Google's new Gemini 4 Carbon goes to cyber defenders first, not the public
The model claims zero successful prompt injections in Gray Swan's test and reaches security teams before developers or consumers see it.
Key points
- Google is releasing Gemini 4 Carbon to a small group of cyber defenders first through its Fairwind Program, before developers or consumers get access.
- Carbon scored 0.0% attack success rate on Gray Swan's Indirect Prompt Injection Benchmark, down from Argon's 0.7%.
- The model is priced at $2 per million input tokens and $10 per million output tokens, the same introductory rate as Gemini 4 Argon.
- Carbon hits 88.2% on SEC-bench Pro for finding real software vulnerabilities and 71.0% on CWE-bench for patching them.
- Google is engaged in the United States government's voluntary pre-release model testing process for Carbon.
Google is doing something unusual with its newest AI model. Instead of putting Gemini 4 Carbon in front of millions of people on day one, it's handing access to a small group of security teams and making everyone else wait.
That choice tells you what this model is built for.
Google DeepMind announced Carbon as its strongest frontier model, meaning its most capable general-purpose AI, with a particular focus on cybersecurity: finding software flaws, checking whether they can be exploited, and writing the fix.
Access begins this week through the Fairwind Program, Google's channel for trusted security partners. Developers, businesses and consumers get it later, once Google is satisfied with the guardrails.
What is Google actually claiming?
Carbon leads on three security benchmarks, standardised tests researchers use to score AI models. It hits 88.2% on SEC-bench Pro for finding real vulnerabilities, 54.8% on ExploitGym for checking whether a flaw can actually be attacked, and 71.0% on Collinear's CWE-bench for patching the root cause.
On the Gray Swan Indirect Prompt Injection Benchmark, a test that tries to trick an AI into following hidden instructions buried in documents or web pages it reads, Carbon resisted every evaluated attempt. The score is 0.0% attack success. Argon, the model Google launched two weeks ago and pitched at lawyers and bankers, sat at 0.7%.
Those are Google's own figures, from Google's own write-up. They haven't been independently reproduced yet. Worth keeping in mind before anyone treats a 0.0% as a guarantee.
Why does the staggered release matter?
A model that's strong at finding software bugs is, by definition, a model that could help someone attack software. Google is being open about that tension. The company says it's engaged in the United States government's voluntary pre-release model testing process and will phase access out gradually rather than ship Carbon to everyone at once.
For readers outside security, here's the plain version. The same tool that spots a hole in a hospital's booking system could, in the wrong hands, be used to walk through that hole. Giving defenders a head start is the point. It's a different pattern from the usual AI launch, where the model lands in a chatbot the same afternoon.
AI2Day has been covering prompt injection risks since 13 July 2026, and the gap between a lab's own benchmark results and what outside researchers find in the field is where that reporting has repeatedly mattered most.
How Carbon compares to Argon
| Detail | Gemini 4 Argon | Gemini 4 Carbon |
|---|---|---|
| Launched | Two weeks ago | This week |
| Input price (per million tokens) | $2 | $2 |
| Output price (per million tokens) | $10 | $10 |
| Prompt injection attack success (Gray Swan IPI) | 0.7% | 0.0% |
| First audience | Developers, enterprises, Gemini app | Vetted cyber defenders via Fairwind |
The pricing matches. The audience doesn't.
What should ordinary readers watch for?
If you use Gemini in Google's apps, nothing changes today. Carbon isn't in the consumer product yet. When it arrives, Google says it will fabricate less, admit uncertainty more clearly, and refuse tasks that fall outside its scope more reliably.
Watch the independent testing. Benchmark numbers from the lab that built the model always look good. Scores from outside researchers, especially on prompt injection, are what will tell us whether Carbon's security story holds up beyond Google's walls. That's the pattern we've seen play out across our coverage of Argon's phased rollout, and there's no reason to expect Carbon to be different.
Credit to the teams at Gray Swan and Collinear whose public benchmarks make any of this checkable.
