Google Gemini 4 Carbon: a frontier model you can't use and what it means for security

Google Gemini 4 Carbon arrives presented by its own maker as its strongest model, with cybersecurity capabilities that Google places at the cutting edge, but almost nobody can use it yet [1]. According to The Verge, for now it is available only to a select group of cybersecurity defense companies [2].

For a company adopting AI, that paradox leaves an uncomfortable question: how to assess a model you only know through what its seller says. The answer is not to wait for general access, but to separate what the manufacturer claims from what you can check, and to set your own criteria before depending on it.

Google Gemini 4 Carbon arrives with headline figures and no general availability

On 28 October 2026, Google DeepMind presented Carbon as its strongest model, with a particular focus on cybersecurity and long-horizon tasks, meaning multi-step engineering work that the model sustains over long periods [1]. The DeepMind blog states that its internal teams have watched it work for days on complex problems, such as locating the root cause of subtle failures in large codebases [1].

The figures Google attaches to the announcement are striking. According to the company, Carbon ranks first on the Artificial Analysis Intelligence Index, in its v5.0 revision, with 59 points [1]. In the security tests Google highlights, the model scores 88.2% on SEC-bench Pro, which evaluates vulnerability detection, and 54.8% on ExploitGym, which focuses on checking whether a flaw is exploitable [1].

Access, by contrast, is very limited. DeepMind explains that it would begin offering Carbon to a subset of defenders that same week and would gradually widen access to other trusted partners through its Fairwind program; in addition, the company has joined the voluntary scheme through which the US administration evaluates models before they reach the market [1]. Developers, businesses and consumers will come later, and according to Infobae they will do so with no confirmed date [3].

The cybersecurity results Google reports need independent reproduction

It is worth distinguishing between what a third party measures and what Google reports. The Artificial Analysis index is an external reference: Infobae specifies that it belongs to an independent firm [3]. But the test-by-test detail comes through the announcement itself, and the DeepMind blog clarifies that those external cybersecurity evaluations were run with the model's safeguards switched off [1].

Other claims are purely internal. According to DeepMind, the Chrome team observed that Carbon performed more than 10 times better than a major frontier model from another lab at generating high-quality patches [1]. According to deepmind.google, the same blog states that Carbon cut successful cheating to 0.0% on Terminal-Bench 4.0, with cheating attempts at 0.4% [1]. To check these figures, it is worth demanding independent evidence and details on the evaluation conditions. Infobae adds that Google has not named the rival in the Chrome comparison, has not published its data and has not released a technical report either [3].

The discrepancy is minor, but it illustrates why it pays to always go to the original source and not to the chain of reproductions.

There are further nuances. Infobae reports, based on an external analysis, that evaluating without safeguards does not show that a customer will get the same results with the restrictions that accompany the commercial product [3]. Ars Technica observes that all frontier models score in a similar range on these tests and that the gap between Carbon and the competition is a few points [5]. Europa Press, for its part, recalls that comparisons with Anthropic or OpenAI models are the company's own results [6].

None of this suggests the figures are false. Restricted access limits the chance that a company without authorization can check those figures through its own tests.

Staged access to frontier models already had a precedent with Argon

Carbon is not an isolated case. Google said on its official blog that Gemini 4 Argon, announced on 30 September 2026, began rolling out to a set of trusted defenders through the Fairwind program, and devoted a specific section to strengthening safeguards before broad availability [7]. In that announcement, Google argued that releasing capabilities at this level safely requires a phased approach [7].

According to Infobae, citing VentureBeat, Argon was opened more widely on 13 October [3]. Carbon arrived shortly afterwards and, according to Ars Technica, it also follows a staged release that could stretch out [5]. La Razón describes the moment as one in which the sector's model generations are already measured in weeks and not months [8].

Argon and Carbon offer two examples of phased access worth keeping in mind when planning adoption. A company adopting AI has to plan without knowing when a given model will reach its service tier, or under what conditions.

A model that finds, exploits and patches flaws is a dual-use capability

What follows is editorial interpretation, not a motive attributed to Google. The three tests the company highlights cover finding vulnerabilities, checking whether they can be exploited, and fixing them [1]. That same competence serves defense and, in other hands, could serve attack. The Argon blog already mentioned the need to refuse harmful requests without blocking legitimate dual-use research [7], and DeepMind speaks of a deliberate rollout of Carbon [1]. On that logic, limiting first access to defense teams is coherent.

For those working in security, the immediate lesson is a different one. To evaluate AI in a defense team, it is advisable to prioritize its integration into detection, triage and patching, with human review, rather than being guided only by rankings. If you are interested in that area, you can see how AI is used today in SOC threat detection.

Before depending on a model you don't control, these are the criteria to set

This is the gap left by the coverage of the announcement. As an editorial proposal, the following criteria can guide the evaluation of frontier models for security or business processes:

1. Distinguish an announcement from contractable availability. A model that has been presented is not a service you can contract, with defined conditions and support.
2. Demand independent evidence or run your own pilot. A result on a public test does not replace a scoped pilot in your environment, with metrics set in advance.
3. Avoid critical dependence on a single provider. A model available only to selected partners can change its terms; document the dependency and keep an alternative.
4. Review what data is sent to the model. Consider which code, logs or vulnerabilities it would be appropriate to share and under what processing conditions.
5. Document who decides and who is accountable. Define who reviews and approves what the model proposes, especially if it suggests patches or prioritizes vulnerabilities.

It is advisable to consult legal counsel on which requirements could apply to the deployment and oversight of a system of this kind. The practical guide to the AI Act for companies helps to place it, and it is advisable to confirm with legal counsel how it applies to each specific situation.

Until you can test Carbon, treat it as a market signal and not as a dependency

The Argon and Carbon announcements have followed one another within a few weeks, and both have followed phased access. According to The Verge, Carbon will be extended over time to other Fairwind partners [2], but that promise is not yet something to build processes on.

A frontier model you cannot test is information about the direction of the market, not a tool. Before depending on it, define how you would evaluate it, who is accountable for its use and what you would do if it does not arrive or changes. You do not need to use Carbon to prepare: an inventory of AI uses, clear owners and measurable pilots are enough, within an AI security governance approach. If you want to test that framework, you can look at Hodeitek's AI security consulting offering.