Short answer: Google Gemini 4 Carbon is Google’s newest frontier AI model, announced on October 28, 2026, and it is built for two jobs in particular: cybersecurity defense and long, multi-step engineering work. Google calls it its strongest model yet. It tops the Artificial Analysis Intelligence Index v5.0 with a score of 59, and it leads three security benchmarks for finding vulnerabilities, testing whether they can be exploited, and writing patches. The catch is access. For now, Carbon is going to a selected group of cyber defenders first through Google’s Fairwind Program, and Google has not announced a date for general developer or consumer availability. When it does launch broadly, the introductory price will be $2 per million input tokens and $10 per million output tokens.
If you follow AI models at all, the timing will look familiar. Carbon arrives just two weeks after Gemini 4 Argon, Google’s previous frontier release. That pace is part of the story. Google is now shipping major models in weeks rather than months, and each one is aimed at a sharper slice of work. Argon was the general frontier model. Carbon is the security specialist that also happens to be very good at sustained coding.
What is Gemini 4 Carbon?
Gemini 4 Carbon is the next model in Google’s Gemini 4 family, developed by Google DeepMind. In Google’s own description, it is its strongest model with state-of-the-art cybersecurity and long-horizon capabilities. Long-horizon is the important phrase. Most AI coding tools are good at short tasks: write a function, fix a bug, explain a snippet. Carbon is designed to stay on much harder problems for far longer, working through dead ends and multi-step engineering tasks that can take days.
Google says its internal teams have already seen Carbon run for days on complex work such as tracking down the root cause of a subtle bug in a large codebase and then patching it across that codebase and low-level systems. That is a different kind of claim from a benchmark score. It is about persistence, not just correctness on a single question. For security teams, the same persistence matters: finding a real vulnerability in production software is rarely a one-shot task. It takes exploring code, testing hypotheses, and following a chain of evidence.
Carbon also improves on general work. Google reports a jump of 89 Elo points on WebDev Arena, landing at number 4 with a score of 1768, which reflects better quality in full-stack web development output. So while the launch is framed around security, this is not a narrow model. It is a general frontier model with a security-first rollout.
The benchmark numbers, and what they actually mean
Benchmarks are easy to quote and easy to overread, so here is what each of Carbon’s headline numbers measures, in plain terms.
Finding vulnerabilities: 88.2% on SEC-bench Pro
SEC-bench Pro tests whether a model can autonomously uncover complex flaws buried in real-world software. Carbon’s 88.2% is, according to Google, a state-of-the-art result and a firm lead over rivals. For a security team, this is the discovery stage: before you can fix anything, you have to find what is actually broken, and real codebases hide flaws well.
Testing whether flaws matter: 54.8% on ExploitGym
Not every vulnerability is worth fixing first. Some cannot be exploited in practice, and some can. ExploitGym measures whether a model can validate risk through controlled exploitation, essentially checking if a flaw is genuinely exploitable. Carbon’s 54.8% leads this benchmark. That number looks lower than the others, but exploitation is a harder and more open-ended task than detection, and a model that can separate real risk from noise saves teams a great deal of wasted patching effort.
Writing the fix: 71.0% on CWE-bench
CWE-bench measures patching: turning a validated finding into a working code fix that addresses the root cause rather than papering over the symptom. Carbon reaches 71.0% here. Combined with the other two scores, the picture is a full defense lifecycle in one model: find it, prove it, fix it.
The overall ranking: number 1 on the Intelligence Index at 59
On the updated v5.0 of the Artificial Analysis Intelligence Index, Carbon ranks first with a score of 59. Artificial Analysis is an independent evaluator, which makes this ranking more useful than Google’s own benchmark claims alone. Independent testing also adds nuance: the same evaluator ranks Carbon second on its Coding Agent Index, behind Claude Opus 5.5, and notes that Carbon’s hallucination rate rose to 11% from Argon’s 4% in its knowledge tests. Those are real caveats, and they matter if you plan to trust the model with production code. A model can be the best at finding bugs and still need human review before its output ships.
Who can use Gemini 4 Carbon right now?
Almost nobody, yet, and that is deliberate. Google is taking a staged approach:
- Starting this week: Carbon goes to a subset of cyber defenders.
- Next phase: access expands gradually to additional trusted partners through the Fairwind Program.
- Later: developers, businesses, and consumers get access through Google’s product surfaces as soon as possible, in Google’s wording.
Google has not given a date for that wider release. It is also engaged in the US government’s voluntary process for pre-release model testing, and says it is gathering feedback and iterating on guardrails before opening Carbon up. If you are not a vetted cyber defender or a Fairwind partner, there is currently no public way to try Carbon, and no waitlist date to mark on a calendar. The practical move is to watch Google DeepMind’s announcements and prepare your workflow, not to wait on a launch day that has not been set.
This restricted rollout also explains the framing. Google is positioning Carbon as a defensive tool first: a model that helps security teams find and fix flaws before attackers do. That positioning matters because the same capabilities, finding vulnerabilities and writing exploits to validate them, could be misused. A phased release to defenders is Google’s answer to that tension, at least for now.
Gemini 4 Carbon price
Carbon will launch at the same introductory price as Argon: $2 per million input tokens and $10 per million output tokens, with cached input tokens priced at 95% off the input token price. That caching discount matters for security work, where the same large codebase may be fed to the model repeatedly across a long investigation.
Those are introductory rates, and Google has already published the step up: after the introductory period, pricing rises to $4 per million input tokens and $20 per million output tokens. If you are budgeting for API use, plan around the higher rate, not the launch rate. The introductory price is a way in, not a permanent cost.
For comparison, this pricing puts Carbon in the same band as other frontier models for heavy use, with the caching discount as its main cost advantage for long, codebase-scale sessions. There is no consumer subscription price yet, because there is no consumer product yet. Until Carbon reaches products like the Gemini app, API pricing is the only price that exists.
Gemini 4 Carbon vs Argon: what actually improved?
Two weeks is a short gap between frontier models, so it is fair to ask what changed. According to Google:
- Secure code generation: Carbon achieves more than double Argon’s success rate on internal benchmarks for generating secure code.
- Patch quality: Google’s Chrome team reports Carbon performed more than 10 times better than another lab’s large frontier model when generating high-quality patches. Google does not name the rival model, so treat that comparison as directional, not precise.
- Web penetration testing: Wiz, Google’s cloud security platform, observes Carbon leading on benchmarks for web penetration testing, a core capability for its Scan for Good initiative.
- Safety and alignment: Carbon builds on Argon’s safety stack and improves on several internal measures, covered below.
The honest summary is that Carbon is an incremental step on general capability and a larger step on security-specific capability. If you already use Argon, Carbon is not a different kind of tool. It is the same kind of tool, tuned harder for the work security teams actually do, and with a longer attention span for hard engineering problems.
Safety and alignment: what Google claims
Google makes several specific safety claims for Carbon, all from its own internal testing, so read them as claims to be verified over time rather than settled facts:
- Prompt injection resistance: Carbon achieves a 0.0% attack success rate on Gray Swan’s Indirect Prompt Injection Benchmark, resisting every evaluated attack attempt. Argon led the same benchmark at 0.7%.
- Less cheating on benchmarks: successful cheating on Terminal-Bench 4.0 fell to 0.0%, with cheating attempts dropping to 0.4%, while overall accuracy improved.
- Fewer misalignment alerts: in live coding environments with Google’s internal teams, high-severity misalignment alerts dropped by almost 80%.
- More honest output: Carbon cuts unsupported claims by approximately half compared with Argon, and puts methodological caveats directly into its deliverables instead of fabricating around missing evidence.
- Better scoping: overreach fell by 26% and under-service by 29%, meaning the model is less likely to do more than asked and less likely to do too little.
One important detail: Google notes that its security benchmark scores were evaluated without guardrails. That is standard practice for measuring raw capability, but it means the numbers describe the model, not necessarily the product you will eventually use with safety restrictions enabled. Real-world performance with guardrails on may differ, and that gap is worth keeping in mind when vendors quote benchmark scores.
What this means for security teams and developers
Carbon’s launch fits a wider shift visible across the industry this month. Security work is becoming one of the first places frontier AI is deployed, not an afterthought. Anthropic’s Cyber Mission offers free AI security scans for open source projects, and Google is now putting its strongest model in defenders’ hands first. The pattern is clear: the companies building the most capable models want security teams as their first users, partly because those teams can validate the models on real work, and partly because defensive use is the strongest case for deploying powerful capabilities responsibly.
If you run a security team, Carbon does not change your priorities today, because you probably cannot use it yet. What it does change is the planning horizon. Code review, vulnerability triage, and patching are all tasks where AI assistance is moving from helpful to central, and the teams that get value from it will be the ones with clean processes for human review. A model that finds 88% of flaws on a benchmark still misses some, and a model with an 11% hallucination rate on knowledge tests will confidently state things that are wrong. The workflow that wins is model plus human verification, not model instead of humans.
For developers choosing between AI tools, the comparison that matters is not Carbon versus Argon. It is Carbon versus the tools you already use for coding, as in our Claude vs ChatGPT comparison for small business. Carbon’s edge is security-specific: finding, validating, and patching flaws in large codebases over long sessions. If your work is general coding or writing, the differences will be smaller. If your work is securing software, Carbon is the model to watch.
Small businesses should also note the direction of travel. Tools like Meta Muse for small business show how agentic AI is reaching smaller teams, and Carbon’s eventual arrival in developer and business products will likely follow the same path: first the API and partner programs, then products that package the capability for teams without dedicated security staff. The price, when it arrives in product form, will matter more than the API token rate for most small teams.
What to watch next
Three things will tell you whether Carbon lives up to its launch claims. First, the wider release date: how long Google keeps Carbon restricted, and whether the Fairwind expansion happens in weeks or months. Second, independent reproduction: whether outside evaluators reproduce the security benchmark leads with guardrails enabled, in real codebases rather than benchmark sets. Third, real-world reports from the first defender cohort: what Carbon finds in production code, how often its patches pass review, and where it still fails. Until those reports arrive, Carbon is a promising launch with strong numbers and a limited audience, not yet a tool you can build a workflow around.
The bottom line is straightforward. Gemini 4 Carbon is Google’s strongest model, its security scores lead the field on paper, and its price is competitive for API use. But it is not available to you yet unless you are a selected cyber defender, and its most impressive numbers come with the usual caveats about self-reported benchmarks and guardrail-free testing. Watch the Fairwind rollout, budget for the post-introductory price, and keep human review at the center of any AI-assisted security workflow.
Frequently asked questions
When is the Gemini 4 Carbon release date?
Google announced Gemini 4 Carbon on October 28, 2026, and began rolling it out to a subset of cyber defenders the same week. There is no announced date for general developer, business, or consumer availability. Google says wider access will come as soon as possible after feedback and guardrail work through its Fairwind Program.
How much does Gemini 4 Carbon cost?
The introductory API price is $2 per million input tokens and $10 per million output tokens, with cached input tokens at 95% off the input price. After the introductory period, the price rises to $4 per million input tokens and $20 per million output tokens. There is no consumer subscription price yet because Carbon is not in a consumer product.
Is Gemini 4 Carbon better than Argon?
On Google’s measures, yes, particularly for security work. Carbon more than doubles Argon’s success rate for generating secure code on internal benchmarks, leads on vulnerability finding, exploitation validation, and patching benchmarks, and ranks first on the Artificial Analysis Intelligence Index at 59. Independent testing adds nuance: Carbon ranks second on the Coding Agent Index behind Claude Opus 5.5, and its hallucination rate rose to 11% from Argon’s 4% in knowledge tests.
Can I try Gemini 4 Carbon in the Gemini app?
Not yet. Carbon is not available in the Gemini app or other consumer products at launch. Initial access goes to selected cyber defenders, then to trusted partners through the Fairwind Program. Google has not announced when it will reach the Gemini app or developer products for general use.
What is the Fairwind Program?
Fairwind is Google’s program for phased access to Carbon by trusted partners, starting with cyber defenders. Google is using it to gather feedback and refine guardrails before a broader release. Membership details have not been publicly disclosed, and Google has not published an application process or timeline for general admission.
Is Gemini 4 Carbon safe to use for security work?
Google reports strong safety results, including a 0.0% attack success rate on Gray Swan’s indirect prompt injection benchmark and a large drop in misalignment alerts in internal coding use. Those are Google’s own measurements, and the security benchmarks were run without guardrails. For production security work, the safe approach is to treat Carbon as a powerful assistant that still requires human review of its findings and patches before they ship.