Gemini 4 Carbon goes to cyber defenders first. The access gate is part of the product

Google’s newest frontier model is priced like a general product and distributed like a controlled one. Gemini 4 Carbon, announced on October 28, costs $2 per million input tokens and $10 per million output tokens at its introductory rate. But this week, only a subset of cybersecurity defenders can use it.

That gap between price list and access list is the most practical fact in the announcement. It is the second time in two days that a lab has shown offensive-grade security capability and paired it with gated distribution, after Anthropic’s exploit chain research. For enterprise security teams, access is becoming something to apply for, not something to buy.

What Google reports

Google describes Carbon as its strongest model for cybersecurity and long-horizon work, meaning coding and investigation tasks that run for a long time. Its reported results:

• Vulnerability finding: 88.2% on SEC-bench Pro.
• Exploitation: 54.8% on ExploitGym.
• Patching: 71.0% on CWE-bench.
• General: a score of 59 on the Artificial Analysis Intelligence Index v5.0, ranked first.
• Robustness: 0.0% attack success on the Gray Swan indirect prompt injection evaluation, and benchmark cheating on Terminal-Bench 4.0 reduced to 0.0%.

Google says the security benchmarks were run without guardrails. Against Gemini 4 Argon, released two weeks earlier at the same introductory price, it reports more than twice the secure-code success rate on internal benchmarks, about half as many unsupported claims, and a drop in prompt injection success from 0.7% to 0.0%.

All of these are Google’s own measurements. A zero on one prompt injection evaluation means that evaluation’s attacks failed; it does not mean the model cannot be manipulated. Treat the numbers as a reason to test, not as test results.

Who can use it, and when

Access starts this week with selected cyber defenders. More trusted partners are added gradually through Google’s Fairwind Program, and Google says Carbon will reach developers, businesses and consumers “soon,” without a date. After the introductory period, prices rise to $4 per million input tokens and $20 per million output tokens; cached input is 95% cheaper.

Two consequences follow. First, if your security team wants early access, the relevant work is an application to the program, with the vendor relationship, use case and controls it asks for, not a procurement request. Second, a budget built on the introductory price will be wrong by half once the period ends, which matters most for the long-running work Carbon is designed for.

Long horizons need limits written down

A model that investigates for hours changes the unit you manage. The question stops being whether a single answer was right and becomes what a run was allowed to do, spend and touch before someone looked at it. Before any long-running security agent goes into production, write down:

1. A spend ceiling per run, priced at the post-introductory rate.
2. The scope it may scan, as a list of repositories, hosts or environments, enforced outside the prompt.
3. What counts as a finding, and who confirms it before it becomes a ticket, because generating findings is now cheaper than confirming them.
4. A stop rule: elapsed time or tokens after which the run pauses for review.

Google’s internal figures say high-severity misalignment alerts fell by nearly 80% in live coding tests. That is a welcome direction and a reminder that the alerts exist. A gated rollout gives security teams a few weeks to set up their limits before the model reaches everyone; that is the window to use.