Is Gemini 4 Carbon safe? What Google has and hasn’t said

Short answer: you cannot use Gemini 4 Carbon yet, and Google’s announcement says nothing at all about your data. Google announced it on 28 October 2026 and is giving it first to a subset of cybersecurity defenders. What Google has published is a set of safety numbers from its own tests, most of them better than Argon’s. When Carbon does reach ordinary accounts, what happens to what you type will depend on the product you use it through, and those rules are already written down.

This post keeps two questions apart. First, what Google says about how Carbon behaves and who can use it. Second, what happens to your prompts in the Gemini app or the API, which no model announcement changes. Everything here was checked against public sources on 29 October 2026.

What Gemini 4 Carbon is

In Google’s announcement, Koray Kavukcuoglu calls Carbon the company’s strongest model, aimed at cybersecurity and long, multi-step work. It builds on Gemini 4 Argon, announced at the end of September. The introductory API price matches Argon’s: $2 per million input tokens and $10 per million output tokens, in US dollars, rising later to $4 and $20. Cached input is 95% cheaper.

The headline numbers are security ones: 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on ExploitGym for exploiting them, and 71.0% on CWE-bench for patching. Google also says Carbon tops the Artificial Analysis Intelligence Index. MarkTechPost’s summary runs through the full table, and Unite.AI notes that these remain Google’s own figures until outside researchers get access. For the background on the model it builds on, see what Gemini 4 Argon is.

Who can use it today

From the week of the announcement, a subset of cyber defenders. Google then plans to widen access gradually to other trusted partners through its Fairwind Program. Developers, businesses and consumers are promised Carbon as soon as possible, with no date and no word on which countries come first.

Fairwind is not an open sign-up. Its page lists more than 650 partners and gives priority to governments and national cyber authorities, critical infrastructure such as healthcare, telecoms, energy and finance, major technology platforms, and academic labs doing defensive research. Applicants are vetted, including background checks. Members must keep access inside their security, incident-response or penetration-testing teams, protect it with phishing-resistant multi-factor authentication, and may not share or resell it. As of 29 October the page still named only Argon, not Carbon.

So a site offering you Gemini 4 Carbon today is very likely selling something else, and passing what you type to a third party whose rules you have not read.

What Google says about its safety

Google says Carbon uses the same layered safety stack as Argon: safety training, real-time misuse defences, resistance to prompt injection, and monitoring of the model’s chain of thought. How that stack works for Argon is in is Gemini 4 Argon safe and Google’s Gemini 4 safety and security report. The new figures for Carbon, all from Google’s internal testing:

• —Indirect prompt injection, where hidden instructions in a web page or document hijack the model: 0.0% attack success on the Gray Swan benchmark, against 0.7% for Argon.
• —Unsupported claims: roughly half as many as Argon. Instead of inventing evidence, Carbon is meant to state its caveats or list what is still needed.
• —Cheating on tasks: 0.0% successful cheating on Terminal-Bench 4.0, with cheating attempts at 0.4%.
• —Staying in scope: 26% less overreach beyond what was asked, and 29% less under-delivery.
• —High-severity misalignment alerts in internal live coding tests: down by almost 80%.

Google also says it is taking part in the US government’s voluntary pre-release testing process and is still refining safeguards before a wider release. It adds that the external cyber benchmarks were run without guardrails. That is candid, and it is also the reason the model is not on general release. The wider question of who watches what an agent does is the subject of OpenAI’s agent misalignment monitoring.

Half as many unsupported claims is a good number. It comes from Google’s own tests, and half is not zero.

The safety number that matters at work

For most people the everyday risk is not a cyberattack. It is a confident answer with nothing behind it. The unsupported-claims figure speaks to exactly that, which makes it the most useful number in the post for anyone outside a security team. It is also the one no outsider has been able to check yet. How to check an AI answer when you are not the expert is the habit that covers you whatever the number turns out to be.

What happens to your data

The announcement has no data section. That is normal for Google, because data handling follows the product and the plan, not the model name. For Fairwind members, the programme page mentions zero data retention when the model is used directly as a managed model on Gemini Enterprise. Everyone else falls under two existing rule sets. If the line between a model and the app you open is fuzzy, AI agent vs LLM sorts it out.

In the Gemini app, the Gemini Apps privacy hub sets the rules. With Keep Activity on, chats auto-delete after 18 months by default. With it off, Google keeps them with your account for 72 hours. A subset of chats is read by human reviewers, and reviewed chats are kept for up to three years. Google’s own advice is not to enter anything confidential.

Through the API, the Gemini API terms split on payment. On unpaid services, Google may use prompts and responses to improve its products, and humans may read them. On paid services it does not, and logs them for a limited time only to detect abuse. In the European Economic Area, Switzerland and the UK, the paid-service rules apply to everything, including Google AI Studio and the free quota.

The one precedent: Argon

Argon went the same way. Announced on 30 September, given first to cyber defenders, then opened on 13 October in the Gemini app to Google AI Pro and Ultra subscribers, and on the paid Gemini API tier the same day. Whether Carbon follows at the same pace is unknown. A precedent is a pattern, not a promise. For how another vendor handled the same questions this month, see is GPT-6.1 Terra safe.

What to do before it reaches you

1. 01Do not look for early access through third-party sites. Google has said who gets Carbon, and an unofficial wrapper sets its own data rules.
2. 02Check Keep Activity in the Gemini app once, deliberately, so the setting is a choice rather than a default.
3. 03If you use the API at work, confirm whether your project is billed. Paid and unpaid tiers are governed differently, unless you are in the EEA, Switzerland or the UK.
4. 04Keep passwords, keys and client data out of prompts. A better safety score does not change that.
5. 05Ask for answers you can check. Write a prompt that works first try shows how to ask for sources and caveats up front.

Coursium is a mobile app that teaches people to use AI at work. Model names change every few weeks. Knowing where your data goes, writing a clear instruction and checking what comes back carry over from one model to the next. If that is what you want to practise, have a look at Coursium.