Google Unveils Gemini 4 Carbon With a Focus on Cybersecurity and Complex Coding - Kingy AI

The company announced Carbon on October 28, 2026, with Reuters publishing its report at 2:08 a.m. on October 29, Philippine time. The immediate opportunity is practical: helping defenders investigate software weaknesses and work toward fixes. However, Carbon is entering a controlled rollout, meaning its announcement doesn't mean everyone can immediately access it through the Gemini app.

Limited Initial Access

Google says Carbon will initially reach selected cybersecurity defenders, with access expanding through its Fairwind Program before broader availability. For now, organizations outside this initial group should treat Carbon as an emerging option rather than an immediately available replacement for existing tools. There is also no guarantee of future access on a particular date.

Security Benchmark Results

Google reports Carbon scores of 88.2% on SEC-bench Pro, 54.8% on ExploitGym and 71.0% on CWE-bench, covering vulnerability discovery, exploitation and patching respectively. These are company-reported results across different evaluations, not a universal security accuracy score. The distinctions between discovery, validation and remediation tasks are important.

SEC-bench Pro describes itself as an evolving benchmark for agents hunting security bugs in critical software systems. However, the benchmark page retrieved for this article did not independently corroborate Google's reported Carbon score, meaning that figure remains attributed to Google.

Challenges in Security Fixes

CWE-bench's documentation shows how security agents can fail by never locating vulnerable code, incorrectly concluding nothing is wrong, or changing correct code without restoring required security properties. A hypothetical repair might prevent one malformed input from crashing a service while leaving related input paths vulnerable.

Fairwind Program Approach

Google DeepMind describes Fairwind as a program giving trusted defenders early access to advanced models, with priorities including organizations protecting government, healthcare and telecommunications systems. The governance includes organizational checks, controlled access and restrictions on redistributing model access.

Google notes that the cited external cybersecurity benchmark evaluations were conducted without guardrails, which matters when interpreting results. A prospective user needs to understand the behavior of the actual service available to them, not just what a model is capable of under one configuration.