it has the tools, files, and system permissions, and still complete the task successfully.
However, these figures come from Google's own evaluations and internal environments. The announcement does not make a commitment that they can be reproduced in all workflows. If companies gain access in the future, they will still need to verify them in their own repositories, approval chains, and risk levels, especially when it comes to production changes, sensitive data, and security tools.
Pricing has been announced, but the product timeline has not yet been finalized.
Google stated that when Carbon is officially launched, it will continue to use the entry-level pricing of Argon: $2 per million inputs of token and $10 per million outputs of token. The price for cached inputs is 95% lower than that for regular inputs. The prices are made public first to provide a basis for cost comparison for the development team, but "official launch" and "currently available" are two different states.
The company stated that it will continue to collect feedback and adjust its protection measures before making the product available to developers, enterprises, and consumers. No definite date was provided in the announcement. Therefore, the current conclusion is that Carbon has already entered a limited testing phase, and the pricing direction has been announced, but the full product launch is still to come later.
This release pushes model competition to a more realistic level. Benchmarks determine what models can do, access policies determine who can do it now, and permissions and audits determine how far they can go within an organization. The high scores of Carbon attract attention, while restricted access points remind users that the maturity of network security models cannot be judged solely by their test scores; it is also important to see how they are integrated into real systems. What is changing first is not the tools in everyone’s hands, but rather a few defense teams that have obtained new access points that are more powerful and thus require stricter constraints.
