Google opens Gemini 4 Carbon to paying developers

Google has widened access to Carbon, a version of its Gemini 4 model, so that paying developers and business customers can use it, SecurityWeek reported on 10 November 2026. The report says the move followed work at Google DeepMind, where AI agents built on the model were used to prove security guarantees in libsignal, the code library behind the Signal messenger.

The report frames the libsignal work as the demonstration that preceded the wider rollout. In other words, Google used an internal security result as the shop window for the model, then opened the door to customers who pay. That pattern is now common across the large model vendors, and it matters to security teams because the same agents that write proofs can also be pointed at a company's own code.

Proving a security guarantee is not the same as testing for bugs. A proof is a formal argument that a piece of code behaves as specified under all inputs covered by the specification, rather than a sample of them. Automated proof work has historically been slow and expensive, which is why it has mostly been reserved for small, high-value components such as cryptographic libraries. An agent that can carry out parts of that work without constant human direction is, on paper, a cost change rather than a capability change.

Several things are not clear from the available reporting. SecurityWeek's summary does not state which parts of libsignal were covered, what the specifications said, how much of the proof work was done by the agents as opposed to human engineers, or whether the proofs have been independently reviewed or published. Nor does it set out the pricing, rate limits or usage terms attached to the newly widened Carbon access, or whether the agent tooling used by DeepMind is part of what customers get.

Those gaps are worth noting because the gap between a vendor demonstration and a reproducible result is where most of the risk sits. A proof is only as good as the specification it is checked against. If the specification misses a property that an attacker cares about, the proof will still pass. Security teams reading announcements of this kind should ask what was proved, not simply that something was.

For now, the practical change is one of access. Developers and businesses who pay Google can use Carbon, where previously the model was more tightly held, according to SecurityWeek. Whether agent-driven verification becomes a routine part of securing widely used open source libraries, rather than a flagship demonstration on a single well-known one, is not something the report addresses.