By Google’s Gemini 4 Carbon leads every major AI security benchmark — 88.2% on vulnerability detection, 54.8% on exploitation testing, 71.0% on patch generation — and you almost certainly can’t use it. Announced October 28, Carbon is gated behind the Fairwind Program, a restricted access tier for governments, critical infrastructure operators, and vetted security partners. For everyone else, here’s what’s actually happening and what to do about it.
The Numbers, With Context
Carbon leads three security-specific benchmarks that matter:
- SEC-bench Pro: 88.2% — finds vulnerabilities in real, long-horizon software systems using actual CVEs
- ExploitGym: 54.8% — end-to-end exploitation of user-space programs, V8, and the Linux kernel
- CWE-bench: 71.0% — patches 120 real repositories across 73 CWE types, 8 languages, and all OWASP Top 10 2025 categories
It also ranks #1 overall on the Artificial Analysis Intelligence Index v5.0 with a score of 59, beating Claude Opus 5.5 (58) and GPT-6 Astra (57). Beyond the rankings: Carbon generates secure code at twice Argon’s rate, produces patches an order of magnitude better than unnamed competitors, and achieves a 0.0% success rate against prompt injection attacks on the Gray Swan IPI Benchmark.
One honest caveat: the Artificial Analysis Index updated to v5.0 alongside Carbon’s announcement, and its methodology changes systematically disadvantage open-weight models compared to v4. The benchmark still carries weight, but don’t treat Carbon as definitively better than competitors by a slim margin — the index shifted under everyone’s feet at the same time.
Who Gets Access (Probably Not You)
Google’s Fairwind Program has been the access mechanism for its most capable security models since September 2026, when it debuted with Gemini 3.8 Flash Cyber. Carbon follows the same rules:
- Government agencies and national cybersecurity authorities
- Critical infrastructure operators: healthcare, telecoms, energy, finance
- Core technology platforms
- Academic labs conducting defensive security research
To qualify, organizations must pass background checks, enforce phishing-resistant MFA, limit access to internal security teams only, and agree not to redistribute. Individual developers, startups, and most companies do not qualify. There is no public timeline for general availability — Google says “as soon as possible,” which historically means months.
This is the second consecutive Fairwind gating after Argon. The pattern suggests tiered access for security-capable models is a permanent feature of Google’s release strategy, not a temporary precaution.
What to Do Right Now
Carbon access is closed, but the prep work is real. Four things worth doing today:
- Parameterize your model ID. Store the Gemini model name as a config value — not hardcoded. When Carbon opens up, switching is a one-line change instead of a codebase audit.
- Evaluate Argon now. Gemini 4 Argon is available on the paid Gemini API tier today. Carbon builds directly on it, so your Argon evals are Carbon prep.
- Build private evals. Create a set of failing tests, known-answer security questions, and vulnerability assessments unique to your codebase. Benchmark scores tell you nothing about your specific use case.
- Don’t wait on daily work. For general agent tasks, GPT-6.1 Terra at $1/$5 per million tokens is available, cheaper, and not rate-limited into irrelevance.
Pricing Breakdown
Carbon launches at the same introductory rates as Argon: $2 per million input tokens, $10 per million output tokens, with a 95% discount on cached inputs. Standard rates after the introductory period climb to $4/$20. For a 2M token run with 80% cache hit and 200K output, that’s roughly $2.96 at intro rates or $5.92 at standard — not cheap for a security agent that runs for hours, but defensible if it catches the vulnerability a human would miss.
The Part Google Won’t Say
Carbon’s benchmark lead is real, but SEC-bench Pro and CWE-bench are rigorous academic benchmarks — not the same as deploying an AI agent on your production codebase. False positives in security are costly: a wrong patch can introduce regressions or mask the actual vulnerability. Staged rollouts also mean the model reaching GA could differ from what was benchmarked.
Watch independent evaluations once Carbon hits the general API — that’s when the real signal arrives. For now, read the official announcement for the full technical brief, and prepare your stack for when the gates open.
