Navigate this guide · 1,927 words
The essential signal
- Google announced Gemini 4 Carbon on 28 October 2026. It ranks first on the Artificial Analysis Intelligence Index at 59 and leads SEC-bench Pro at 88.2 percent, ExploitGym at 54.8 percent and CWE-bench at 71.0 percent.
- Access is gated. A subset of vetted cyber defenders gets Carbon first through the Fairwind Program. Developers, businesses and consumers have no date yet and the model has no public API identifier.
- The headline scores are mostly Google's own. The independent figure is the index ranking at 59, one point ahead of Claude Opus 5.5. The cyber figures were measured without guardrails and cannot yet be reproduced by outsiders.
What Google announced on 28 October
Google DeepMind announced Gemini 4 Carbon on 28 October 2026. Senior vice president Koray Kavukcuoglu called it the strongest model Google has built with state-of-the-art cybersecurity and long-horizon capabilities. It is the second model in the Gemini 4 family and it arrived two weeks after Gemini 4 Argon. [1][2][9][1][2][5][8][9][12]
The announcement frames Carbon as a model for sustained engineering work rather than quick answers. Google says its internal teams have watched Carbon run for days on multi-step tasks like tracing a subtle bug across a large codebase and patching low-level systems. That endurance claim is the thread that connects the coding gains and the security gains. [1][5][9][1][2][5][8][9][12]
Two facts sit beside the capability claims. Google has not disclosed a parameter count or training compute figure or a new architecture for Carbon. The model also has no public API identifier yet, so the announcement describes a model that exists inside Google and inside a small defender cohort rather than a product anyone can call today. [5][8][12][1][2][5][8][9][12]
The three cyber benchmarks explained
Carbon's security case rests on three external benchmarks that map to the defence lifecycle. SEC-bench Pro measures finding real vulnerabilities in real software. ExploitGym measures turning a disclosed flaw into a working exploit to validate risk. CWE-bench measures turning a validated finding into a working code fix at the root cause. [1][2][6][1][2][4][6][8][10]
Google reports Carbon at 88.2 percent on SEC-bench Pro and 54.8 percent on ExploitGym and 71.0 percent on CWE-bench. The SEC-bench Pro evaluation covered 183 tasks with an average of three attempts per task. The CWE-bench evaluation covered 120 tasks with four runs per task and required a proposed fix to stop the exploit while keeping existing tests passing. [1][4][8][1][2][4][6][8][10]
One detail changes how the scores should be read. Google says the external cybersecurity evaluations were run without guardrails. A score measured without guardrails is not a measure of deployed partner performance, where guardrails and review steps stand between a model and a live system. [2][8][10][1][2][4][6][8][10]
The number one ranking, examined
Artificial Analysis placed Carbon first on its Intelligence Index version 5 at 59. Claude Opus 5.5 followed at 58 and GPT-6 Astra at 57 and Argon at 50. A one-point lead on an aggregate index is a close race rather than a runaway win. Run-to-run variance and methodology choices can move a single point. [3][5][11][3][4][5][11][12]
The same independent assessment narrows the headline. Carbon led four of the nine evaluations inside the index and did not lead on coding or knowledge work. On the separate Coding Agent Index Carbon ranked second at 59 with Antigravity CLI, three points behind Claude Code paired with Opus 5.5 at 62. First overall is not first at everything. [4][11][3][4][5][11][12]
Cost per task adds a second dimension to the ranking. At standard pricing Artificial Analysis puts Carbon at 7.76 dollars per Intelligence Index task against 10.04 dollars for Opus 5.5 at maximum reasoning and 6.25 dollars for GPT-6 Astra at maximum reasoning. Carbon used 123,000 output tokens per task against 173,000 for Opus 5.5. Cheaper per task is a real advantage for teams that run agents at scale. [11][12][3][4][5][11][12]
Long-horizon work: the agent that runs for days
The long-horizon claim is the part of Carbon that matters most for engineering teams. Google describes a model built for sustained agentic workflows where an agent works through dead ends and keeps the thread across hundreds of steps. Internal teams have seen Carbon run for days on tasks like root-causing and patching subtle bugs across large codebases. [1][5][9][1][5][6][7][9][10][12]
Web development gives the claim a public anchor. Carbon gained 89 Elo points to reach fourth place on WebDev Arena, a public ranking of models that build websites from prompts. Fourth place after a large gain still leaves three models ahead, so the result supports a step forward rather than dominance in web building. [1][6][7][1][5][6][7][9][10][12]
The limits of the claim deserve equal weight. Google has published no public demonstration of a multi-day run that outsiders can inspect step by step. Until Carbon reaches developers, the endurance story rests on Google's internal reports and on the benchmark scores that reward long tasks. [5][10][12][1][5][6][7][9][10][12]
The honesty and safety claims
Google reports a set of behaviour improvements against Argon. Unsupported claims fell by about half in internal testing. High-severity misalignment alerts in live coding with Google's own teams dropped by almost 80 percent. Overreach fell 26 percent and under-service fell 29 percent, which Google reads as more reliable execution of multi-step plans inside project constraints. [1][9][12][1][2][6][9][11][12]
Two safety figures stand out. Carbon resisted every evaluated attack on Gray Swan's indirect prompt injection benchmark for a 0.0 percent attack success rate against 0.7 percent for Argon. Successful cheating on Terminal-Bench 4.0 fell to 0.0 percent with attempts at 0.4 percent. Both figures come from Google's own testing and have not yet been reproduced by outsiders. [1][2][6][1][2][6][9][11][12]
One independent finding points the other way. Artificial Analysis measured Carbon's hallucination rate on its knowledge test at 11 percent against 4 percent for Argon, even as accuracy rose 10 points to 58 percent. A model can answer more questions correctly and still invent more answers on the ones it misses. That tension is exactly what outside testing needs to resolve. [11][12][1][2][6][9][11][12]
Who gets Carbon first: the Fairwind terms
Access starts with a subset of cyber defenders in the week of the announcement and widens gradually to additional trusted partners through the Fairwind Program. The programme counts more than 650 partners worldwide. Priority goes to governments and national cyber authorities and critical infrastructure operators and core technology platforms. Academic labs focused on defensive benchmarking can also apply. [1][3][8][1][3][5][6][7][8]
Membership carries conditions. Google runs background checks on applicants. Partners must use phishing-resistant multi-factor authentication and may give access only to internal cybersecurity, incident response or penetration testing teams. Partners may not share or resell access. Applying does not guarantee Carbon access, since the published programme terms still name Argon as the model. [6][7][8][1][3][5][6][7][8]
The gap between the announcement and the paperwork is visible in public pages. The Fairwind page as read on 29 October still described Argon and did not mention Carbon. The public API catalogue listed Argon and no Carbon identifier. A team planning around Carbon should confirm Carbon access and permitted uses and data handling terms in writing before scheduling work around it. [5][7][8][1][3][5][6][7][8]
The price list with no end date
Carbon will launch at Argon's introductory price of 2 dollars per million input tokens and 10 dollars per million output tokens. Cached input tokens cost 95 percent less than the standard input rate. After the introductory period the price rises to 4 dollars per million input tokens and 20 dollars per million output tokens. [1][3][4][1][3][4][5][7][8][11]
Google has not said when the introductory period ends. Argon's identical offer runs to 30 November. That deadline should not be assumed to apply to Carbon. A team budgeting beyond November should plan at the standard rate rather than treating the discount as permanent. [7][8][11][1][3][4][5][7][8][11]
The price is a stated future price rather than a live one for most readers. The public API documentation lists Argon and not Carbon as an available model and pricing target. Until Carbon appears in the catalogue, the price tells teams what to budget and not what they can buy today. [5][8][1][3][4][5][7][8][11]
The Argon template: what two weeks suggests
Argon is the best available guide to Carbon's rollout because Google staged Argon the same way. Argon went to Fairwind security teams on 30 September and reached AI Pro and Ultra subscribers in the Gemini app 13 days later. Developers worldwide followed on 23 October. [7][10][12][7][8][10][11][12]
If Carbon takes the same steps, paying subscribers could have it around 10 November. That date is an estimate from coverage of Argon's timeline rather than a promise from Google. Carbon's stronger attack skills may justify a longer wait. Free app users should expect to wait longer still after paying subscribers. [7][11][7][8][10][11][12]
The sign to watch is concrete. Carbon appearing in the Gemini app model picker for AI Pro subscribers or on Google's pricing page with an end date for its offer would mean the Fairwind stage is over. Until one of those appears, the gated stage continues. [7][8][7][8][10][11][12]
The missing paperwork
The announcement links a safety and security report. The report covers Argon rather than Carbon. The model-card index likewise lists Argon as the relevant Gemini 4 card. A Carbon-specific safety assessment has not been published. [5][12][5][12]
Without a Carbon-specific assessment, outsiders cannot check how Google measured residual risk for Carbon itself. The announcement describes additional safeguards and stronger alignment. The document that would let independent readers test those claims belongs to the earlier model. [5][12][5][12]
Google also discloses no parameter count and no training compute figure and no architecture change for Carbon. A frontier release with no size and no architecture disclosure asks readers to judge the model on scores alone. That is a thinner basis than the documentation that usually accompanies a model of this size. [5][12][5][12]
The open-versus-gated week
Carbon arrived in the same week as an opposite answer to the same dual-use problem. Mistral published the weights of Large 4 on 29 October for anyone to download and self-host. Carbon went the other way, with access restricted to vetted defenders. One week produced a downloadable frontier cyber model and a gated one. [13][10][1][2][10][13]
The logic of gating is the dual-use problem in plain form. A model that scores 88.2 percent on finding vulnerabilities and 54.8 percent on turning flaws into working exploits helps defenders write patches faster. The same capability helps attackers find targets faster. Giving defenders a head start is Google's stated reason for the staged release. [1][2][10][1][2][10][13]
The dual-use tension is not theoretical. A model that finds flaws and writes exploits serves both sides of the security contest, which is why the order of access matters as much as the scores. Google's answer is sequence: defenders first, everyone else after guardrail iteration. Whether that sequence holds under commercial pressure is the question the coming weeks will answer. [1][10][1][2][10][13]
What to watch before general availability
Four signals will show whether Carbon is moving toward wider release. The first is Carbon appearing in the public API catalogue with a model identifier and a pricing entry. The second is the Gemini app model picker showing Carbon for paying subscribers. The third is a Carbon-specific safety report replacing the Argon document. The fourth is independent benchmark runs from researchers outside Google. [5][7][8][1][2][3][4][5][7][8][10]
Guardrail iteration is the work Google says must happen first. Google is gathering feedback from the defender cohort and refining guardrails before opening Carbon to developers, businesses and consumers. The company is also taking part in the United States government voluntary pre-release testing process. How long that loop takes is unannounced. [1][3][4][1][2][3][4][5][7][8][10]
Independent runs will test the numbers that matter most. The cyber figures were measured without guardrails and cannot be reproduced by outsiders while access stays gated. When researchers can run Carbon themselves, the 88.2 and 54.8 and 71.0 figures will face the check that matters: the same test with the same harness in independent hands. [2][5][10][1][2][3][4][5][7][8][10]
What we still do not know
The general availability date is unknown. Google says developers, businesses and consumers will get Carbon as soon as possible after feedback and guardrail iteration. No date and no staged timetable beyond the Fairwind phase has been published. [1][3][7][1][2][3][5][6][7][8]
The model itself is partly undisclosed. No parameter count and no training compute figure and no architecture description has been published. Coverage has raised the question whether Carbon is a post-training advance on Argon rather than a new architecture. The announcement does not settle it. [2][5][1][2][3][5][6][7][8]
The enforcement picture is incomplete. The Fairwind terms as published still name Argon. The public catalogue carries no Carbon entry. How Google will decide which defenders qualify and how quickly the cohort widens is not documented in the announcement. Those decisions will shape who benefits first from the strongest cyber model Google has built. [6][7][8][1][2][3][5][6][7][8]
Questions, answered.
When can I use Gemini 4 Carbon?
Only a subset of vetted cyber defenders can use it now through the Fairwind Program. Google has set no date for developers, businesses and consumers. The best guide is Argon's rollout, which took about two weeks from Fairwind teams to wider access. Google has promised nothing of the kind for Carbon. [1][3][7][1][3][7]
Is Carbon really the best model available?
It ranks first on the Artificial Analysis Intelligence Index at 59, one point ahead of Claude Opus 5.5 at 58. It does not lead on coding or knowledge work inside that index. It ranks second on the Coding Agent Index at 59 against 62 for Claude Code with Opus 5.5. First overall is not first at everything. [3][5][11][3][5][11]
What do the cyber scores actually prove?
They prove Carbon performs strongly on lab tests for finding flaws at 88.2 percent on SEC-bench Pro and validating exploits at 54.8 percent on ExploitGym and patching at 71.0 percent on CWE-bench. The tests were run without guardrails, so they do not prove deployed performance inside a guarded product. Outsiders cannot reproduce them yet while access stays gated. [1][2][8][1][2][8]
What will Carbon cost?
The introductory price is 2 dollars per million input tokens and 10 dollars per million output tokens, with cached input at 95 percent off. After the introductory period the price rises to 4 dollars and 20 dollars. Google has not said when the introductory period ends, so budget at the standard rate for work that runs past the launch window. [1][3][4][1][3][4]
Why is Google restricting access?
Carbon's capability is dual-use. A model that finds vulnerabilities and turns them into working exploits helps defenders patch faster and helps attackers target faster. Google is giving vetted defenders a head start while it refines guardrails and takes part in voluntary United States government pre-release testing. [1][2][10][1][2][10]
How is Carbon different from Argon?
Carbon builds on Argon with stronger cybersecurity scores and longer-horizon engineering work and behaviour improvements like halved unsupported claims and zero successful prompt injection attacks in Google's tests. Google has not disclosed whether the advance comes from a new architecture or further training. The safety report linked from the announcement still covers Argon. [1][5][9][1][5][9]
Read the sources.
- Introducing Gemini 4 CarbonGoogle DeepMind · Accessed 2026-11-06
- Gemini 4 Carbon: Google's cybersecurity-focused AI modelSkimwire · Accessed 2026-11-06
- Google gives Gemini 4 Carbon to cyber defenders firstBetaNews · Accessed 2026-11-06
- Google Limits Gemini 4 Carbon Rollout to Cyber DefendersTokenPost · Accessed 2026-11-06
- Google's Gemini 4 Carbon leads updated benchmarks, but access remains limitedMLQ · Accessed 2026-11-06
- Google Gives Cyber Defenders First Access to Gemini 4 CarbonWebProNews · Accessed 2026-11-06
- Gemini 4 Carbon: Google's new frontier model explainedYuphora · Accessed 2026-11-06
- Google announces Gemini 4 Carbon, with cyber defenders first in lineRohitAI · Accessed 2026-11-06
- Google's Gemini 4 Carbon pushes cyber defense firstStartupHub · Accessed 2026-11-06
- Everything That Happened in AI Today Thursday, October 29The Neuron · Accessed 2026-11-06
- Gemini 4 Carbon: Index 59, $2/$10 Price, Who Gets ItExplainX · Accessed 2026-11-06
- Model Drop: Gemini 4 CarbonHandyAI · Accessed 2026-11-06
- Mistral Large 4 (Le Chonk) is now open weightMistral · Accessed 2026-11-06
Contributor articles and source links do not guarantee error-free reporting. See our editorial policy.
