Google announced Gemini 4 Carbon on October 28, 2026 as its strongest frontier model for cybersecurity and long-horizon work. Initial access begins with a subset of cyber defenders and expands gradually through the Fairwind Program. Developers, businesses and consumers are promised access later, so Carbon is not a broadly available Canadian product today.
The published results are Google and benchmark-provider evidence
Google reports Carbon scores of 88.2% on SEC-bench Pro for vulnerability finding, 54.8% on ExploitGym and 71.0% on CWE-bench for patching. It also cites internal results for secure-code generation, unsupported claims and alignment alerts. These numbers depend on benchmark definitions, settings and guardrails; they do not establish performance on a specific organization’s code.
Google says some external cyber evaluations were run without guardrails. A procurement test should therefore measure the deployed configuration, including refusals, tools and policy controls. Teams should include false positives, missed findings and unsafe proposed patches rather than compare only headline scores.
Related sources: Google: Introducing Gemini 4 Carbon ↗
The rollout is intentionally restricted
Google says it is participating in a US government pre-release testing process and will gather feedback from trusted defenders before broader release. The announcement does not give a firm general-availability date or Canadian access list. “As soon as possible” is not a release commitment.
A Canadian security team should wait for applicable terms, processing locations and product documentation before scheduling production use. Early access can support bounded evaluation, but it should not be placed in an incident-response critical path without availability, support and fallback plans.
Related sources: Google: Introducing Gemini 4 Carbon ↗
Pricing is announced before broad access
Google lists an introductory API price of US$2 per million input tokens and US$10 per million output tokens, with cached inputs at a 95% discount. After the introductory period, Google says pricing will rise to US$4 and US$20. Those are vendor prices in US dollars, not a Canadian invoice estimate; taxes, exchange rates, tool calls and retries affect total cost.
Because general access is not yet available, the practical cost metric is cost per accepted security result in a controlled pilot. Include analyst review, exploit-validation infrastructure and remediation work, not only tokens.
Related sources: Google: Introducing Gemini 4 Carbon ↗
Safety claims still require external authorization controls
Google reports lower cheating, unsupported claims, overreach and prompt-injection success in selected tests. A zero result on one injection benchmark is not immunity from hostile repository content, webpages or tool output. Cyber models also carry dual-use risk when given exploit capability.
Keep credentials scoped, isolate untrusted inputs, require approval before exploitation or production changes, and preserve evidence for human review. Carbon’s limited rollout is a signal that capability and misuse risk need staged evaluation, not a guarantee that every deployment is safe.
Sources and editorial method
We use the linked original statements and reports to distinguish documented facts from our analysis. Company announcements describe their authors’ plans and claims; they are not independent verification of future outcomes. This article is dated and will be revised if material evidence changes. Read our editorial standards and corrections process.
- Google: Introducing Gemini 4 Carbon ↗ — Official October 28 announcement; access, pricing, benchmark and safety claims.