Google's top model went to defenders first

Google reports that Gemini 4 Carbon scores 88.2% ⁰¹ on SEC-bench Pro, a test of finding software flaws. On CWE-bench, a test of fixing them, Google reports 71.0% ⁰². Almost no one outside a small circle can use the model yet.

Google announced Carbon on October 28, 2026 ⁰⁸. Artificial Analysis ranks it first on its Intelligence Index v5.0 with 59 ⁰³ points at its high reasoning setting. Claude Opus 5.5 (Max, Default Fallback) scores 58 ⁰⁴ and GPT-6 Astra (Max) scores 57. Two points separate the top three models.

Google is giving Carbon first to a subset of cyber defenders. Additional trusted partners in its Fairwind Program are set to come next. Everyone else waits, and Google has set no date.

We have not run Carbon. Neither have most of our readers. If your team picks models by leaderboard rank, the top of the board is now a model you cannot call from your code today.

Frontier models now ship on an access ladder

Carbon ships on a ladder with four rungs. Google says a subset of cyber defenders will reach the first rung the week of October 28. Trusted organizations in Fairwind get the second. Developers and businesses on the API get the third. Consumers inside Google products get the fourth.

This is the second time the ladder has shown up in four weeks. Google announced Gemini 4 Argon on September 30, and MarketScale reports it went first to Fairwind defenders, with paid API customers next. Tokenpost reports Argon reached developers and enterprises worldwide on October 13. So it took 13 days ²⁶ to get from announcement to the third rung.

Each rung yields a different kind of evidence. The first yields vendor benchmarks, and Google publishes those. The second yields field feedback from real defensive work, and Google keeps that. Your own evidence starts at the third rung, on your own code.

One number explains why the ladder exists. Google reports Carbon scores 54.8% ⁰⁶ on ExploitGym, a test of turning a found flaw into a working attack. The skill that lets a defender prove a bug is real also lets an attacker use it. According to VentureBeat, Google says broad release will come "as soon as possible" after it can "gather feedback and iterate on guardrails."

Carbon's 17.2-point gap between finding and fixing

Think of Carbon as a home inspector who spots almost every crack in the foundation but repairs far fewer of them well. Google's own figures put finding at 88.2% ⁰¹ and patching at 71.0% ⁰². That leaves 17.2 ²⁷ points between the report and the repair. For a builder, the repair is where the money goes.

The gains from Argon to Carbon were uneven. VentureBeat's comparison puts Argon at 83.4% ¹⁶ on SEC-bench Pro and 68.0% ¹⁷ on CWE-bench, so Carbon gained 4.8 ²⁸ points at finding and 3.0 at patching. On ExploitGym it reportedly gained 12.8 ¹⁸ points, from 42.0% to 54.8%. The attack skill jumped the most. The fix moved the least.

We think that uneven gain is the real headline for anyone wiring a model into a security pipeline. If a model gets much better at attacks and only slightly better at fixes, it needs tighter permissions with each release. You set those permissions, whatever rung you stand on.

On the fix side, there are two pieces of better news. Reuters reports Carbon writes secure code at more than twice Argon's success rate on Google's internal tests. Gray Swan's evaluation, as cited in Google's announcements, put indirect prompt-injection attack success at 0.0% ¹⁹ for Carbon against 0.7% for Argon at 15 adaptive attempts. Both are narrow tests, and Reuters gives no absolute percentage for the secure-code result.

The index lead doesn't tell you much about your codebase either. Tokenpost reports Carbon led four of the index's nine evaluations and did not lead in coding or knowledge work. Tokenpost adds that SEC-bench Pro covered 183 tasks with an average of three attempts per task. Three tries per task is generous. A real pipeline gets one shot before a deploy.

Tokens are the cheaper part. Google lists introductory prices of $2 ¹⁴ per million input tokens and $10 per million output tokens, rising later to $4 ²³ and $20. Cached input gets a 95% ²⁴ discount. A job of 100 million ²⁹ input tokens and 10 million output tokens costs $300 at the intro rate and $600 at the later rate.

Cache 80% ³⁰ of that input at the later rate and the bill falls to $296. Now suppose your scanner surfaces 100 ³¹ real bugs and the 71.0% ⁰² patch rate holds on your code. That puts 29 patches on an engineer's desk. At even one hour each, the review time costs more than the tokens for most teams.

The rollout that works copies Google's ladder inside your own shop. Step one, the model reports flaws from read-only access to your repository. Step two, a human approves every patch it proposes.

Step three, it attempts exploits only inside a sandbox, meaning an isolated machine with no production credentials. Step four is a small production pilot. Widen it only when false positives and regressions stay under limits you wrote down before the pilot started.

Attack skill climbs faster than the fix

Launch day stops meaning access by 2031

Google's year shows how fast this is moving. R&D World reports Google promised Gemini 3.5 Pro at I/O in May for June, and Bloomberg reported its coding fell short of internal goals. A Google spokesperson told Reuters the company no longer plans to release it. Argon arrived September 30 and Carbon on October 28, 28 days ³² apart.

Over those 28 days ³², Artificial Analysis scores went from 50 ⁰⁷ for Argon to 59 for Carbon, as VentureBeat reports. That's 9 points in four weeks, and the top three now sit within 2 points of each other. At that pace, a 1-point lead can flip in a single release.

If Google kept a 28-day ³⁴ cadence, it would ship about 13 flagship updates a year, since 365 divided by 28 is about 13. Nobody knows if that pace can hold, and the 3.5 Pro slip suggests it may not. Even at one major release per quarter, Google alone ships 20 ³⁵ by 2031. If Argon and Carbon are any guide, many of those will open on a gated rung.

The risk math favors the builder who owns the test. A harness on your own code takes a weekend to build and tens of dollars per run. Picking by leaderboard means paying for a fresh migration every time a 1-point lead changes hands. Across 20 ³⁵ releases, the harness pays for itself the first time it tells you to stay put.

The ladder sorts companies, too. MarketScale reports Fairwind already counted more than 650 organizations with Argon, across government and critical infrastructure partners. Smaller firms without security teams wait on a lower rung, and they are often the least able to defend themselves. Our read is that the ladder is part safety policy and part sales. Scarcity builds demand, and early access creates reference customers.

Replay your own patched bugs against Argon

Your git history already holds an answer key. Every commit where someone fixed a security bug is a test with a known right answer. Run the harness on what you can reach today. That means Argon, which Tokenpost reports has been open to developers since October 13, plus any model your team already pays for.

Step one: pick 20 ³⁵ past security fixes. For each one, note the file and the flaw type. Keep any test that proves the fix worked.

Step two: check out the commit just before each fix inside a sandbox. A sandbox here means a container or machine with no production credentials and no outbound network. OpenBot, a self-hosted platform that gives every agent its own dedicated machine, is one way to get that isolation.

Step three: give the model read-only access and ask it to find the flaw. Score a hit only when it names the right file and the right flaw type. Log misses and invented findings in separate columns, because a fabricated bug wastes the same review hour as a real one.

Step four: ask for a patch, apply it, and run the full test suite. A regression is a test that passed before the patch and fails after it. Count a fix as verified only when the original bug is gone and nothing else broke.

Step five: log tokens and divide. Assume each task uses 400,000 ³⁷ input tokens and 40,000 output tokens. VentureBeat reports Argon shares Carbon's $2 ¹⁵ and $10 intro rates, which puts each task at $1.20 ³⁸ and all 20 at $24. If 14 ³⁹ patches verify, you paid about $1.71 per verified fix.

Expect the first run to break. Some patches will compile and still fail tests, and some tasks will time out. Those failures show where the gap between finding and fixing sits on your code. Pin the model version in config so each rerun stays comparable.

When Carbon reaches your rung, swapping it in takes one config change and one rerun. You will then have your own gap between finding and fixing, measured on code you actually ship.