Google's Gemini 4 Carbon is so good at finding security holes that cyber defenders get the keys first
By Brett Gavaghan, Founder of Adaptd ·
Google announced Gemini 4 Carbon on 28 October, its strongest model yet. It goes to a small group of cyber defenders first, with businesses and the public to follow.
The short version
- Gemini 4 Carbon is Google's newest and strongest AI model, built for long coding tasks and cyber security work.
- A small group of cyber defenders gets it first. Google says everyone else follows later, with no date given.
- Nothing changes for your business yet, but it's a good prompt to tighten up how fast you install security updates.
Google has a new AI model it's so confident about that it's only handing it to the security people for now. That says a fair bit about where these tools are heading.
What is Gemini 4 Carbon?
Gemini 4 Carbon is Google's new frontier AI model, announced on 28 October 2026, with a focus on long coding jobs and cyber security. It arrives about two weeks after Gemini 4 Argon.
Google says Carbon ranks first on Artificial Analysis's Intelligence Index v5.0 with a score of 59. It scored 88.2% on a test of finding software vulnerabilities and 71.0% on one for patching them. Google also says it makes about half as many unsupported claims as Argon, which is a nice change from a model confidently making things up.
Who can use it, and when?
Only a subset of cyber defenders can use Gemini 4 Carbon at first, with more trusted partners added over time. Google says businesses and the general public will get it "as soon as possible", but hasn't given a date.
For developers, the introductory price matches Argon at US$2 per million input tokens and US$10 per million output tokens. After the introductory period it rises to US$4 and US$20.
What should your business do about it?
Your business doesn't need to do anything about Gemini 4 Carbon itself, because you can't use it yet and the Gemini app you use now hasn't changed. The bigger signal is how well AI now finds holes in software.
My take: if Google is careful enough to hand this to defenders first, assume similar tools will reach the other side eventually. The fix is boring and cheap. Turn on automatic updates on every work device, and ask whoever looks after your website how quickly they patch plugins.
It's like changing the locks after a locksmith moves in next door. They're probably lovely. Change them anyway.
Wondering what this means for your business?
That's exactly what the discovery call is for.