Picture a lock-picking set so advanced that its maker refuses to sell it to the general public. That is the exact reality of Google DeepMind’s Gemini 4 Carbon. Despite securing the #1 position on independent frontier benchmarks, Carbon remains strictly locked behind vetted enterprise doors due to its profound dual-use offensive capabilities.
That is a rough analogy for where Google stands with Gemini 4 Carbon. It is the top-ranked model on a major independent index, and most developers and companies cannot use it. Access is limited to vetted cyber defenders, and Google has given no public date.
Google says it is still tuning guardrails. The likely driver, as analysts read it, is the dual-use problem: the skills that help defenders find and fix flaws can also help attackers exploit them. This guide covers the restricted launch, the pricing, and the governance work enterprises can do before the door opens.
The Rollout at a Glance
| Question | Answer so far |
|---|---|
| Announced | October 28, 2026, by Google DeepMind |
| Who can use it now | A subset of cyber defenders, widening to more trusted partners |
| Path in | Google’s Fairwind Program |
| Public release date | None announced. Google says developers, businesses and consumers get it “as soon as possible” |
| Introductory price | $2 per million input tokens and $10 per million output tokens |
| Later price | $4 and $20 |
| Government testing | Google says it is in the US voluntary pre-release testing process |
The Restricted Launch: Who Gets In
Average developers and consumers cannot use Carbon yet. Google is starting with a small group of defenders and adding partners in phases through Fairwind, a DeepMind program for high-priority defenders.
- Scale: Fairwind says it works with more than 650 partners.
- Priority: Governments and national cyber authorities, critical infrastructure operators, and core technology platforms.
- Strong authentication: Partners must use phishing-resistant multi-factor authentication.
- Narrow users: Access is limited to internal security, incident response or penetration testing teams.
- No sharing: Partners cannot share, redistribute or resell access, and usage is tracked.
- Allowed dual-use work: Authorized threat simulation, reverse engineering and malware analysis for defense or academic research. Creating malware is strictly prohibited.
Will the Door Stay Closed?
There is a precedent. Argon, the model Google released just before Carbon, followed a path that gives a hint about what may come next.
| Date | Argon milestone |
|---|---|
| September 30, 2026 | Announced and rolled out to trusted cyber defenders through Fairwind |
| October 13, 2026 | Opened to developers, and to Google AI Pro and Ultra subscribers in the Gemini app |
If Carbon follows the same path, wider access could come within weeks. Google has made no such commitment, so treat that as speculation.
The “Dual Use” Dilemma
Google describes Carbon as strong across the whole defense lifecycle: finding a flaw, proving it can be exploited, and patching it. Those steps use the exact same foundational understanding of how software breaks.
| Stage | Benchmark | Score | Defender use, and the risk |
|---|---|---|---|
| Find | SEC-bench Pro | 88.2% | Spots real flaws. An attacker would also want that list. |
| Exploit | ExploitGym | 54.8% | Prioritizes what is truly dangerous. In the wrong hands, builds the attack. |
| Patch | CWE-bench | 71.0% | Turns findings into fixes. Mostly a defender skill. |
Why Caution Makes Sense
- Google ran its cybersecurity benchmarks without guardrails, so these scores reflect the raw model with safety limits switched off.
- One independent reviewer reports that the ExploitGym headline used a 10-hour time cap, against 6 hours for Claude Opus 5.5, and that Carbon scores 53.5% at 6 hours.
- For Argon, Google’s safety report said it could not rule out that the unmitigated model reaches its critical cybersecurity capability level, and that its safeguards bring the risk below that level.
What Google Says It Built In
Google says Carbon uses model training, real-time misuse defenses, prompt injection resilience, and chain-of-thought monitoring. It reports 0.0% attack success on one prompt injection benchmark. These are self-reported, and one benchmark does not guarantee safety against a determined attacker.
Governance Before Access Opens
Most enterprises cannot use Carbon yet, which makes this the right time to prepare. The OWASP lists are a practical checklist:
| OWASP risk | How it could show up with Carbon | Control outside the model |
|---|---|---|
| Prompt Injection | The model reads untrusted code, advisories, and web pages | Inspect inputs and tool results, and run your own injection tests |
| Excessive Agency | Built for days-long tasks, so permissions pile up | Task-scoped credentials, tool allowlists, human approval for risky steps |
| Sensitive Information Disclosure | Large context can hold source code and secrets | Data classification, redaction, minimal context |
| Misinformation | Reported hallucination rate of 11% against Argon’s 4% | Require reproducible evidence and independent testing of patches |
| Improper Output Handling | Generated patches or exploit code could run unreviewed | Sandboxes, CI gates, code review before merge |
| Unbounded Consumption | Artificial Analysis recorded ~200M output tokens against a 64M median | Token budgets, rate limits, cost caps |
OWASP also publishes a list for agentic applications, with risks such as agent goal hijack, tool misuse, and identity and privilege abuse. Check both lists for their current editions, because numbering and wording change.
Prepare Even If You Never Get Access
- Inventory: Catalog every place AI models run, with owners, tools, and credentials.
- Policy layer: Add one policy layer so rules stay the same if you switch models.
- Patch timelines: Shorten patch timelines. Comparable offensive capability may reach attackers eventually.
- Human-in-the-loop: Keep a human in the loop for merges, active scans, and any exploit execution.
Pricing Breakdown
| Component | Introductory price | Later price |
|---|---|---|
| Input, per 1M tokens | $2 | $4 |
| Output, per 1M tokens | $10 | $20 |
| Cached input | 95% off the input price (~$0.10/M) | Not spelled out in Google’s note |
Google has not given an end date for the introductory rate. Prices double afterwards. At the introductory rate, 95% off $2 works out to about $0.10 per million cached input tokens.
Illustrative Monthly Costs
| Workload | Introductory | Later price |
|---|---|---|
| 10M input, 2M output | $40 | $80 |
| 100M input, 10M output | $300 | $600 |
| 100M input (80M cached), 10M output | About $148 | Not calculated |
Price per token is only half the story. Artificial Analysis estimates Carbon’s cost at $7.76 per index task, against $10.04 for Claude Opus 5.5 at max and $6.25 for GPT-6 Astra. It also found Carbon unusually wordy, which raises output costs.
If You Need a Gemini Model Today
Teams that need a model in production now can use Gemini 4 Argon, which is available to developers at the same introductory prices. Carbon has no general access, so planning a product around it today would be a gamble. A safer approach is to build with Argon and keep your model choice flexible.
Frequently Asked Questions
Can I use Gemini 4 Carbon now?
Not unless you are an approved cyber defender. Google started with a subset of cyber defenders and is adding trusted partners through the Fairwind Program.
What is the Fairwind Program?
It is a Google DeepMind program giving high-priority defenders early access to advanced models, with more than 650 partners and strict terms on authentication and use.
How much does Gemini 4 Carbon cost?
The introductory price is $2 per million input tokens and $10 per million output tokens, with cached input 95% cheaper. It rises to $4 and $20 later.
Why is Gemini 4 Carbon restricted?
Google says it is gathering feedback and tuning guardrails before wider release. Analysts point to the dual-use risk, because finding and patching flaws uses skills that also help exploit them.
What is a dual-use AI model?
It is a model whose abilities can serve both defensive and harmful purposes, such as helping secure software or attack it.
When will Gemini 4 Carbon be publicly available?
Google has not given a date. It says it will reach developers, businesses and consumers as soon as possible after guardrail work.
How should companies prepare for powerful security AI?
Inventory your AI use, add a policy layer, limit permissions, keep human approval for risky actions, and map risks to the OWASP lists.
