Google has announced Gemini 4 Carbon, a new flagship AI model specialized in long-horizon software engineering and defensive cybersecurity, arriving just two weeks after the debut of its reasoning-focused predecessor, Gemini 4 Argon. The release, detailed in Google AI updates for October 2026, also included a research preview of Genie 4, a real-time conversational world model that generates virtual environments with native audio support. The rapid cadence underscores an intensifying push to capture high-value computing demand in autonomous code development and penetration testing workflows.

On external quantitative evaluation metrics, Gemini 4 Carbon achieved the top position on the Artificial Analysis Intelligence Index v5.0 with an overall score of 59. This marks a nine-point gain over the 50 points recorded by Gemini 4 Argon and edges past Anthropic Claude Opus 5.5 at 58 points and OpenAI GPT-6 Astra at 57 points. Koray Kavukcuoglu, vice president at Google and chief AI architect at Google DeepMind, stated that the model proves how rapidly frontier capabilities can advance while bolstering safety guardrails. In specialized security evaluations, Gemini 4 Carbon registered an 88.2% success rate on SEC-bench Pro vulnerability detection, 54.8% on ExploitGym exploit verification, and 71.0% on CWE-bench automated vulnerability remediation. In addition, its attack success rate dropped to 0.0% in Gray Swan indirect prompt injection evaluations, improving on the 0.7% rate seen in Gemini 4 Argon.

Given the dual-use risks surrounding automated penetration testing and exploit generation, which could potentially be repurposed for zero-day cyberattacks, Google has deferred a full general release. Access is initially limited to vetted defensive security groups via US federal pre-testing protocols and the Fairwind program. For authorized enterprise users, API pricing is set at $2 per million input tokens and $10 per million output tokens. This cost structure is designed to keep token expenses predictable for pipelines that process extensive codebases and sustain lengthy autonomous agent loops, offering enterprises a metric to evaluate computing costs against traditional manual code auditing and penetration testing.