Gemini 4 Carbon: Google's $2 Cyber-Defense Model Nobody Can Buy Yet

The headline number, and the catch behind it

Google DeepMind announced Gemini 4 Carbon on October 28, 2026, calling it its strongest model yet, built for cybersecurity defense and long-running engineering work. The announcement lands exactly two weeks after Gemini 4 Argon, and the pace is the first thing worth noticing: Google is now shipping frontier models the way other companies ship point releases.

The headline number is real, but it comes from an outside tester, not from Google alone. Artificial Analysis puts Carbon first on version 5.0 of its Intelligence Index, with a score of 59. That puts it one point ahead of Anthropic's Claude Opus 5.5 at 58 and two ahead of OpenAI's GPT-6 Astra at 57. Carbon leads four of the index's nine evaluations — HLE-Diamond, Terminal-Bench-Science, AA-Omniscience and AutomationBench-AA — while trailing in others, which is worth stating plainly: first overall does not mean first everywhere.

Then the catch. Almost nobody can use Carbon yet. Google is making it available this week to a subset of cyber defenders, then gradually to additional trusted partners through its Fairwind Program. Developers, businesses and consumers get it, in Google's words, "as soon as possible" — with no date attached. The price is published anyway, which is unusual for a model you cannot buy, and that is what makes this launch worth covering now rather than when the gates open.

What Carbon is for

Carbon is a frontier model tuned for two jobs that usually pull in opposite directions: finding security flaws, and doing long engineering work without wandering off. Google says its internal teams have watched Carbon run for days, persisting through dead ends to root-cause and patch subtle bugs across large codebases and low-level systems. That is a company claim from internal use, not an independent test, and it should be read that way. Still, it explains the positioning: this is not a chatbot model with a security hobby. The security work is the product.

Google frames the cybersecurity case as a three-step lifecycle — find, validate, fix — and publishes a benchmark for each step. All three were evaluated without safety guardrails, a detail Google states itself and one that matters: these scores describe the raw model, not the guarded product most people will eventually meet.

• Finding real vulnerabilities: 88.2% on SEC-bench Pro, where the model autonomously uncovers complex flaws buried in real-world software. Google calls this a state-of-the-art result, and the lead over its rivals on this benchmark is wide.
• Validating risk through exploitation: 54.8% on ExploitGym, which tests whether a model can turn a disclosed flaw into a working exploit. Defenders use this to decide what to patch first. The same capability in other hands is the dual-use tension at the heart of this release, and it is almost certainly why the rollout is gated.
• Patching at the root cause: 71.0% on Collinear's CWE-bench, turning validated findings into working code fixes rather than surface-level patches.

On internal benchmarks, Google reports more than double the success rate for generating secure code compared with Argon. Its Chrome team reports Carbon generating high-quality patches more than ten times better than another lab's large frontier model — a striking claim with an unnamed rival, so treat it as a company anecdote, not a measurement. Wiz, Google's cloud security platform, reports Carbon leading on web penetration testing benchmarks for its Scan for Good initiative. Again, company-selected evidence, but it fits the pattern: the early users are defenders, and the early stories are defender stories.

What it costs — and the fine print

Carbon launches at the same introductory price as Argon: $2 per million input tokens and $10 per million output tokens, with cached input tokens priced at 95% off the input rate. At the introductory rate, cached input works out to $0.10 per million tokens.

The fine print has three parts. First, Artificial Analysis lists Carbon's standard pricing at $4 per million input tokens and $20 per million output tokens — the same standard rate as Argon — with the current price framed as a 50% launch discount. Second, unlike Argon's introductory period, no end date has been confirmed for Carbon's discount, so there is no November 30-style deadline to plan around; do not assume Argon's date carries over. Third, and most important, the price is currently theoretical for almost everyone reading this: there is no public API access to buy yet, so the rate card describes a future purchase, not a checkout you can complete today.

For a sense of scale, Artificial Analysis puts Carbon's cost at $7.76 per Intelligence Index task at standard pricing — about 23% less than Claude Opus 5.5 in max mode at $10.04, but about 1.2 times GPT-6 Astra in max mode at $6.25. Carbon uses 123,000 output tokens per task against Opus 5.5's 173,000, which is where much of the saving comes from: it writes less to reach a comparable answer. Those are third-party measurements on a benchmark, not a bill you will receive, but they are the most concrete cost comparison available while access is closed.

Where Carbon does not lead

The honest version of this story includes the places where Carbon trails, because Artificial Analysis publishes those too. On its Coding Agent Index, Carbon with high reasoning scores 59, three points behind Claude Code with Claude Opus 5.5 in max mode at 62. Carbon ranks second on Terminal-Bench 4.0 at 64% and on FrontierCode v1.1 at 51%, again behind Opus 5.5 in max mode. On agentic knowledge work, Carbon scores 1,609 Elo on AA-Briefcase — a 126-point improvement over Argon — but still trails Kimi K3.1 Pro at 1,678, Muse Wonder in max mode at 1,659 and Grok 4.7 in xhigh mode at 1,638. Its biggest gain there is presentations, up 293 Elo to 1,598.

There is also a number that moved in the wrong direction. On AA-Omniscience, Carbon scores 54, six points ahead of Opus 5.5 and eight ahead of Argon, with accuracy up ten points over Argon to 58%. But its hallucination rate rises from Argon's 4% to 11%. That is still the second-lowest of any model Artificial Analysis lists — behind only Argon, against 50% for both Opus 5.5 and GPT-6 Astra in max mode — yet it is a reminder that a higher index score and a more trustworthy model are not the same thing.

Outside the benchmarks, Carbon jumps 89 Elo points to land fourth at 1,768 on WebDev Arena, which Google ties to better output quality and artifacts in full-stack web development. And on context, Artificial Analysis lists a 1-million-token window, with text, image, video and speech input and text output. Google published no parameter count, and no public model card accompanied the announcement, so anyone quoting a size for Carbon is guessing.

The safety work, and why the rollout is gated

Carbon builds on the same multi-layered safety stack as Argon — training, real-time misuse defenses, prompt-injection resilience and chain-of-thought monitoring — and Google reports a set of alignment gains measured internally. Successful cheating on Terminal-Bench 4.0 fell to 0.0%, with cheating attempts down to 0.4%. In live coding with its own teams, high-severity misalignment alerts dropped by almost 80%. Unsupported claims fell by roughly half compared with Argon. Overreach fell 26% and under-service fell 29%, which Google reads as more reliable execution of multi-step plans without stepping outside scope. On Gray Swan's Indirect Prompt Injection benchmark, Carbon's attack success rate is 0.0%, down from Argon's 0.7% — every evaluated attack attempt resisted.

All of those figures are Google's own, from internal testing. None has independent replication yet, because almost nobody outside Google has the model. That is the circular problem with a gated launch: the safety claims cannot be checked by the people most qualified to check them until the gate opens.

The gate itself has a structure. Google says it is engaged in the U.S. government's voluntary process for pre-release model testing. Access starts with a subset of cyber defenders, then expands to additional trusted partners through the Fairwind Program, which reporting describes as prioritizing governments, critical infrastructure operators and core technology platforms. The sequencing is deliberate, and it tells you how Google sees the risk: a model that scores 54.8% on turning flaws into working exploits is a defender tool first and a general product second, at least for now.

Carbon vs the field

The comparison that matters most is against Argon, because Carbon is being sold as its successor two weeks later. On the Artificial Analysis Intelligence Index v5, Carbon scores 59 against Argon's 50 — a nine-point jump in a fortnight. On SEC-bench Pro it is 88.2% against 83.4%; on ExploitGym 54.8% against 42.0%. Those are large moves, and they are also the reason to be slightly skeptical of the cadence: two weeks is a short time for a genuinely new model, and developers will reasonably ask how much of Carbon is a new model and how much is Argon further tuned. Google's announcement does not answer that question, and the lack of a model card means nobody outside Google can.

Scores are Artificial Analysis Intelligence Index v5 and Google's published cyber benchmarks, with rival SEC-bench and ExploitGym figures as compiled in launch coverage. Benchmark figures for Carbon were evaluated without guardrails, per Google.

Pros and cons

Pros: the highest score on the Artificial Analysis Intelligence Index v5, with a clear lead in complex reasoning, knowledge and scientific tasks; the strongest published cyber-defense benchmarks across finding, validating and patching; a nine-point index jump over Argon in two weeks; long-horizon engineering that, by Google's internal account, sustains multi-day work; safety metrics that improved on every axis Google reports; and a published price that undercuts the standard rate of its closest rival on a per-task basis.

Cons: almost nobody can use it, with no date for general access; the introductory price has no confirmed end date, so budgeting beyond it means assuming the $4/$20 standard rate; it trails Claude Opus 5.5 on coding-agent benchmarks; its hallucination rate rose from Argon's 4% to 11%; no parameter count or public model card; and every safety and internal benchmark figure is company-reported, with no independent replication possible until access widens.

FAQ

What is Gemini 4 Carbon?

Gemini 4 Carbon is Google DeepMind's frontier model announced October 28, 2026, built for cybersecurity defense and long-horizon engineering tasks. It finds vulnerabilities, validates them through exploitation testing, and patches them at root cause, and it ranks first on Artificial Analysis Intelligence Index v5 with a score of 59.

Can I use Gemini 4 Carbon today?

Almost certainly not. Access begins with a subset of cyber defenders, then expands to additional trusted partners through Google's Fairwind Program. Developers, businesses and consumers will get access via Google's product surfaces "as soon as possible," with no date given. There is no public signup that guarantees access.

How much does Gemini 4 Carbon cost?

The introductory price is $2 per million input tokens and $10 per million output tokens, with cached input at 95% off. Artificial Analysis lists the standard price at $4 per million input tokens and $20 per million output tokens, with the current rate framed as a 50% launch discount. No end date for the discount has been confirmed, and there is no public API to buy through yet.

How is Carbon different from Argon?

Carbon scores nine points higher than Argon on the Artificial Analysis Intelligence Index v5 (59 vs 50), leads on all three published cyber benchmarks, and adds long-horizon engineering and stronger alignment metrics. Argon, by contrast, is already available through the Gemini API. Carbon is the stronger model on paper and the less available one in practice — a trade-off worth keeping in mind before planning any migration. For the full Argon picture, see our Gemini 4 Argon pricing analysis.

Should defenders wait for Carbon or use Argon now?

If you have production security work to do, use what you can buy: Argon is available through the Gemini API today, while Carbon has no general access date. Carbon's benchmarks suggest it will be the better tool when it arrives, but a benchmark is not a deployment, and the gated rollout means the wait could be weeks or longer. The same week also brought another Google frontier story worth comparing: Google Genie 4, the world model you can talk to and steer live.

Key takeaways

• Google DeepMind announced Gemini 4 Carbon on October 28, 2026, two weeks after Argon, as its frontier model for cybersecurity defense and long-horizon engineering.
• Carbon ranks first on Artificial Analysis Intelligence Index v5 at 59, ahead of Claude Opus 5.5 at 58 and GPT-6 Astra at 57, but trails Opus 5.5 on coding-agent benchmarks.
• Its cyber benchmarks are 88.2% on SEC-bench Pro, 54.8% on ExploitGym and 71.0% on CWE-bench, all evaluated without guardrails, per Google.
• Introductory pricing is $2 per million input tokens and $10 per million output tokens, with cached input 95% off; the standard rate is $4/$20, with no confirmed end date for the discount.
• Access starts with a subset of cyber defenders through the Fairwind Program, with no date for developers, businesses or consumers — so for now, Carbon is a price list and a benchmark sheet, not a tool you can buy.

Carbon will be judged properly only when defenders outside Google's first cohort can run it against their own codebases and their own threats. Until then, the honest summary is this: the strongest benchmark sheet Google has published this year, attached to a model almost nobody can touch, at a price that is published but not yet payable. That combination — a public price for a closed product — is becoming Google's signature move, and it is worth watching whether the gate opens as fast as the benchmarks suggest it should. Published October 29, 2026, from the October 28 announcement and same-day independent testing.