Google Built the Best Bug-Hunter on Earth. You Cannot Buy It.

Google Built the Best Bug-Hunter on Earth. You Are Not Allowed to Buy It.

On Wednesday, Google published a blog post with the kind of numbers that normally arrive attached to a product page and a checkout button. Carbon tops the intelligence leaderboard at 59. It lands 88.2% on SEC-bench Pro, the benchmark for finding vulnerabilities in real code. It hits 54.8% on ExploitGym, the benchmark for turning those vulnerabilities into working exploits, and 71.0% on CWE-bench for patching them. On its own internal tests, Google’s Chrome team reported Carbon produced high-quality patches more than ten times better than another lab’s large frontier model.

Then came the sentence that matters more than all the benchmarks combined: starting this week, Carbon goes to “a subset of cyber defenders,” with broader access phased in through the Fairwind Program. Developers, businesses and consumers get it “as soon as possible.”

Read that again. Not “available today.” Not “in the API now.” As soon as possible. The most capable vulnerability-finding model any lab has shipped is withheld by design, and the queue order is not alphabetical.

There is a defensible argument for releasing it this way — I will get to it, because it is not stupid. But there is also a plainly uncomfortable implication for anyone who assumed AI capability gets cheaper and more available on a schedule, and that uncomfortable implication is the reason this post exists.

What Google Actually Shipped, in Plain Numbers

Strip the marketing and Carbon is a long-horizon agentic coding model with an unusual specialisation: it is very good at the parts of software engineering humans are worst at, which is systematically looking for the thing that is going to break.

Google describes the capability across the cybersecurity defence lifecycle — detection, validation and remediation. It is built on Gemini 4 Argon, which shipped two weeks earlier, and it is aimed squarely at “sustained agentic workflows.” Internally, Google’s teams have watched Carbon run for days to persist through dead ends on multi-step engineering problems: root-causing and patching subtle bugs across large codebases and low-level systems.

Days. Not minutes. Not an autocomplete that gives up when the obvious fix does not work. A model that keeps going after the first three hypotheses are wrong, which is the actual shape of every hard bug any developer has ever chased at two in the morning.

Google is explicit that these external benchmarks were “evaluated without guardrails” — a detail that matters, because a model scoring 54.8% on turning vulnerabilities into exploits is a model that can do the offensive half of the job. Guardrails are what stand between a defensive tool and an offensive one, and guardrails are exactly what the staged rollout is protecting.

The Rollout Is the Product Decision, Not the Afterthought

Here is where Carbon stops being a benchmark story and becomes a power story. Google says it is “actively engaged in the U.S. government’s voluntary process for pre-release model testing.” Then: access goes to a subset of cyber defenders, expanding through Fairwind to “trusted partners,” and the general availability question is answered with “as soon as possible.”

That is three separate gates. A government review. A hand-picked defender list. A partner program. Every one of those gates has a door, and every door has someone standing at it deciding who walks through.

Consider what it means to be on the wrong side of all three. If you are a twenty-person software company in Ohio, your application security budget is whatever your lead developer can carve out between shipping features. The most effective vulnerability-finding tool in existence — priced at the same $2 per million input tokens as its predecessor, with cached input at 95% off — is not on the menu. Not because you cannot afford it, but because you have not been invited.

The counterargument deserves a fair hearing, and it is not weak. A model with offensive capability at this level is genuinely dangerous in the wrong hands, and a company that ships it to everyone on day one and then watches a hospital get ransomed has done something worse than slow-walking a release. Google is also not alone: Anthropic flagged liability risk in its own S-1 filing this week, banks spent the past two days telling customers not to hand their passwords to AI agents, and South Korea’s financial sector is absorbing a fresh wave of cyberattacks. The whole industry is suddenly being forced to answer the question of what happens when the agent does the damage.

But be clear about what “deliberate” means here. It does not mean safe. It means chosen. Google chose the order. Google chose the list. And the gap between #1 and second-best is now a gap Google alone decides who gets to close.

Carbon vs. Argon vs. What You Can Actually Use

Carbon did not arrive in a vacuum. It replaced Gemini 4 Argon two weeks after Argon launched, which tells you something about the pace Google is now running at — and something less comfortable about how long any particular model stays at the top of your stack.

The pricing is the most quietly brutal part of the announcement. Carbon costs the same as Argon: $2 per million input tokens, $10 per million output, with cached input at 95% off the input price. Google did not raise the price for the frontier. It held the price and moved the frontier forward, which is the behaviour of a company that intends to win the whole category.

Look at the second row and the third row together. The price is identical to Argon. The capability is not. That combination — same cost, more power, restricted access — is a very specific kind of market signal. It says the constraint on adoption is not money. It is permission.

The Fairwind Program Is Where the Real Story Lives

Google’s post mentions the Fairwind Program in a single subordinate clause: access will be gradually phased to “additional trusted partners” through it. One clause. No details on the page about what a partner is, what it costs, or how a company qualifies.

That single clause is doing an enormous amount of work. It is the mechanism by which a frontier capability gets allocated to some businesses and withheld from others, and it is described in the same register a company uses to mention a parking policy.

If you want to understand how AI market structure actually forms, watch the programs like this one rather than the benchmarks. Benchmarks tell you what a model can do. Programs like Fairwind tell you who gets to find out.

There is a historical rhyme here worth naming. Cloud computing went through the same gate: early capacity went to partners with the right contracts, the right scale and the right relationships, and everyone else waited for the price to fall and the door to widen. That worked out eventually. It also took years, and the companies that got in early built advantages that never closed.

What This Actually Means If You Run a Business

Let me make the practical case without pretending it is comfortable. The lesson is not “wait for Carbon.” You may be waiting a long time, and your competitors may not be waiting with you.

The lesson is that capability tiering is now a permanent feature of the AI market, and anyone building a stack on the assumption that the best model will always be rentable at list price is building on sand. That changes three decisions.

First, stop designing around a single frontier model. If your workflow only works with the top-ranked model on the leaderboard, you do not have a workflow, you have a dependency on someone else’s release schedule. Carbon replaced Argon in fourteen days. Assume your current model gets replaced under you and make sure the thing you built survives it.

Second, treat security tooling as a queue you are already standing in. Your software vendors are the ones who will — or will not — get access to models like Carbon. When you next evaluate a vendor, ask whether they can name what they use for vulnerability detection and whether that tool is on a restricted tier. The answer tells you how exposed you actually are. A vendor who has never thought about it is a vendor who is exposed.

Third, notice that the offensive half is moving too. ExploitGym at 54.8% is not a defensive benchmark. The same class of capability that finds your holes can be pointed at them, and the guardrails Google is leaning on to justify its staged rollout are the only thing standing between the two uses. That is not a reason to panic. It is a reason to shorten the time between “bug shipped” and “bug patched” — because the window is the only thing a defender actually controls.

The Part Google Did Not Say Out Loud

Google’s post never claims Carbon will stay restricted indefinitely. It says “as soon as possible,” twice, in slightly different words. That is a company leaving itself room.

What it also never says is how it will decide when the guardrails are good enough, or who signs off, or what happens if a Fairwind partner gets compromised while holding access nobody else has. Those are the questions a serious reader should be asking, and none of them have published answers.

What we do know is that the model exists, it is the best of its kind, it is priced like a commodity, and the door is being opened from the inside. The companies on Google’s list will spend the next several months finding vulnerabilities faster than anyone else can. Everyone else will get the same tool later, when “later” arrives.

The uncomfortable truth of the AI market in late 2026 is that the frontier does not price itself out of reach. It sorts itself out of reach. That is a harder problem to solve, because there is no discount to wait for and no cheaper tier coming — only a list, and the question of whether you are on it.

Frequently Asked Questions

What is Gemini 4 Carbon?
It is Google’s newest frontier AI model, announced 28 October 2026, built on Gemini 4 Argon. It specialises in cybersecurity defence work and sustained long-horizon engineering tasks, and it ranks #1 on Artificial Analysis Intelligence Index v5.0 at 59.

Can I use Gemini 4 Carbon today?
Not unless you are on Google’s list. Access started this week for a subset of cyber defenders, with broader access phased through the Fairwind Program to trusted partners. Google says developer, business and consumer access is coming “as soon as possible.”

How much does Gemini 4 Carbon cost?
Google priced it identically to Argon: $2 per million input tokens and $10 per million output tokens, with cached input tokens at 95% off the input price. Pricing being public while access is restricted is the core contradiction of the release.

How good is Carbon at finding real vulnerabilities?
It scored 88.2% on SEC-bench Pro for finding vulnerabilities in real code, 54.8% on ExploitGym for turning them into working exploits, and 71.0% on CWE-bench for patching. Google notes these external results were evaluated without guardrails.

Is Carbon better than Claude Opus 5.5 or GPT-6 Astra?
By Google’s own reporting it outperforms them on several benchmarks, including bug-hunting, and holds the #1 spot on the Artificial Analysis Intelligence Index v5.0. Independent verification of the internal figures is not available.

What should a small business do about restricted AI capability?
Two things. Ask your software vendors which models they use for security work and whether those are restricted tiers, and avoid building workflows that only function with the single top-ranked model. Carbon replaced Argon two weeks after Argon launched; assume your model of choice gets replaced under you.

What is the Fairwind Program?
Google describes it as the program through which Carbon access is gradually extended to trusted partners. Google’s announcement gives no detail on membership criteria, cost or timelines.