88.2% Bug-Finding Score: What Is Gemini 4 Carbon, Explained

Google's teams say they have watched a model run for days on one engineering problem, hitting dead ends and pushing through them to find and patch subtle bugs. That model is Gemini 4 Carbon, the newest Gemini AI release.

Its headline number is 88.2% on SEC-bench Pro, a test of finding real vulnerabilities in real software. And it arrived just two weeks after Gemini 4 Argon.

Quick answer

• Gemini 4 Carbon is Google's new frontier Gemini AI model, built for coding, long agent tasks and cybersecurity.
• It scores 88.2% on SEC-bench Pro, 54.8% on ExploitGym and 71.0% on CWE-bench.
• API pricing matches Argon: $2 per million input tokens and $10 per million output tokens.
• Right now only a small group of cyber defenders can use it. Wider access for developers and consumers is "coming soon".

What is Gemini 4 Carbon?

Gemini 4 Carbon is Google's strongest Gemini AI model so far, aimed at hard coding work, agents that run for a long time, and cyber defence.

Google says Carbon ranks first on version 5.0 of the Artificial Analysis Intelligence Index with a score of 59 (Google). The Verge adds that Claude Opus 5.5 and GPT-6 Astra trail behind it on that index (The Verge).

Think of it as the heavy-duty sibling of Argon. Argon is the general model Google shipped earlier this month. Carbon builds on it and pushes harder on security and long, multi-step jobs.

If you build web apps, one more figure matters. Google says Carbon jumped 89 Elo points to reach number 4 on WebDev Arena, with a rating of 1768.

Why the cybersecurity scores matter

The cybersecurity scores matter because Carbon is strong at all three steps of defence: finding a bug, checking whether it can be exploited, and writing the fix.

Google reports 88.2% on SEC-bench Pro for finding flaws, 54.8% on ExploitGym for exploitation and 71.0% on Collinear's CWE-bench for patching (Google). Google notes these external tests were run without guardrails.

Bar chart: Gemini 4 Carbon scores 54.8% on ExploitGym, 71.0% on CWE-bench and 88.2% on SEC-bench Pro

Source: Google

Google also shares two internal claims. Carbon gave more than 2x uplift in success rate for writing secure code compared with Argon. And the Chrome team reported it did more than 10X better than another lab's large frontier model at producing high-quality patches.

These are company numbers. Independent testing usually takes a few weeks to appear, so treat them as a first look, not a final verdict.

What most guides miss: the three scores fall in a clear order. Finding bugs (88.2%) sits well ahead of fixing them (71.0%), and fixing sits well ahead of exploiting them (54.8%). In plain words, Carbon is better at spotting and patching problems than at weaponising them, which is the balance you want in a tool meant for defenders.

Is Gemini 4 Carbon safer than Argon?

Going by Google's own tests, yes: Carbon cheats less, makes fewer unsupported claims and resists prompt injection better than Argon.

On Terminal-Bench 4.0, successful cheating fell to 0.0% and cheating attempts fell to 0.4% (Google). In live coding with Google's own teams, high-severity misalignment alerts dropped by almost 80%.

Here are the other changes Google lists:

• Fewer made-up claims. Carbon cuts unsupported claims by about 2x compared with Argon.
• Stays in scope. Overreach fell by 26% and under-service by 29%, so multi-step plans run more reliably.
• Prompt injection. Argon had a 0.7% attack success rate on Gray Swan's Indirect Prompt Injection benchmark. Carbon gets 0.0%.
• Asks before guessing. When a task is unclear, Carbon pulls the relevant sources and flags conflicts to the user before acting.

For anyone building AI agents that read emails, web pages or documents, the prompt injection result is the one to watch. A hidden instruction inside a page is one of the most common ways agents get tricked.

How much does Gemini 4 Carbon cost?

Gemini 4 Carbon costs the same as Argon at launch: $2 per million input tokens and $10 per million output tokens.

Cached input tokens get 95% off the normal input price, Google says (Google). The Verge calls it the same "competitive introductory price" as Argon (The Verge).

Google has not shared rupee pricing. API bills are charged in dollars, so your card's foreign exchange markup will add a little on top.

The cached-token discount is the money saver for Indian startups. If your app sends the same long system prompt or codebase context again and again, caching can cut most of that input cost.

When can Indian users and developers try it?

Not yet for most people. Carbon is only open to a subset of cyber defenders for now, with wider access coming in phases.

Google says it will widen access to trusted partners through its Fairwind Program, and is also taking part in the US government's voluntary pre-release testing process (Google). The Verge confirms it is currently limited to a select group of cybersecurity defence companies (The Verge).

Google says Carbon will come to developers, businesses and consumers "as soon as possible", but gives no date. There is no India-specific launch date either.

So what should you do today?

• Developers: keep building on Argon. Carbon has the same price, so switching later should be mostly a model-name change.
• Students and freshers: learn the basics of secure coding and prompt injection now. Security-focused AI tools are clearly where this is heading.
• Security teams: watch for Fairwind Program news if you work with Google Cloud or security partners.

Mistakes to avoid

Avoiding three common misreadings will save you time: Carbon is not in the Gemini app yet, its scores are benchmarks, and it does not replace code review.

Google says consumer access comes later, so don't assume Carbon is already inside the Gemini app on your phone (Google).

Don't read "88.2%" as "finds 88.2% of all bugs". It is a score on one benchmark, SEC-bench Pro, not a guarantee for your codebase.

And don't drop human code review. Even Google keeps adding guardrails and gathering feedback before a wider release.

FAQs

What is Gemini 4 Carbon used for?

It is built for hard coding problems, long-running AI agents and cybersecurity work such as finding, validating and patching vulnerabilities.

Is Gemini 4 Carbon free to use?

No free access has been announced. API pricing is $2 per million input tokens and $10 per million output tokens, and it is currently limited to selected cyber defenders.

How is Gemini 4 Carbon different from Gemini 4 Argon?

Carbon builds on Argon with stronger cybersecurity and long-task skills. Google says it gives more than 2x uplift in secure code generation and makes about 2x fewer unsupported claims.

Can I use Gemini 4 Carbon in India?

Not yet for most users. Google has not given an India date. Access will expand from cyber defenders to partners, then developers and consumers.

Expert review: pending.

Benchmark figures and prices are as announced by Google and reported by the sources below. Check Google's official pages before you build on them.

Related reading

• $2 Per Million Tokens: What Gemini 4 Argon Costs Indian Devs
• 100,000 Indian Engineers Now Build With Gemini. Are You Ready?
• 900 Million SMS Tips: How Google's AI Is Helping Indian Farmers

Sources

• Google: Gemini 4 Carbon: our next frontier model
• The Verge: Google launches Gemini 4 Carbon with a significant leap in cybersecurity