Google unveils Gemini 4 Carbon with a focus on cyber defence

Google DeepMind has announced Gemini 4 Carbon, its latest flagship artificial intelligence model, arriving two weeks after the release of Gemini 4 Argon. The new model places heavy emphasis on software engineering and cyber defence, scoring 59 on version five of the Artificial Analysis Intelligence Index to rank slightly ahead of Claude Opus 5.5 and GPT-6 Astra.

According to Google, the system was trained to handle the full cycle of discovering software weaknesses and generating fixes. On benchmark tests reported by the company, Carbon scored 88.2 per cent on SEC-bench Pro for identifying security flaws, 54.8 per cent on ExploitGym for testing potential exploits, and 71 per cent on CWE-bench for writing working patches.

Because these capabilities can be used to find vulnerabilities as easily as to repair them, Google is not releasing the model immediately to the general public. Access will begin with a limited group of cyber defenders through Google's Fairwind program, alongside voluntary pre-release safety testing with the United States government. Wider availability for developers and enterprise customers will follow in later phases.

Google has set introductory pricing at US$2 per million input tokens and US$10 per million output tokens, matching Argon, with a 95 per cent discount on cached inputs. Standard pricing will double to US$4 and US$20 once the introductory period ends.

What this means for Australian businesses

While Carbon is not yet available for direct use, its technical direction shows where commercial AI tooling is heading over the coming months.

• Software teams should prepare for better automated patching. When models like Carbon enter tools such as GitHub or Google Cloud, internal development teams and external IT providers will be able to audit codebases and patch vulnerabilities much faster.
• The speed of offensive cyber risks will also rise. As automated tools become better at locating security holes, criminals will use similar techniques. Australian businesses relying on outdated plugins, legacy website forms, or unpatched software will face faster scans from bad actors looking for weak spots.
• Routine basic cyber hygiene becomes non-negotiable. Australian small businesses should check that multi-factor authentication is active across all company accounts, software patches are applied without delay, and managed IT providers have automated vulnerability monitoring in place.