Gemini 4 Carbon: Google's Strongest Model Starts With Cyber Defenders

Google DeepMind announced Gemini 4 Carbon on October 28, 2026, calling it its "strongest model with state-of-the-art cybersecurity and long horizon capabilities", in the words of Koray Kavukcuoglu, SVP at Google DeepMind and Chief AI Architect. It arrives two weeks after Gemini 4 Argon, and, like Argon's first days, it starts with a small group: a subset of cyber defenders, widening through the Fairwind Program.

The rumor that a model with this name was coming was already circulating; we tracked it in what The Information reported about Carbon, a new Anthropic model and OpenAI Terra. Now there is an official page, a safety report and a price list. This post sticks to what Google's own announcement says and flags where the numbers are Google's alone.

TL;DR: what we know about Gemini 4 Carbon

Update (October 29, 2026): Artificial Analysis confirms #1, with caveats

Artificial Analysis published its own write-up of Carbon, so the 59 is now an independent result rather than only Google's figure. Its main findings:

• #1 on Intelligence Index v5 at 59, with the top score in 4 of the 9 evaluations: HLE-Diamond, Terminal-Bench-Science, AA-Omniscience and AutomationBench-AA. It does not lead on coding and knowledge work.
• Second on coding agents. With Antigravity CLI, Carbon (high) scores 59 on the Coding Agent Index, 3 points behind Claude Code with Claude Opus 5.5 (max) at 62. It ranks second on Terminal-Bench 4.0 (64%) and FrontierCode v1.1 (51%), behind Opus 5.5 (max) at 56% on the latter.
• Cost per task. At standard pricing, Carbon costs $7.76 per Intelligence Index task, about 23% less than Opus 5.5 (max, $10.04) and about 1.2x GPT-6 Astra (max, $6.25). It uses 123k output tokens per task, 29% fewer than Opus 5.5 (173k).
• Pricing wording. Artificial Analysis lists standard pricing of $4/$20 per 1M input/output tokens, with Google's 50% launch discount and no confirmed end date, which matches the $2/$10 intro rate above. Cached input gets a 95% discount.
• Hallucination trade-off. On AA-Omniscience v1.1 Carbon scores 54 (Opus 5.5: 48), with accuracy up 10 points over Argon to 58%, but its hallucination rate rises from 4% to 11%. That is still the second lowest of any model Artificial Analysis lists, behind only Argon, against 50% for both Opus 5.5 (max) and GPT-6 Astra (max).
• Knowledge work is not leading. On AA-Briefcase Carbon scores 1609 Elo, up 126 over Argon, but behind Grok 4.7, Muse Wonder and Kimi K3.1 Pro.

Artificial Analysis also notes Carbon is still being rolled out to selected users and is not publicly available. The one-point lead over Opus 5.5 (58) remains small, so read it as a close race. See our Intelligence Index v5 write-up for how the index is built.

What is Gemini 4 Carbon?

Carbon is the second model in the Gemini 4 family after Argon. Google describes improvements in coding, agentic and scientific tasks, full-stack web development and multimodal understanding. The distinctive claim is endurance: Google says internal teams have watched it run for days on complex multi-step engineering work, such as root-causing a bug and patching it across a large codebase.

That is a different pitch from a chat model that answers quickly. It is the same direction the industry has been moving, where the unit of work is a task that takes hours, not a single reply. If you build agents, the thing to watch is not a single score but whether Carbon stays on task across hundreds of steps. For background on how those long runs are structured, see our guide to loop engineering for coding agents.

Who gets Carbon first, and why

Google says that starting the week of the announcement, Carbon is available to a subset of cyber defenders. Access then grows to more trusted partners through the Fairwind Program, the same channel used for Argon. Everyone else waits "as soon as possible", after more feedback and guardrail iteration.

The logic is the dual-use problem. A model that scores 88.2% on a vulnerability-finding benchmark and 54.8% on an exploitation benchmark is useful to defenders and to attackers. Putting it first in the hands of vetted defenders is a way to get patches written before the capability is broadly available. Argon followed the same path, then reached general availability about two weeks later, as covered in the update on our Argon launch post. Nothing in the Carbon announcement promises the same timeline, so do not assume it.

The takeaway for security teams: if you are not already a Fairwind partner, the practical step today is to apply through Google's program page and to prepare the tooling that would consume a model like this, such as triage queues and patch review.

The benchmarks, and what each one measures

Google reports the following. The full comparison table in the announcement is an image, so we cannot reproduce rival model numbers from the text; check Google's page for the table.

For context on the headline index: our write-up of Artificial Analysis Intelligence Index v5 put Claude Opus 5.5 at 58, so Carbon's 59 is a one-point lead on Google's account. A single point on an aggregate index is within the range where methodology and run-to-run variance matter, so treat it as "tied at the top" until independent runs accumulate.

The two numbers worth reading closely are the vulnerability ones. State-of-the-art on both finding and exploiting is notable, but Google reports only a 71.0% on patching, which is the part defenders actually need. Finding bugs faster than you can fix them is a queue problem, not a win.

Honesty and alignment claims

Beyond capability, Google reports behavior changes against Argon: unsupported claims cut by about half, high-severity misalignment alerts in live coding down almost 80%, overreach down 26% and under-service down 29%. The safety stack is carried over from Argon: training, real-time misuse defenses, prompt-injection resilience and chain-of-thought monitoring.

The Terminal-Bench line is interesting in its own right. Google says successful cheating on Terminal-Bench 4.0 dropped to 0.0%, with attempts at 0.4%. For how Argon behaved on this axis, our Argon safety report breakdown covers activation probes and the roughly 2% cheating figure. A move to zero successful cheats is the kind of claim worth checking in the PDF: ask whether it means the model stopped trying, or the harness got better at catching it. Google's number, in either case, is not independent.

Price: same intro rate, double later

Introductory pricing matches Argon at $2 per million input tokens and $10 per million output tokens, with cached input 95% off. After the introductory period it becomes $4 and $20, which is the same list pair we recorded for Claude Opus 5.5. A job that reads 5 million tokens and writes 1 million would cost about $20 at intro rates and $40 afterwards, before caching.

The 95% cache discount is the lever for agent work. Long-running coding agents resend a large, mostly stable prefix every turn, so the cached rate is the number that decides your real bill. Our explainer on Gemini context caching and agent token costs walks through the arithmetic.

No end date for the intro price is published, and none of this is purchasable by most readers yet.

How Carbon compares with Argon, and with the field

For a head-to-head against rivals, our existing Argon vs Opus 5.5 vs Grok 4.7 vs GPT-6 Astra comparison is the baseline; Carbon-specific third-party numbers will arrive once access widens. We have not included scores for other labs' models here because the only table that lists them is an image on Google's page.

What to do this week

1. Security teams: apply to the Fairwind Program if you are a qualifying defender. Line up where AI-generated patches will be reviewed; the 71.0% CWE-bench patching figure is a reminder that every patch needs a human.
2. Developers: do nothing to production. Pin a 30 to 50 prompt eval set, include a long multi-file bug-fix task, and rerun it when a public model ID appears.
3. Agent builders: read the safety report for the prompt-injection and cheating methodology before you rely on the 0.0% claims; an agent with tool access is only as safe as the harness around it. If you run agents against real systems, AgentBeam is the agent security platform from the explainx.ai team that stops agents before they take dangerous actions.
4. Everyone else: wait for independent evaluations. Artificial Analysis and the benchmark maintainers will publish their own runs.

How to test a model like this when you get access

A fair evaluation of a long-horizon security model needs three ingredients. First, a fixed set of known vulnerabilities in code you own, so you can score finds, exploits and patches against ground truth instead of impressions. Second, a patch review step where a human or a separate test suite decides whether the fix actually removes the bug without breaking behavior. Third, a log of wall-clock time and token spend per task, because a model that runs for days can be correct and still too expensive to deploy at scale.

Run the same set on your current model so the comparison is yours, not a vendor's. Keep the harness identical between runs, since benchmark swings of several points often trace back to tool setup rather than the model.

What is still unknown

• Context window and output limit: not stated for Carbon.
• General availability date: Google says "as soon as possible", nothing firmer.
• Independent verification: every figure above except the leaderboard positions comes from Google's own announcement and report.
• The end of the intro price: unpublished.

We will add an update section to this post when access widens or independent results appear.

Related reading

• Gemini 4 Argon launch, benchmarks and pricing
• What The Information reported on Carbon, Terra and a new Anthropic model
• Gemini 4 Argon safety report: probes and cheating
• Argon vs Opus 5.5 vs Grok 4.7 vs GPT-6 Astra
• Artificial Analysis Intelligence Index v5
• Top 10 Gemini 4 Argon use cases
• Official: Google's Gemini 4 Carbon announcement and Fairwind Program

Details are accurate as of October 28, 2026 and come from Google's announcement; access, pricing and benchmarks may change.