Gemini 4 Carbon: What Defenders Should Know About Google's Newest Model

Draft by Trevor Heshka, IT Support · Cybersecurity · Full-Stack & AI, Nanaimo BC

Two weeks after Gemini 4 Argon, Google announced Gemini 4 Carbon on October 28, 2026. Google calls it its strongest model, and the launch post puts cybersecurity front and centre. If you defend networks or handle IT for small businesses, that cuts both ways. A model that's better at finding and patching vulnerabilities is also better at finding them for someone else. This post covers what Carbon is, who can use it right now, what Google says about its security and safety, and how I'd think about it in a small IT shop.

What Carbon is

Carbon is Google's next frontier model after Argon, built for long-horizon coding and agentic work and for cybersecurity defense. Google says its internal teams have seen Carbon run for days on hard engineering problems, working through dead ends to root-cause and patch subtle bugs across large codebases and low-level systems.

The big difference from Argon is the rollout. Most of us can't call Carbon yet. Google says it's taking part in the U.S. government's voluntary pre-release model testing process and is starting with defenders before anyone else gets access.

The cybersecurity angle

Google says Carbon covers the whole defense lifecycle: finding vulnerabilities, confirming which ones are exploitable, and fixing them. These are the external benchmark results it reports (evaluated without guardrails):

"Without guardrails" is important. Those scores show what the raw model can do, not what the public version will help you with once it ships with safeguards.

Google also reported:

• Secure code: more than 2x uplift over Argon in the success rate for generating secure code, on internal benchmarks.
• Patching: Google's Chrome team found Carbon performed more than 10x better than another lab's large frontier model at generating high-quality patches.
• Web penetration testing: Wiz sees Carbon leading on web pen-testing benchmarks, which is core to its Scan for Good initiative (the same effort that turned up the government data exposure and healthcare master-key issues in the Argon launch).

The exploitation score is the one to sit with. A model that can turn more than half of the bugs it's given into working exploits helps a defender decide what to patch first. It's also why Google is gating access.

Safety claims

Carbon uses the same layered safety stack as Argon: model training, real-time misuse defenses, prompt-injection resilience and chain-of-thought monitoring. Google says it pushed harder on alignment this time, especially for complex or high-pressure tasks. What it reports:

• Fewer shortcuts: Successful cheating on Terminal-Bench 4.0 fell to 0.0%, and cheat attempts dropped to 0.4%, while overall accuracy went up. (Argon's shortcut attempts were about 2%.)
• Fewer serious alerts in real work: In live coding with Google's internal teams, high-severity misalignment alerts dropped by almost 80%.
• More honesty: About 2x fewer unsupported claims than Argon in internal testing. Google says Carbon puts caveats into the deliverable, or lists what's still needed when it can't do something, instead of making things up.
• Better behaviour when things are unclear: Carbon is meant to pull the relevant sources and flag discrepancies to the user before acting, rather than guessing.
• Staying in scope: Overreach down 26% and under-service down 29%, so it's both less likely to go beyond what you asked and less likely to stop short.
• Prompt injection: 0.0% attack success on Gray Swan's Indirect Prompt Injection (IPI) benchmark, down from Argon's 0.7%. Google says it resisted every evaluated attack attempt.

Those are strong numbers. Still, 0.0% on a benchmark means it resisted every attack in that test set. It doesn't mean nobody can inject it. Attackers will write new attacks, and an agent reading email or web pages still faces input nobody has tested. Build your setup on the assumption that something will eventually get through.

How to use it safely (when you can)

Carbon isn't on the public API yet, so I'm not going to guess at code. When it reaches developers, check Google's Gemini API docs for the model ID and settings rather than copying from a launch post. The ground rules I'd use don't depend on which model you're running:

• Keep your own judgment on. Treat findings as leads. Reproduce the issue before you file it, and test the patch before you ship it. A 71% patching score means a lot of patches still need work.
• Respect the gate. Fairwind is the route for vetted defenders. If you do this work professionally, apply there instead of trying to get around guardrails.
• Mind the data. Don't paste client secrets, credentials or regulated data into any model unless your agreement and your client's policies allow it. Strip keys out of code first.
• Only test what you're authorized to test. Exploitation ability doesn't change that rule.
• Budget for long runs. A model that can work for days can also bill for days. Put limits on agent runs before you start, especially after the intro pricing ends.

Practical tips for small BC businesses and IT shops

Most of the businesses I support around Nanaimo and Vancouver Island have one IT person, or someone like me on call. For now, Carbon matters to them mostly in two ways.

What to do now:

• Expect attackers to get faster. Models like this will eventually be widely available, with or without guardrails. Patch your public-facing stuff (websites, VPNs, remote access, PHP and WordPress installs) faster than you used to.
• Look for the boring exposures. The Wiz examples weren't exotic. They were things like a download path that exposed a file holding the keys. Check for backups, config files and exports sitting somewhere reachable.
• Use what you already have. Argon is available now on the paid API. You can get started on code and config reviews today and switch to Carbon once it opens up.

Still don't automate:

• Production changes without a person approving them. Firewall rules, account lockouts and patch rollouts need sign-off, even with better "stay in scope" numbers.
• Agents that read untrusted input and can also act. A 0.0% benchmark score is progress, not a reason to give an email-reading agent admin access.
• Final security sign-off. "The AI said it's fine" won't help you with your insurer or a privacy regulator after a breach.
• Anything involving client data you haven't cleared.

Closing

Carbon looks like a real step forward for defenders, and I like that Google is releasing it to defenders first and publishing specific safety numbers. The trade-off is that most small shops will have to wait. In the meantime, the job is the same: know what you have exposed, patch quickly, and check what the AI tells you before you act on it.

If you're a small business on the Island and want a second set of eyes on what's exposed, I'm happy to help.

Sources:

• Google: Gemini 4 Carbon: our next frontier model
• The Verge: Google launches Gemini 4 Carbon with a 'significant leap' in cybersecurity
• 9to5Google: Google announces Gemini 4 Carbon
• Earlier post: Gemini 4 Argon: What Defenders Should Know