A model that improves performance in vulnerability discovery, exploitation verification, and patch generation. The most direct business move may not be to immediately open it up to everyone. On October 28th, Google chose a more targeted approach when releasing Gemini and Carbon: it first opened it to a select group of trusted network defenders this week, and will gradually expand access to more trusted partners through Fairwind Program, while also participating in pre-release model testing conducted by the U.S. government. Widespread use by developers, enterprises, and consumers is still to come.
Carbon is positioned as the most powerful model in the Gemini 4 series, with a focus on network security and long-duration tasks. The external benchmarks listed by the official include: SEC-bench with 88.2% vulnerability detection, ExploitGym with 54.8% exploitation validation, and CWE-bench with 71.0% root cause repair. These results describe the capabilities under specific evaluation settings; not every code library can achieve the same success rate, let alone authorized models attacking real systems on their own.
The release strategy and capability direction are integrated. The more effective a cybersecurity model is at detecting and exploiting vulnerabilities, the greater its defensive value; however, the direct risk of misuse also increases. Google does not automatically convert “leading performance” into “immediately available for everyone.” Instead, it first limits the users, collects feedback, and continues to adjust the safeguards. This approach separates the release date from the full market launch date, so readers should not assume that “already released” means that ordinary Gemini users can access Carbon today.
Being able to run for a few days doesn't mean it can be unattended.
According to Google, Carbon represents a continuous intelligent agent workflow design. The internal team has observed that it can run for several days, navigating through dead ends in large codebases and underlying systems, tracking and fixing minor defects. While persistence over a long period can reduce the disruption of tasks due to a single failure, it also magnifies issues related to permissions, costs, and the accumulation of errors. A model that can run continuously for several days requires clearer objectives, phased checks, and reversible tools, rather than less supervision.
On WebDev Arena, Carbon has improved by 89 Elo points compared to the previous stage, ranking fourth with 1768 points. This result also reminds the market that a model can lead in network security benchmarks, but it is not necessarily the best in every general development ranking. When evaluating models, it is important to break down the tasks separately; one comprehensive slogan should not be used to cover the differences in code, web pages, multimodal capabilities, and scientific reasoning.
The official also disclosed several internal security-related results: compared to Argon, the success rate of generating secure code has more than tripled; high-severity misalignment alerts in the internal environment have decreased by nearly 80%; in Terminal-Bench version 4.0, successful cheating attempts have dropped to 0, and the overall cheating attempt rate has reduced to 0.4%; the success rate of attacks that indirectly exploit injection benchmarks in Gray Swan is also 0. These results provide directional evidence, but since some of them are part of internal evaluations, actual deployment still requires independent penetration testing by a red team and log auditing.
There is also a deadline for the initial listing price.
Carbon has an initial price that is the same as Argon: 2 dollars per million input tokens and 10 dollars per million output tokens, with the caching input cost being 95% lower than the input price. The official footnote clearly states that after the introductory period ends, the prices will change to 4 dollars for input and 20 dollars for output. If a company estimates its long-term automation costs based on the initial launch price, it may mistake this temporary discount for a stable unit price.
In addition to price, the limited availability itself also affects procurement decisions. Currently, only a portion of network defenders and testing partners have access to the model, and the specific dates for the widespread API have not yet been announced. What companies can do now is to assess high-value tasks suitable for Carbon, establish authorization boundaries and validation sets, rather than including unobtained access rights in production schedules.
What’s truly worth watching in this release is not just the three security benchmarks. Google has incorporated strong network capabilities, long-term execution, limited initial rollout, and subsequent expansion into the same product decision-making process. Once the model is more capable of taking action, the way it is launched also begins to become part of the security design: first, it’s necessary to prove who can use it, where it can be used, and how any deviations can be detected; only then can we discuss deploying these capabilities across all products.
This also put a brake on the 'release upon completion' pace. Procurement parties can currently verify requirements and budgets, but they cannot directly use benchmark results as the standard for production of SLA. Even if the defense team is granted permission to test it, they should divide the process into three clear stages: model discovery, manual review, and patch deployment.
