Gemini 4 Carbon: Google focuses on secure code and long-running AI agents

On October 28, 2026, Google DeepMind announced Gemini 4 Carbon, the second flagship model in the Gemini 4 family following Argon.

Carbon is designed for software engineering tasks involving many steps, tool use and extended analysis. Google reports that its internal teams have observed the model working for days on complex problems, identifying underlying software defects and developing patches across large codebases.

Cybersecurity is a major focus: discovering software vulnerabilities, determining whether they can be exploited and generating code changes to address them.

These capabilities are currently documented through evaluations and internal deployments. Carbon is not yet generally available for independent hands-on testing.

Independent evaluator Artificial Analysis gives Gemini 4 Carbon a score of 59 on Intelligence Index v5.0, compared with 50 for Argon. Carbon ranks first overall at the time of its announcement.

It ranks second on the evaluator's Coding Agent Index, behind Claude Opus 5.5. Its overall lead therefore does not extend to every individual category.

For cybersecurity, Google reports three benchmark results:

Google says these evaluations were conducted without the model's normal guardrails. Although the benchmarks are externally developed, the reported cybersecurity scores come from Google rather than an independent end-to-end assessment of the deployed service.

On internal evaluations, Google also reports that Carbon achieves more than twice Argon's success rate when generating secure code.

Carbon also includes changes intended to improve the behavior of AI agents during complex tasks.

Google reports approximately half as many unsupported claims compared with Argon, alongside a nearly 80% reduction in high-severity misalignment alerts within its internal development environments.

On the Gray Swan indirect prompt-injection benchmark, Carbon recorded a 0% attack success rate in the evaluated cases, compared with 0.7% for Argon.

That result applies to the tested scenarios and configuration. It does not establish immunity against malicious instructions embedded in documents, web pages or other content processed by an AI agent.

Accuracy measurements also require context. On the independent AA-Omniscience evaluation, Artificial Analysis reports improved accuracy over Argon, while the hallucination rate increases from 4% to 11%. These measurements use different methods from Google's internal assessments and are not directly comparable.

Google will initially provide Carbon to a small group of cybersecurity defenders, followed by selected partners through its Fairwind Program.

The company is also participating in the US government's voluntary pre-release model testing process.

Google has announced introductory pricing of $2 per million input tokens and $10 per million output tokens, with a 95% discount for cached input tokens.

After the introductory period, pricing will increase to $4 and $20 respectively. No expiration date has been announced.

Artificial Analysis lists a one-million-token context window and multimodal input capabilities. Complete public API specifications, general-access arrangements and operating limits have yet to be announced.

The capabilities described by Google address workflows that currently involve developers, static analysis tools, testing infrastructure and code review.

An agent that can identify a defect, modify the underlying code and validate the fix could reduce several manual steps. Its effectiveness will also depend on tool access, execution permissions and the safeguards applied before changes reach production.

Enterprise evaluations should measure patch quality, introduced regressions, execution time and total operating cost on representative repositories.

The currently available evidence does not establish that Carbon can independently manage the security of production software.