Google Holds Back Powerful Gemini Carbon Model

The Gemini Carbon Model is Google's most powerful cybersecurity system yet, and almost nobody can use it. The company announced the model on October 28, 2026, describing it as its strongest frontier system for cybersecurity and long-running engineering work, then restricted first access to a small group of vetted cyber defenders. Google says wider availability will follow, but it has set no public date for developers, businesses or ordinary users.

What the system is built to do covers the full defense cycle: find a software flaw, prove it can be exploited, and fix it at the root cause. Google reports that internal teams watched it work continuously for days on complex engineering jobs, pushing through dead ends to trace subtle bugs across large codebases. That persistence is the point of the Gemini Carbon Model. Earlier models often stalled after a few failed attempts or lost track of details across sprawling repositories, while this one is designed to keep going until the job is done.

The headline numbers come from Google's own launch materials and have not yet been independently reproduced. On a benchmark for discovering real vulnerabilities, the system scored 88.2 percent. On a separate test for validating risk through exploitation, it scored 54.8 percent. On a third test for patching at the root cause, it reached 71.0 percent.

An independent index of general capability placed the Gemini Carbon Model first with a score of 59, ahead of its closest rival by a single point, according to reports of the launch. Google also says its Chrome team found the system more than ten times better than another leading model at producing high-quality patches, though that comparison is self-reported and the rival was not named.

Why Google is keeping the gates closed

The reason is dual use. A system genuinely good at finding flaws, writing exploits and patching code helps defenders, and in the wrong hands it helps attackers just as much. Google is therefore releasing it first through a restricted-access program for trusted defenders, covering more than six hundred fifty partners including governments, national cyber authorities and operators of critical infrastructure in health care, energy, telecom and finance. Work inside that program is limited to defensive and academic research purposes, according to the company.

Safety testing is the second reason for the slow rollout. Google says the system is taking part in the United States government's voluntary pre-release testing process, and that broader access will come after it gathers feedback and adjusts its safeguards. The safety figures published for the Gemini Carbon Model point in an encouraging direction: successful cheating on a coding benchmark fell to zero, indirect prompt-injection attacks succeeded none of the time on one independent test, and high-severity misalignment alerts in live coding environments dropped by almost four-fifths. Those are the company's own measurements, and outside researchers cannot verify them until more people can run the system.

What it costs, and who waits

Pricing follows the template of its predecessor, which became generally available on October 13, 2026. Introductory rates are two dollars per million input tokens and ten dollars per million output tokens, with cached input costing ninety-five percent less than the standard input rate. After the introductory period, which Google has not dated, the listed rates rise to four dollars and twenty dollars respectively. For a security team triaging vulnerabilities around the clock, that pricing is a budget line to plan now; for everyone else, it is a number to watch from the sidelines.

The gated launch fits a pattern that is becoming hard to miss. A day before this announcement, Google unveiled an interactive world model as a research preview for trusted testers rather than a public release, and rival labs have likewise begun staging their most capable systems behind vetting first. The shift reflects a genuine dilemma: the same capability that lets a hospital patch a flaw before attackers find it could let an attacker find that flaw first.

For security teams, the practical question is whether to seek access now or wait. Hospitals, banks, utilities and government agencies can apply through the restricted-access program and run their own vulnerability-triage tests, rather than taking launch benchmarks on trust. Everyone else has a simpler job: watch how the first vetted users report back, because their experience will say more about the Gemini Carbon Model than any launch chart can.

Critics note the tension in Google's own pitch, since a model kept from the public cannot be independently audited by the researchers best placed to find its weaknesses. The debate over state-by-state AI rules shows how unsettled the governance question remains, as covered in the governors' push on AI guardrails, while lab automation's latest funding round shows how quickly AI is moving into high-stakes work. For now, the Gemini Carbon Model is a tool readers will hear about long before they can touch, and that gap between announcement and access is itself the story.