Google launches Gemini 4 Carbon for cybersecurity and long-horizon agents, starting with cyber defenders
Google has introduced Gemini 4 Carbon, a new frontier model that the company describes as its strongest to date, with state-of-the-art results in cybersecurity and in long-horizon agentic work. The announcement was published on the Google blog on October 28, 2026 by Koray Kavukcuoglu, SVP at Google DeepMind and Chief AI Architect at Google, two weeks after Gemini 4 Argon reached general availability for enterprise developers. Carbon is positioned above Argon in the Gemini 4 family rather than as a replacement for it, and Google is deliberately not opening it to everyone at once.
The rollout starts with a subset of cyber defenders during the week of the announcement. Google then plans to extend access gradually to additional trusted partners through its Fairwind Program, and only after that to developers, businesses and consumers through its usual product surfaces, a step the company says will come "as soon as possible" without giving a date. For now, Gemini 4 Carbon does not appear in the Gemini API changelog or on the Gemini Developer API pricing page, which still list Gemini 4 Argon as the latest generally available model.
The headline claims concern security work. Google reports 88.2% on SEC-bench Pro, a vulnerability-finding benchmark, 54.8% on ExploitGym, an exploitation benchmark, and 71.0% on CWE-bench, which measures vulnerability remediation. The company also says that Carbon reached first place on the Artificial Analysis Intelligence Index v5.0 with a score of 59, and that internal teams have kept the model running for days on multi-step engineering tasks such as root-causing and patching bugs across large codebases.
This launch also confirms a model that Data Studios had previously covered only as a report, in Google reportedly tests Gemini 4 Carbon with stronger coding performance than Argon. The official announcement now supplies the name, the benchmark table, the pricing and the access plan, and the sections below are built on those official documents.
··········
WHAT GOOGLE HAS ANNOUNCED.
Google presents Gemini 4 Carbon as a model designed for sustained agentic workflows, meaning tasks where a model plans, executes, checks and corrects its own work over many steps and long periods of time rather than answering a single prompt. The clearest example in the announcement is the claim that internal teams have run Carbon for days on engineering tasks that involve tracing a bug to its root cause and producing a patch in a large codebase. Google does not publish logs or success rates for these internal runs, so they should be read as a description of intended use rather than as a measured result.
The model sits in a family that already includes Gemini 4 Argon, which Google announced on September 30, 2026 and opened to enterprise developers on October 13, 2026 under the model ID gemini-4-argon. According to the Argon model card, that model is a large-scale sparse mixture-of-experts transformer with a combined input and output window of up to 1M tokens, text, image, audio and video inputs, and text output. Google has not published an equivalent model card for Carbon, and neither the announcement nor the evaluation document states Carbon's context window, modalities, architecture or knowledge cutoff.
The announcement also includes several behavioral claims based on Google's internal testing. Compared with Argon, Google says Carbon cuts unsupported claims by about half, reduces overreach by 26% and under-service by 29%, and lowers high-severity misalignment alerts in live coding environments by almost 80%. On Terminal-Bench 4.0, Google reports that successful cheating fell to 0.0% and attempted cheating to 0.4%, while accuracy improved. These are vendor-reported figures without independent replication at the time of writing.
··········
CYBERSECURITY RESULTS AND WHAT THE BENCHMARKS MEASURE.
Cybersecurity is the area where Google makes its strongest claims, and it is also the reason for the restricted rollout. The three security benchmarks in the official table cover different stages of the same workflow: finding a vulnerability, exploiting it, and fixing it. Google's evaluation document explains how each one was run, which matters because the settings differ from benchmark to benchmark.
SEC-bench Pro was self-computed by Google on the 183-task May 2026 JavaScript engine split, with pass@1 averaged over three attempts per task and the Antigravity harness. ExploitGym was also self-computed, with a single attempt per task, the Antigravity harness and no internet access; a run counts as a success only when the exploit captures the target flag and an LLM judge confirms that the intended vulnerability was used. CWE-bench v1 scores come from the official public leaderboard, evaluated across models by Collinear AI, with models ranked by programmatic pass@1 and ties broken by pass@4.
........
Security benchmark | Gemini 4 Carbon | Gemini 4 Argon | GPT-6 Astra | Claude Opus 5.5 | Claude Fable 5.1 |
SEC-bench Pro (find) | 88.2% | 83.4% | 85.4% | not listed | not listed |
ExploitGym (exploit) | 54.8% | 42.0% | 42.4% | 34.5% | not listed |
CWE-bench (patch) | 71.0% | 68.0% | 68.0% | 67.0% | 58.0% |
........
The largest gap is on ExploitGym, where Carbon's 54.8% is 12.8 percentage points above Argon and 12.4 points above GPT-6 Astra as listed by Google. On CWE-bench the margin is narrower, at three points over both Argon and GPT-6 Astra. Google adds that the Chrome team found Carbon "more than 10X better" than another lab's large frontier model at generating high-quality patches, that Wiz reports Carbon leading on web penetration testing benchmarks, and that internal secure-code generation improved by more than 2x in success rate over Argon. Google does not name the other lab's model in the Chrome comparison.
Prompt-injection resistance is the other security figure in the announcement. On Gray Swan's Indirect Prompt Injection benchmark, Google says Argon had a 0.7% attack success rate and Carbon has 0.0%. For agents that read web pages, emails or documents written by third parties, this is the metric most directly connected to the risk of an attacker hijacking the model through injected instructions.
··········
FULL BENCHMARK TABLE AGAINST GPT-6 ASTRA AND CLAUDE OPUS 5.5.
Beyond security, the official Gemini page lists results for general capability, agentic coding, computer use, knowledge work, multimodal understanding, long context and science. Carbon scores higher than Argon on every row, but it is not first everywhere against competitors: GPT-6 Astra leads on FrontierSWE 2 and Claude Opus 5.5 leads on the OSWorld-2.1 offline subset.
........
Benchmark | Gemini 4 Carbon | Gemini 4 Argon | GPT-6 Astra | Claude Opus 5.5 |
AA Intelligence Index v5.0 | 59 | 50 | 57 | 58 |
Vals Index v2.2 | 70.4% | 69.2% | 65.0% | 70.2% |
SWE-sweep | 9.6% | 4.3% | 9.5% | 3.6% |
FrontierSWE 2 | 61.2% | 55.0% | 65.5% | 62.3% |
Terminal-Bench 4.0 (AA) | 65.2% | 57.1% | 59.1% | 59.6% |
Agents' Last Exam v1.1 | 77.4% | 69.0% | 73.1% | 71.6% |
OSWorld-2.1 (offline subset) | 81.5% | 74.7% | 80.9% | 87.2% |
AutomationBench (Zapier) | 53.9% | 51.3% | 41.4% | 42.5% |
Vending-Bench 2 (bank balance) | $16,484 | $13,718 | $15,515 | $9,235 |
GraphWalks 256K-1M (BFS F1) | 96.2% | 84.2% | 71.8% | 66.8% |
RiemannBench | 80.0% | 76.0% | 72.0% | 69.6% |
Terminal-Bench-Science 0.1 (AA) | 64.8% | 52.9% | 63.3% | 59.0% |
........
Several of these comparisons are not like-for-like, and Google's evaluation document says so. Carbon and Argon were run by Google through the Gemini API with the highest thinking settings, while most non-Gemini results are the providers' self-reported numbers or come from public leaderboards, system cards and technical reports, using the maximum available thinking settings or the best available reasoning results. Nothing in the document indicates that Google ran the competing models itself. The OSWorld-2.1 figure for Carbon is "maxed over 3 runs with a single attempt per run," on an 82-task offline subset with a 500-step limit, 1080p resolution and screenshot-only observation, which is a different protocol from a single averaged score.
The long-context result is the most striking outside security. GraphWalks was self-computed by Google for all models on 200 problems with context lengths between 256K and 1M tokens, and Carbon's 96.2% BFS F1 is 12 points above Argon and more than 24 points above GPT-6 Astra. Because Google has not stated Carbon's context window, the benchmark shows that the model handles inputs of up to 1M tokens in this test, but it is not a formal specification of the limit developers will get. The general index scores are close at the top: Carbon's 59 on the Artificial Analysis Intelligence Index v5.0 is one point above Claude Opus 5.5 and two above GPT-6 Astra.
··········
WHO CAN USE GEMINI 4 CARBON AND WHEN.
For most readers, the practical answer today is that Gemini 4 Carbon is not yet available to them. Google describes a three-stage rollout: a subset of cyber defenders first, starting the week of October 28; then additional trusted partners through the Fairwind Program; and finally developers, businesses and consumers through Google's product surfaces. The company has not said which products will carry Carbon first, whether the Gemini app, Google AI Pro or Ultra subscriptions, Google AI Studio, the Gemini API or Gemini Enterprise, and it has not given a model ID or a general-availability date.
The Fairwind Program, which Google announced on September 2, 2026, is a limited-access program for governments and trusted partners. Google says it has more than 650 partners globally and prioritizes governments and national cyber authorities, critical infrastructure operators in healthcare, telecommunications, energy and finance, and core technology platforms. Applicants are vetted and subject to background checks, access must be restricted to internal cybersecurity, incident response or penetration testing teams, and partners must use user-level authentication and phishing-resistant multi-factor authentication. Partners may not share, redistribute or sell access. Permitted dual-use work includes authorized threat simulation, reverse engineering and malware analysis for defensive or academic research, while malicious tasks such as creating malware are not allowed. At the time of writing, the Fairwind page still names Gemini 4 Argon, used alone or with the CodeMender code-security agent, as the program's model, so the exact terms that will apply to Carbon have not been published.
Organizations that want early access can fill in the interest form on the Fairwind page. Developers who need a production model now can use Gemini 4 Argon, which is generally available through the Gemini API, Google AI Studio and Google Antigravity, and is available in the Gemini app for Google AI Pro and Ultra subscribers. The launch details and pricing of that model are covered in Google launches Gemini 4 Argon globally with introductory API pricing. Teams planning to move workloads to Gemini later this year should also check the data-handling defaults described in Google turns on Gemini API request storage by default for new paid projects.
··········
GEMINI 4 CARBON PRICING AND WHAT AN AGENT SESSION WOULD COST.
Google has announced Carbon's price list before opening the model to developers. The introductory price is the same as Argon's: $2 per 1M input tokens and $10 per 1M output tokens, with cached input tokens discounted by 95%. After the introductory period, Carbon will cost $4 per 1M input tokens and $20 per 1M output tokens. The announcement does not say how long Carbon's introductory period will last. For Argon, the official Gemini Developer API pricing page sets the end of introductory pricing at November 30, 2026, with the higher rates applying from December 1, 2026.
........
Model (USD per 1M tokens) | Input | Output | Cached input | Batch input / output | Status |
Gemini 4 Carbon, introductory | $2.00 | $10.00 | 95% off input | not announced | Announced, not yet in API |
Gemini 4 Carbon, standard | $4.00 | $20.00 | 95% off input | not announced | After introductory period |
Gemini 4 Argon, through Nov 30 | $2.00 | $10.00 | $0.10 | $1.00 / $5.00 | Generally available |
Gemini 4 Argon, from Dec 1 | $4.00 | $20.00 | $0.20 | $2.00 / $10.00 | Generally available |
........
Carbon prices are taken from Google's announcement and Argon prices from the official Gemini Developer API pricing page, both as listed on October 29, 2026. Applying the announced 95% discount gives an implied cached-input price of $0.10 per 1M tokens at introductory rates and $0.20 at standard rates for Carbon, but Google has not yet published a Carbon row on its pricing page, so batch, flex and priority prices for the new model remain unknown.
To give a sense of scale, consider a long coding-agent session that reads 2M input tokens and writes 200,000 output tokens. Without caching, it would cost $4.00 for input plus $2.00 for output, or $6.00, at introductory prices, and $12.00 at standard prices. If 80% of the input is served from cache, the same session would cost about $0.80 for uncached input, $0.16 for cached input and $2.00 for output, or $2.96 at introductory prices, rising to about $5.92 at standard prices. These figures are illustrative and assume that Carbon's cache discount applies in the same way as Argon's implicit caching, which Google has not yet documented for Carbon. Because Carbon is announced at Argon's exact rates, the decision between the two models, once Carbon is available, will rest on output quality and task length rather than on token price.
··········
SAFETY APPROACH AND RESTRICTED ACCESS.
Google says Carbon uses the same multi-layered safety stack as Argon, combining model training, real-time misuse defenses, prompt-injection resilience and chain-of-thought monitoring, and that the model participates in the U.S. government's voluntary pre-release model testing process. The announcement links to the Gemini 4 safety report, which was published for Argon; Google has not released a separate safety report or model card for Carbon.
The staged rollout follows directly from the model's strengths. A system that scores 54.8% on an exploitation benchmark and finds vulnerabilities with high accuracy is useful to defenders and potentially useful to attackers, and Google's answer is to put it first in the hands of vetted organizations under contractual limits, then broaden access. This is the same pattern Google used for Argon, which also rolled out first to trusted cyber defenders through Fairwind before reaching paid API customers and Google AI Ultra subscribers. Neither the announcement nor the Fairwind page describes how cybersecurity requests will be handled once Carbon becomes available to the general public.
··········
WHAT IS ESTABLISHED AND WHAT REMAINS OPEN.
The established facts are the official announcement of October 28, 2026, the published benchmark table, the methodology notes, the introductory and standard prices, and the three-stage access plan that begins with a subset of cyber defenders. The benchmark results show Carbon ahead of Argon on every listed test and ahead of GPT-6 Astra and Claude Opus 5.5 on most of them, with clear exceptions on FrontierSWE 2 and OSWorld-2.1, and with the caveat that the competitor numbers are largely self-reported by other providers under different settings.
What remains open is substantial. Google has not published a model card for Carbon, so its context window, modalities, architecture and knowledge cutoff are undocumented. There is no API model ID, no general-availability date, no length for the introductory pricing period and no batch or priority prices. The behavioral improvements in misalignment, overreach and cheating come from internal testing, and the claims attributed to the Chrome team and Wiz have not been accompanied by public data. Until Carbon appears on the Gemini API pricing page and in the changelog, developers can plan around the announced prices but cannot yet build on the model.
··········
FOLLOW US FOR MORE.
·····
DATA STUDIOS
·····
datastudios.org
