Google officially launched Gemini 4 Carbon on October 28, rolling it out selectively to an elite group of pre-screened cyber defenders rather than making it broadly available to developers or consumers. Arriving roughly two weeks after the debut of Gemini 4 Argon, the tech giant notes that Carbon demonstrates superior capabilities in identifying vulnerabilities, crafting exploits, and patching code. At present, the company has not provided a definitive timeline for a wider public rollout.

For enterprise security leaders, this strategic move carries significant weight. It marks the decision of yet another frontier AI lab to withhold its most powerful offensive-capable cybersecurity model from the general public due to inherent risks. The specific criteria established by Google to determine eligibility will inevitably dictate the standards and terms extended to corporate security teams. As it stands, Google has refrained from publishing a comprehensive public roster of participating organizations.

How Fairwind Controls Access

Access to Carbon is managed exclusively through Fairwind, an initiative that Google states collaborates with upwards of 650 partners. Priority access is granted to government entities, critical infrastructure operators, and foundational technology platforms, while academic research institutions specializing in defensive benchmarking are invited to apply. Interested entities must submit an application form, after which Google conducts thorough background checks into their operational security track records.

Mandatory security prerequisites for partners include the implementation of phishing-resistant multifactor authentication, strict internal containment—limiting model usage strictly to internal security, incident response, and penetration testing units—and comprehensive employee activity tracking. The redistribution, reselling, or sharing of access credentials is strictly forbidden. Approved activities encompass threat modeling, reverse engineering, and malware dissection, whereas the automated generation of malicious software is strictly prohibited.

The underlying architecture of the model is optimized for prolonged, complex workloads. Google highlights that Carbon has operated autonomously for days within its internal engineering teams, successfully tracking complex bugs to their root causes within massive code repositories and subsequently generating patches. Defenders can deploy the model against legacy codebases to systematically clear out technical debt, utilizing CodeMender—Google's proprietary code security agent—to automate remediation efforts.

Performance metrics released by Google indicate an 88.2% success rate on SEC-bench Pro for vulnerability discovery, 54.8% on ExploitGym for exploit generation, and 71.0% on CWE-bench for patching. Furthermore, the company asserts that Carbon more than doubles the success rate of the Argon model when it comes to producing secure code.

During an initial introductory phase, Google has priced Carbon identically to Argon, charging $2 per million input tokens and $10 per million output tokens. Following the conclusion of this introductory window, these rates are scheduled to increase to $4 and $20, respectively.

This cautious posture mirrors Anthropic’s strategy from April regarding Glasswing, which granted twelve premier launch partners—including AWS, Apple, Microsoft, and Nvidia—access to the Claude Mythos Preview, alongside over 40 other critical software maintainers.

Anthropic backed this rollout by pledging up to $100 million in usage credits alongside $4 million in financial support for open-source security coalitions, reiterating that Mythos Preview would not see general availability.

While both artificial intelligence laboratories frame these stringent access controls as defensive measures relying on trusted ecosystems, their execution differs. Google’s partner network is broader on paper, with Gemini Enterprise's implementation of Argon supporting zero data retention. Conversely, Anthropic has publicly disclosed its launch partners, directly funded open-source maintainers, and subsequently introduced a tiered verification framework.

The most pronounced divergence lies in transparency: Glasswing openly publishes its roster of participants, whereas Fairwind displays partner logos without disclosing names within its textual documentation. Furthermore, Anthropic prices Mythos Preview at $25 per million input tokens post-research preview, overshadowing Carbon's introductory rate of $2. Because the two labs evaluate their systems using disparate benchmarks, direct comparative performance remains difficult to quantify.

What Fairwind Does Not Solve

An evaluation by WorkOS regarding the Argon deployment highlights three core vulnerabilities that persist within the new Carbon framework. Vetting functions merely as a point-in-time assessment, and Google has yet to clarify what specific operational triggers would prompt a secondary security review following a partner organization's acquisition or data breach. Moreover, while system access is provisioned at the corporate level, the ultimate risk of misuse remains distributed among individual employees. Finally, because the participant directory is kept confidential, individual partners lack visibility into who else shares the designated trust boundary.

The benchmark data similarly warrants close scrutiny. Google disclosed that its external cybersecurity evaluations were conducted without safety guardrails, meaning the published metrics reflect the model's performance with refusals entirely disabled. Additionally, nearly all performance claims originate from proprietary in-house testing without independent external validation. Google has also noted that it continues to aggregate user feedback and refine safety guardrails ahead of any general release. Notably, Fairwind's official documentation continues to feature Argon as the primary available model, leaving the exact written terms for Carbon veiled in privacy.

Ultimately, deploying an AI model capable of discovering software vulnerabilities at a pace that vastly outstrips human review capacity simply shifts the operational bottleneck from bug detection to remediation triage.

What Security Leaders Should Ask Google

For enterprises that do not fit the profile of a government agency, critical infrastructure provider, or major technology platform, eligibility remains the primary hurdle. Security leaders should proactively inquire about application pathways and the internal decision-making criteria used by the vendor.

Review capacity is the next critical consideration. If Carbon identifies hundreds of exploitable software flaws within a single quarter, internal engineering teams must manually validate and deploy each patch, keeping in mind that automated outputs from tools like CodeMender still demand human engineering sign-off.

Evidence and auditing represent the third vital pillar. Organizations must request comprehensive audit logs detailing which specific personnel or service accounts executed individual sessions, alongside metrics detailing how rapidly access permissions are revoked when a security team member departs.

According to WorkOS, the Argon rollout prioritized trusted defenders before queuing paid API customers. If Google replicates this sequential release model for Carbon, the majority of enterprises will receive access in staggered tiers. This provides corporate security leadership with a valuable window to establish robust triage pipelines and logging infrastructure before the technology lands in their own environments.

Placing restrictions on an advanced artificial intelligence model capable of executing software exploits is a pragmatic choice for any vendor reporting a 54.8% success rate in exploitation capabilities. However, earning genuine industry trust will require Google to fully disclose its participant roster and transparently enforce penalties against partners who violate operational protocols.