Gemini 4 Carbon: Google's Cybersecurity AI Model, No API Yet
Google says Gemini 4 Carbon tops intelligence and cybersecurity benchmarks, but with no public access, its numbers can't yet be independently checked.
What is Gemini 4 Carbon?
Gemini 4 Carbon is a new AI model from Google, announced as its strongest offering yet for long-running tasks and cybersecurity work. It arrived just days after Gemini 4 Ultra, and Google is pitching it specifically at cyber defenders rather than the general public. Right now, access is limited to a small group of selected testers. There’s no public API, no download, and no announced release date. Everything currently known about Carbon comes from benchmark charts and claims that Google itself has published.
TL;DR
- Gemini 4 Carbon is Google’s newest frontier model, positioned around long-horizon tasks and cybersecurity rather than as a general-purpose chatbot upgrade.
- Google claims it ranks number one on the Artificial Analysis Intelligence Index, though Claude Opus 5.5 and GPT-6 Extra score close enough that the gap looks more like a toss-up than a clear win.
- On cybersecurity benchmarks like vulnerability discovery and exploitation, Carbon reportedly leads, but the charts show different limits and different tooling were used across models, which muddies a direct comparison.
- Google reports a prompt injection score of zero, which would be a meaningful result for anyone building AI agents, if it holds up outside Google’s own test environment.
- There is currently no API, no open weights, and no public release date, so none of these numbers can be independently verified.
- The cybersecurity tests were reportedly run without guardrails, which is a notable methodological detail given how the results are being used to market the model.
Why is Google calling it “Carbon”?
Google hasn’t explained the naming beyond the obvious metaphor: carbon under enough pressure becomes a diamond. The implication is that Carbon is meant to be the compressed, refined version of whatever came before it, a model squeezed for performance rather than scale for its own sake. Whether that metaphor holds depends entirely on results nobody outside Google’s testing group can currently check.
What is Google claiming about its benchmark performance?
The headline claim is that Gemini 4 Carbon sits at number one on the Artificial Analysis Intelligence Index, a widely watched independent aggregate benchmark that several labs now compete over. But the actual chart tells a tighter story: Claude Opus 5.5 and GPT-6 Extra land right behind Carbon, close enough that on several individual sub-benchmarks, those two models actually come out ahead, not Carbon.
That distinction matters. A benchmark lead measured in fractions of a point, with other models winning on several component tests, is not the same as a clear first place. It is closer to three frontier labs trading blows than one model pulling away from the pack.
How strong are the cybersecurity claims?
This is where Google is putting most of its marketing weight. Carbon is shown topping charts for finding vulnerabilities in real software and for exploitation tasks, which would be genuinely useful capabilities for security teams if they translate to real-world defense work.
But the fine print on these charts raises questions. The models being compared were not all given the same operating limits, so it’s unclear whether Carbon won because it is more capable or because it was allowed more room to work. On top of that, the models ran inside different tools during testing, meaning part of the result reflects the surrounding tooling, not the underlying model alone. That’s not necessarily dishonest, but it does mean the comparison isn’t apples to apples, and any benchmark chart that doesn’t hold variables constant deserves a skeptical read.
What does the prompt injection score actually mean?
One of the more interesting figures is prompt injection resistance, where lower scores are better. Google reports Carbon scoring zero, essentially claiming it resisted every injection attempt thrown at it during testing. If that number holds up under independent, adversarial testing, it would be a real deal for anyone deploying AI agents that browse the web, read documents, or handle untrusted input, since prompt injection remains one of the most common ways to hijack agentic systems in production.
The catch is the same one that applies to every number in this release: it’s Google’s own test, on Google’s own terms, with no outside party yet able to replicate it. A perfect score on an internal red-team exercise is encouraging, but it isn’t the same as surviving contact with the open internet.
Why can’t anyone verify these numbers yet?
Nothing gets lost.
Because there is no way to access the model. No API key, no downloadable weights, no playground, no third-party eval suite has touched Gemini 4 Carbon. The only people who can currently run it are the small group of cyber defenders Google selected for early access, and their results haven’t been made public.
This is the central tension with the release. Google is presenting detailed, favorable charts across intelligence and security benchmarks, but every one of those charts was produced internally. There is no independent lab, academic group, or outside security researcher confirming any of it yet. That doesn’t mean the claims are false. It means they are currently unfalsifiable, which is a different and more cautious category.
It’s also worth noting that the cybersecurity tests reportedly ran without guardrails, meaning the model operated with fewer safety restrictions than it likely would in a production deployment. That’s a reasonable setup for measuring raw capability, but it’s another variable that makes the results harder to compare against how a competitor’s guardrailed, publicly available model might perform on the same tasks.
Is Gemini 4 Carbon worth paying attention to?
Yes, cautiously. A frontier lab releasing a model specifically tuned for cybersecurity work, rather than general chat or coding, is a notable shift in focus. If the vulnerability-finding and exploitation numbers hold up under independent testing, that has real implications for both defenders and attackers, since the same capabilities that help a security team patch software faster could also help a bad actor find exploits faster. A prompt injection score of zero, if real and reproducible, would also be a genuinely useful data point for anyone building production AI agents.
But “worth attention” and “worth trusting the numbers” are different things. Until Carbon is available through a public API or as downloadable weights, nobody outside Google’s selected tester group can run their own evaluation. Benchmark charts published by the company that built the model, using the company’s own test conditions, are a starting point, not a verdict.
Frequently Asked Questions
What is Gemini 4 Carbon used for?
Google is positioning it for long-running tasks and cybersecurity work, specifically things like finding software vulnerabilities and testing exploits, rather than as a general-purpose assistant.
Can I use Gemini 4 Carbon right now?
No. There is no public API, no download, and no open weights. Access is currently limited to a small group of cyber defenders selected by Google, with no announced date for wider release.
Does Gemini 4 Carbon beat GPT-6 Extra and Claude Opus 5.5?
Google’s own chart shows Carbon slightly ahead on the Artificial Analysis Intelligence Index, but the scores are close enough that Opus and GPT-6 Extra actually lead on some individual sub-benchmarks. It’s a close race, not a clear win.
Why do the cybersecurity benchmark numbers need scrutiny?
Because the models being compared weren’t given identical operating limits and ran inside different tools during testing. Both factors can affect results independent of the model’s raw capability, and the tests reportedly had no guardrails enabled.
What does a prompt injection score of zero mean?
It suggests Carbon resisted every prompt injection attempt in Google’s internal testing. That would be significant for AI agent safety if confirmed by outside researchers, but it hasn’t yet been tested beyond Google’s own environment.
