Google Built Its Best Model Yet. You Probably Can't Use It.

Google shipped its strongest model yet this week, and almost nobody can use it. Gemini 4 Carbon went live on October 28, and instead of the usual launch day stampede of API keys and consumer app updates, Google handed it first to a small group of "cyber defenders." Everyone else gets in line.

That is a strange way to release a flagship. It is also the most interesting thing about this launch.

What Carbon actually is

Carbon is the follow-up to Gemini 4 Argon, which Google shipped roughly two weeks earlier around October 13. Two frontier models in a month is not a normal cadence, even by 2026 standards, and it says something about how the labs are now competing. Argon was the general release. Carbon is the specialist.

The pitch is narrow and specific: security work, long-horizon agentic tasks, and coding. Koray Kavukcuoglu, SVP at Google DeepMind and Chief AI Architect, framed it plainly in the announcement: "Today, we're announcing the next frontier model: Gemini 4 Carbon, our strongest model with state-of-the-art cybersecurity and long horizon capabilities." (That is the quote as published, no hedging needed.)

The benchmark table is where Google makes its case. Carbon tops Artificial Analysis Intelligence Index v5.0 at 59. It scores 88.2% on SEC-bench Pro for vulnerability finding, 54.8% on ExploitGym, and 71.0% on CWE-bench for patching. Those numbers are all self-reported and Google notes the evals were run "without guardrails," so treat them as a ceiling rather than a floor. Still, the direction is clear.

The prompt-injection result is the one worth staring at. On the Grey Swan indirect prompt injection suite, Carbon allowed 0.0% attack success. Argon was 0.7%, Claude Opus 5.5 was 1%, and GPT-6 Astra was 8.5%. If that holds up outside Google's test harness, it is the single most consequential number in the release, because prompt injection is the vulnerability class that has quietly blocked every serious agent deployment for the past two years.

The security-first rollout is the story

Google is not shipping Carbon to everyone. The company says it "will make Carbon available to a subset of cyber defenders and will gradually phase access to additional trusted partners through our Fairwind Program." Developers, businesses, and consumers come later, "as soon as possible," with no date attached.

Ars Technica's Ryan Whitwam opened his coverage with a knowing sigh, and he has a point. Every launch since GPT-4 has come with a claim about new thresholds. What makes this one different is that Google is voluntarily restricting its own revenue window in order to stage access, and the reason is explicit: the company says it is "actively engaged in the U.S. government's voluntary process for pre-release model testing."

That is a notable shift in posture. For most of 2025 and 2026, labs have treated pre-release government review as a checkbox, something to satisfy on paper while shipping broadly. Carbon is the first major release where the regulatory process appears to be shaping the actual distribution plan rather than sitting next to it.

There is an obvious business cost here. Google is holding back a model it says is its best from the developers who would pay for it, and it is doing so while OpenAI and Anthropic keep pushing general availability. If the staged rollout drags past a few weeks, that is real market share. Google apparently thinks the risk of a bad early headline is worse.

Pricing tells you what Google is worried about

Introductory pricing lands at $2 per million input tokens and $10 per million output, with cached input at 95% off the input rate. That is identical to Argon's intro pricing, which suggests Google is not trying to buy the market this time. The post-introductory rate, per 9to5Google, is $4 input and $20 output. Google declined to say when the intro period ends.

Compare that to where frontier pricing sat a year ago and the trajectory is obvious. The floor keeps dropping. Carbon is priced like a commodity model that happens to be very good at security work, not like a scarce capability. That is the open-weight pressure showing up in the one place labs cannot hide it.

Where the skepticism belongs

Two things deserve calibration.

First, the gap is thin. Ars Technica read Google's eval table and noted that Carbon beats GPT-6 Astra, Claude Opus 5.5, and Claude Fable 5.1 on every test, but "the gap between Carbon and the competition is just a few points." A few points on a benchmark suite is inside the noise of prompt formatting and eval harness choices. The Artificial Analysis comparison to Opus 5.5's score of 58 is not even a clean head-to-head, since the two models were indexed on different days.

Second, the safety claims lean on internal measurement. Google reports a roughly 80% drop in high-severity misalignment alerts, a 26% reduction in overreach, and 29% in under-service relative to Argon. It also says successful cheating on Terminal-Bench 4.0 fell to 0.0%, with attempts at 0.4%, while accuracy went up. There is a linked safety and security report for anyone who wants the methodology, and that is more disclosure than most labs offer. But internal misalignment metrics are internal for a reason.

What to watch

The real test for Carbon is not the launch. It is whether the prompt-injection number survives contact with the wild. If third-party red teams confirm that 0.0%, security teams will have a genuine reason to push agent deployments that have been stuck in pilot purgatory. If it crumbles, Google will have spent a lot of goodwill on a number that only held in a lab.

The second test is timing. Google has promised general availability "as soon as possible" and has not defined that phrase. If Carbon reaches developers before the end of November, the staged rollout reads as a deliberate and well-executed safety play. If it slips into next year, it starts to look like a lab that lost control of its own release schedule.

Either way, the era of the same-day global frontier launch is ending. We are now watching the labs figure out who gets the dangerous models first, and Google just answered that question in public.