Gemini 4 Carbon: Google's strongest model, for cyber defenders first

Google announced Gemini 4 Carbon on October 28, 2026, two weeks after Gemini 4 Argon went on general release. Google calls Carbon its strongest model, with "state-of-the-art cybersecurity and long horizon capabilities." Most businesses cannot use it yet. Access starts with a subset of cyber defenders and expands to trusted partners through Google's Fairwind Program. Google says developers, businesses and consumers will get it "as soon as possible," without a date.

This is a summary of the announcement and what it means for a business planning AI work. We have not tested Carbon. Every result below is reported by Google, its teams or its partners.

What Google reports

Carbon ranks first on version 5.0 of the Artificial Analysis Intelligence Index, with a score of 59. The announcement leans hardest on security work, and reports three external benchmarks, each covering one stage of handling a vulnerability:

Google notes that these were "evaluated without guardrails," meaning without the misuse filters a deployed model would have. On internal benchmarks, Google reports more than twice Argon's success rate at generating secure code. The Chrome team reported that Carbon did more than 10 times better than "another lab's large frontier model" at generating high-quality patches. The announcement does not name that model.

Outside security, Carbon gains 89 Elo points and reaches fourth place on WebDev Arena at 1768. Google says internal teams have seen it "run for days" on multi-step engineering tasks such as root-causing and patching subtle bugs across large codebases.

The behaviour claims matter more for everyday use

For a business that hands an agent real tasks, the alignment section is the most practical part of the announcement. Google reports, against Argon or its own internal tests:

• Less cheating on tests: successful cheating on Terminal-Bench 4.0 fell to 0.0%, with attempted cheating at 0.4%. High-severity misalignment alerts in live internal coding fell by almost 80%.
• Fewer unsupported claims: roughly half as many as Argon. Google says Carbon states caveats in the deliverable, or lists what is still required, instead of fabricating around missing evidence.
• Staying in scope: overreach down 26% and under-service down 29% on multi-step plans.
• Prompt injection: a 0.0% attack success rate on Gray Swan's Indirect Prompt Injection benchmark, down from Argon's 0.7%.

These are the failures that make agents expensive to supervise: invented facts, quiet shortcuts and actions nobody asked for. The improvements are worth testing when access opens. They are not a reason to remove review. A 0.0% score means Carbon resisted every attack in one benchmark's set, not that injected instructions in your email or documents can no longer work. Tools that enforce limits outside the model, such as NVIDIA OpenShell, still matter for any agent that can send, buy or delete.

Pricing will double after the introductory period

Carbon launches at Argon's introductory price: $2 per million input tokens and $10 per million output tokens, with cached input 95% cheaper. A footnote says $4 and $20 apply after the introductory period ends. Google has not said when that is for Carbon. For Argon, the same rates applied until November 30, 2026.

Long-running agent work consumes a lot of output. A task that runs for hours produces far more tokens than a chat answer, so the post-introductory rate is the one to budget against. Our Argon cost guide shows how to price an accepted result rather than a single request, and the same method applies to Carbon.

Access depends on Google's schedule

Google is taking what it calls "a deliberate approach to rollout" and says it is taking part in the U.S. government's voluntary process for pre-release model testing. That is a reasonable choice for a model whose strongest skills are finding and exploiting vulnerabilities. It also means your access is set by a provider's rollout plan, as we noted when Argon first went to security partners.

When we checked on October 28, the Fairwind page still described Argon as the program's model and did not mention Carbon. Fairwind gives early access to high-priority defenders such as governments, healthcare providers and telecommunications services. Participants agree to terms including phishing-resistant MFA, access limited to internal security teams, and tracking of employee use. Most small and mid-sized businesses are unlikely to qualify.

What to do now

The two-week gap between Argon and Carbon is a useful signal. A model you evaluate this month may be superseded next month, and a finished evaluation goes stale quickly. We would do four things:

1. Keep your evaluation reusable. Save the tasks, source files and acceptance checks you used for Argon or other models, so you can rerun them on Carbon in a day rather than redesign them.
2. Budget at $4 and $20. If a workflow only pays off at the introductory rate, it does not pay off.
3. Keep controls outside the model. Approval steps, limited credentials and network policy should not depend on any vendor's alignment results.
4. Do not wait for gated access. Security patching, code review and document work can be tested now on generally available models, including open models you run yourself. Move to Carbon if it proves better on your own tasks.

We will update this article when Google publishes general availability, a model card or an end date for introductory pricing.