GitHub adds Gemini 4 Carbon to Copilot: model available in 10 environments

When an assistant proposes a bug fix, the developer has to check two things: whether the error is gone and whether a new one has appeared next to it. Gemini 4 Carbon can now be tried on exactly this kind of task inside GitHub Copilot. For example, give it a defect in an access-control check and see whether it finds the cause, proposes a suitable patch and verifies neighboring scenarios. This is an example of use, not the result of a published test.

The practical value of the news is the chance to compare one more model on your own code without adopting a separate new tool. But there is no basis yet to promise a team faster development: the announcement reports availability, not proof of an advantage.

What exactly has appeared in Copilot

According to GitHub's announcement of November 10, Gemini 4 Carbon has become generally available for Pro+, Max, Business and Enterprise subscriptions. The rollout is gradual. The model can be selected in ten environments, including VS Code, JetBrains IDEs, Copilot CLI and the GitHub Copilot coding agent. Billing is by usage, at the provider's price list; enterprise access is managed by administrators.

GitHub describes the model as designed for complex programming, agentic tasks and reasoning, with an emphasis on secure code generation. The post contains no comparative measurements of quality, speed or number of vulnerabilities. So for now the "emphasis on security" is best read as a stated direction of the model's development.

For a team, there are two separate decisions here. The first is whether to allow access to the new tool. The second is to determine on which tasks using it pays off. The mere appearance of an item in the menu answers only the first question and says nothing about the quality of a future fix.

How to test it on a clear-cut bug

Imagine a service where a user can open someone else's document by substituting its identifier in a request. A useful assignment for the model goes like this: find the cause, propose a minimal fix and add tests for access by the owner and by an outside user. The conditions should be specific enough that the result can be verified.

A good answer in such an experiment should show where exactly the server makes the access decision. Then the developer checks that the fix blocks other people's documents while preserving legitimate scenarios: owner access, collaboration and the administrative rights provided by the product. A nice explanation without a working patch does not solve the problem.

For comparison, take an internal bug that has already been fixed and the original version of the repository before the fix. Give the same task to Carbon and to the model your team uses now. Look at test results, unnecessary changes, human review time and total cost. One good answer is a reason to continue the experiment; several different tasks will give a more useful picture.

Define in advance what counts as success. For example: the error reproduces before the patch, disappears after it, neighboring scenarios keep working, and the reviewer understands the reason for each change. Otherwise it is easy to mistake a confident tone for the quality of engineering work.

What is worth paying for

For a product manager or founder, the key metric is how much work the team actually accepts costs. A cheap answer can turn out to be expensive if the developer spends a long time reworking the patch. A costlier request can pay off if it shortens the analysis of a complex defect. This has to be measured together with human time.

Start with a small set of tasks: a bug fix, a change across several related files and an access-control check. Record the results and costs. If Carbon helps with a specific type of work, use it there. If there is no difference, there is no reason to change your usual process either.

The promise of secure code does not replace review and testing of the application's behavior. The decision to adopt should be made after your own experiment: it will show whether the team gets a useful fix faster and at what cost.