At a glance
Access: Limited rollout to selected cyber defenders, followed by additional trusted partners through the Fairwind Program.
Developer availability: A general availability date has not been announced.
Introductory pricing: $2 per million input tokens and $10 per million output tokens. Cached input tokens are 95% less than the input price. After the introductory period, the stated prices are $4 and $20 respectively.
Official announcement: Google’s Gemini 4 Carbon release.
What shipped
Gemini 4 Carbon is Google's newest frontier model, pitched at sustained, long-horizon agent work with a heavy cybersecurity focus. Access is narrow for now: Google is starting with a subset of cyber defenders, and developers, businesses and consumers come later. Every figure below comes from the company's announcement, so treat the benchmark numbers as vendor-reported until independent testing catches up.
Google calls Gemini 4 Carbon its strongest model, with state-of-the-art cybersecurity and long-horizon capabilities. The announcement comes from Koray Kavukcuoglu, SVP of Google DeepMind and Chief AI Architect. Carbon builds on Gemini 4 Argon, which Google says launched two weeks earlier, and the company presents that short gap as evidence of how fast it is pushing the frontier.
The rollout is staged on purpose. Google says it is taking a deliberate approach and is engaged in the U.S. government's voluntary process for pre-release model testing. A subset of cyber defenders gets access this week, and additional trusted partners follow gradually through the Fairwind Program. Google is still gathering feedback and iterating on guardrails before opening Carbon to developers, businesses and consumers through its product surfaces, which it wants to do as soon as possible. No date is given.
Key capabilities
Long-horizon engineering. Google says Carbon is built for sustained agentic workflows. Its internal teams have seen it run for days, persisting through dead ends on multi-step tasks such as root-causing and patching subtle bugs across large codebases and low-level systems.
Cybersecurity defense. On external benchmarks evaluated without guardrails, Google reports 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on ExploitGym for exploitation, and 71.0% on Collinear's CWE-bench for patching. Google calls the first two state-of-the-art results.
Secure code and patches. On Google's internal benchmarks, Carbon has more than 2x the success rate of Argon at generating secure code. Google also relays a report from its Chrome team that Carbon performed more than 10X better than another lab's large frontier model at generating high quality patches. That is the Chrome team's own comparison, and the other model is not named.
Alignment in coding work. Carbon cut successful cheating on Terminal-Bench 4.0 to 0.0%, with cheating attempts down to 0.4%, while overall accuracy improved. In live coding environments with Google's internal teams, high-severity misalignment alerts dropped by almost 80%.
Honesty and scope. In internal testing, Google says Carbon cuts unsupported claims by approximately 2x over Argon. It also reports overreach down 26% and under-service down 29%, which it ties to more reliable end-to-end execution of multi-step plans within project constraints.
Prompt injection. On Gray Swan's Indirect Prompt Injection benchmark, Argon had a 0.7% attack success rate and Carbon reaches 0.0%. Every evaluated attack was resisted. That is a benchmark result, not a guarantee for your own tool-using deployments.
Pricing. Carbon will launch at Argon's introductory price of $2 per million input tokens and $10 per million output tokens, with cached input tokens at 95% off the input price. After the introductory period, $4 and $20 per million tokens apply. The announcement text gives no end date for that period.
Benchmarks and comparisons
Google’s release includes the following comparison with Gemini 4 Argon, GPT-6 Astra, Claude Opus 5.5 and Claude Fable 5.1. These are the figures presented by Google on Oct 28 2026; Archon has not independently reproduced the evaluations. A dash means the source does not report a result.
Scroll horizontally to see all five models.
Benchmark | Gemini 4 Carbon | Gemini 4 Argon | GPT-6 Astra | Claude Opus 5.5 | Claude Fable 5.1 |
|---|---|---|---|---|---|
AA Index v5.0 | 59 | 50 | 57 | 58 | 49 |
Vals Index v2.2 | 70.4% | 69.2% | 65.0% | 70.2% | — |
SWE-sweep | 9.6% | 4.3% | 9.5% | 3.6% | 2.9% |
FrontierSWE 2 | 61.2% | 55.0% | 65.5% | 62.3% | 56.3% |
Terminal-Bench 4.0 (AA) | 65.2% | 57.1% | 59.1% | 59.6% | 52.0% |
Agents’ Last Exam v1.1 — score | 77.4% | 69.0% | 73.1% | 71.6% | — |
OSWorld-2.1 — offline subset | 81.5% | 74.7% | 80.9% | 87.2% | 76.8% |
AutomationBench — Zapier | 53.9% | 51.3% | 41.4% | 42.5% | 31.4% |
Vending-Bench 2 — bank balance ($) | $16,484 | $13,718 | $15,515 | $9,235 | $5,422 |
Chartography | 72.5% | 71.6% | 71.0% | 66.3% | 46.2% |
Blueprint-Bench 2 — similarity score | 58.6% | 54.4% | 49.7% | 51.2% | 41.9% |
GraphWalks — 256k to 1M, BFS (F1) | 96.2% | 84.2% | 71.8% | 66.8% | 65.0% |
RiemannBench | 80.0% | 76.0% | 72.0% | 69.6% | 65.6% |
Terminal-Bench-Science 0.1 (AA) | 64.8% | 52.9% | 63.3% | 59.0% | 43.3% |
CWE-bench | 71.0% | 68.0% | 68.0% | 67.0% | 58.0% |
ExploitGym | 54.8% | 42.0% | 42.4% | 34.5% | — |
SEC-bench Pro | 88.2% | 83.4% | 85.4% | — | — |
Carbon improves on Argon across the reported measures, but it does not lead every comparison. GPT-6 Astra and Claude Opus 5.5 score higher on FrontierSWE 2, while Claude Opus 5.5 leads on the OSWorld-2.1 offline subset. Treat each row as a separate evaluation; these results do not establish an overall winner for every agent workflow.
View Google’s original comparison chart and the official release for evaluation context. Google states that its cybersecurity benchmark results were evaluated without guardrails, so deployment behavior may differ.
What it means for agent work
Plan for runs that last days, not minutes. If Carbon behaves outside Google as it does inside, the limit shifts from whether the model can keep going to whether your workflow can checkpoint, resume and be reviewed along the way.
Scope discipline is the most useful claim for operators. Lower overreach and under-service, plus a habit of retrieving sources and surfacing discrepancies before acting, are what separate an agent you can hand a multi-step plan from one you have to watch. Google offers this as an observation about collaboration, not a measured guarantee, so test it against your own approval rules.
Detect, validate and patch in one model. The security results suggest a defense pipeline handled end to end. The gains were measured without guardrails, and real deployments will run with them, so behavior may differ. Keep a human in the loop for anything that changes production code.
Prompt-injection numbers do not replace least privilege. A 0.0% rate on one benchmark is encouraging, but untrusted content reaching an agent with real permissions is still a risk to design around with scoped tool access and audit trails.
Budget for both price tiers. Introductory rates are lower than the rates that follow, and cached input is heavily discounted, so long-running agents that reuse large contexts benefit most from the cached-token pricing.
If you are working out where a model like this fits into governed, production agent operations, you can Book a Consultation.
How to try it
You cannot yet try Gemini 4 Carbon through ordinary channels. At announcement, access is limited to a subset of cyber defenders, with more trusted partners added gradually through the Fairwind Program. Google has not given a date for developers, businesses or consumers, only that it plans to get there as soon as possible once guardrail feedback is in. Check the official announcement linked above for updates rather than relying on third-party timelines.
Until then, the practical step is to prepare. Pick the long-running, multi-step tasks you would hand to a stronger model, write the scope limits and approval points they need, and be ready to run your own evaluation once access opens.