Updated November 10, 2026
What is Gemini 4 Carbon?
Gemini 4 Carbon is Google's frontier model announced on October 28, 2026, with an emphasis on cybersecurity defense and long-horizon engineering. Google describes improvements over Gemini 4 Argon in coding, agentic work and secure software development. Availability is the first thing a prospective user should check: the launch describes access for a subset of cyber defenders, followed by trusted partners through the Fairwind Program. The sources reviewed for this guide do not establish broad public API access as of November 10. Carbon should therefore be understood as a restricted-rollout model, not a generally available replacement for every Gemini user.
Watch Carbon closely for authorized cyber defense and sustained engineering tasks, but do not plan a public launch around access you have not confirmed. Its announced prices and provider-reported benchmarks are useful planning inputs, not proof of general availability.
Official model and release documentation
Specification | Verified detail |
|---|---|
Provider | |
Announcement | October 28, 2026 |
Rollout | Subset of cyber defenders and trusted partners |
Access program | Fairwind; confirm eligibility with Google |
Primary emphasis | Cybersecurity defense and long-horizon engineering |
License | Proprietary hosted model |
Public API model ID | Not verified in the cited launch material |
Context and output limits | Not established by the reviewed Carbon source |
Knowledge cutoff | Not verified in reviewed source |
Announced input/output | $2 / $10 per million tokens |
Cached input announcement | 95% discount on input price |
What changed and how to approach migration
Carbon builds on Argon rather than merely changing the branding of the existing model. Google highlights longer-running work, stronger vulnerability analysis and better secure-code generation. The announcement also reports improvements in transparency, scope control and prompt-injection resistance. These are provider evaluations and should be described with their settings intact. For an Argon migration, compare the exact Carbon configuration your organization can access, not only the headline launch results. Confirm tools, quotas, safeguards and pricing before changing a working application.
Area | What changed |
|---|---|
Predecessor relationship | Builds on Gemini 4 Argon |
Engineering focus | More sustained, long-horizon agent tasks |
Cyber focus | Finding, validating and patching vulnerabilities |
Access difference | Restricted phased rollout described at launch |
Ranking consequence | No automatic replacement for Argon in the site table |
Capabilities and practical use cases
A useful Carbon evaluation would ask an approved defender to take a real issue from initial evidence through a validated patch in an authorized environment. The important artifact is not a confident description of a possible bug; it is a result that another engineer can check and maintain. Google also describes full-stack development, scientific work and multimodal gains, but the public launch does not supply every deployment limit or endpoint detail. Teams should obtain those details before specifying an integration. Long-horizon capability also raises practical questions about budget, checkpoints, recovery and how the agent reports unresolved uncertainty.
Workflow | Practical fit |
|---|---|
Vulnerability discovery | Find candidate issues with inspectable evidence |
Risk validation | Check whether a suspected issue is reproducible |
Patch development | Address the root cause and test regressions |
Long-horizon engineering | Continue a complex task across multiple failed approaches |
Web development | Generate and revise full-stack artifacts |
Scope-aware collaboration | Report uncertainty and respect task boundaries |
Benchmarks and evidence
Google reports 88.2% on SEC-bench Pro, 54.8% on ExploitGym and 71.0% on CWE-bench. The launch explicitly says those external cyber benchmarks were evaluated without guardrails, a material condition when comparing them with a deployed product. Google also reports an Artificial Analysis Intelligence Index v5 score of 59 and a launch-time WebDev Arena position of fourth at 1768 Elo. Those are dated statements from the announcement, not a fresh assertion that Carbon still holds that position today. Percentages, index scores and Elo are different metrics and should not be averaged together.
Evidence | Reported result | How to interpret it |
|---|---|---|
SEC-bench Pro | 88.2% | Google-reported; evaluated without guardrails |
ExploitGym | 54.8% | Google-reported; evaluated without guardrails |
CWE-bench | 71.0% | Google-reported; evaluated without guardrails |
AA Intelligence Index v5 | 59 | Reported in October 28 announcement |
WebDev Arena | 1768 Elo; fourth at launch | Historical launch claim, not current live placement |
Pricing and total cost
Google announced introductory pricing of $2 per million input tokens and $10 per million output tokens, with cached input priced at 95% off the input rate. That discount implies $0.10 per million cached input tokens, but it remains an arithmetic interpretation of the announced terms, not a separate verified invoice rate. One million uncached input tokens plus 100,000 output tokens would cost $3 at the announced base rates. Because rollout is restricted, confirm actual account terms, context tiers, tool charges and billing availability before using the announcement to budget an application.
Cost component | Published term or planning boundary |
|---|---|
Announced input | $2 / million tokens |
Announced output | $10 / million tokens |
Announced cached-input discount | 95% off input |
Implied cached-input rate | $0.10 / million, calculated from announcement |
1M input + 100K output | $3 at announced base rates |
Actual access and billing | Confirm with Google for your approved account |
Unverified rate details | Context tiers and extra tool charges not assumed |
Limitations and deployment tradeoffs
The central limitation is access. A provider can announce a powerful model before ordinary developers can call it. The reviewed Carbon material also does not establish the exact public API identifier, context ceiling or maximum output, so those fields should not be copied from Argon. Google's safety results are useful evidence about evaluated conditions, not a guarantee of zero prompt-injection or alignment failures in a new system. The distinction between unguarded benchmark runs and deployed safeguards is especially important for cyber comparisons. Confirm that the behavior required for your legitimate workflow is available within the approved product configuration.
Consideration | What to check |
|---|---|
Restricted rollout | Do not promise access before approval |
Incomplete specifications | Do not inherit Argon limits or API IDs |
Guardrail differences | Keep benchmark and deployment settings separate |
Dated rankings | Label launch-time index and Elo claims |
Operational complexity | Use checkpoints, budgets and reproducible validation |
How to evaluate Gemini 4 Carbon for your workload
Start with a small, representative set of restricted-rollout cyber defense and long-horizon engineering tasks, including ordinary cases, difficult edge cases and tasks with an objectively checkable answer. For this model, a useful pilot includes a scoped patch-validation workflow with reproducible regression checks. Keep the prompts, available tools, source material and acceptance criteria consistent across candidates. Record the exact model ID, reasoning configuration, date and any provider-specific access program so the comparison can be repeated later.
Measure completed-task quality rather than the fluency of the response. Ask a reviewer to identify unsupported claims, incorrect changes, missing evidence and avoidable manual repair. An agent that stops honestly when evidence is insufficient can be more useful than one that produces an impressive-looking but invalid artifact. Where tools are involved, track invalid arguments, failed calls and recovery behavior separately from the final answer. A single successful demonstration is a reason to continue testing, not proof of a dependable service level.
Pilot measure | What to record |
|---|---|
Task completion | Was the requested artifact actually completed and checked? |
Evidence quality | Can a reviewer trace decisive claims to sources or tests? |
Correction burden | How much expert time was needed after the model finished? |
Latency | Measure end-to-end time, not just first-token speed |
Total cost | Include tokens, tools, retries and human review |
Failure handling | Did it report uncertainty and recover without inventing success? |
Use a staged rollout only after the pilot meets the target you set in advance. Preserve a known baseline and a way to compare new requests with the previous configuration. If the model, tool interface, access policy or price changes, rerun the affected cases instead of assuming an old result still applies. The purpose of evaluation is a defensible choice for your actual work, not a claim that one model is universally best.
Who should use it, and what should you compare?
Carbon belongs on the watchlist of security teams and engineering organizations already able to work with Google's restricted programs. It is not the simplest recommendation for a developer who needs a working public API today. Teams should keep a currently accessible model in their application plan while evaluating Carbon's potential. Compare Argon, public frontier models and approved specialist alternatives on the same engineering tasks. Choose the shortlist around actual access, evidence quality and task fit rather than the newest announcement alone.
Alternative | Why compare it | Decision boundary |
|---|---|---|
Gemini 4 Argon | Current ranked Google option | Do not assume Carbon availability transfers |
Claude Fable 5.2 | Public demanding-work model | Different price and safeguard profile |
GPT-6 Astra | General frontier comparison | Evaluate under matching tools and task budgets |
Approved specialist models | Dedicated cyber workflows | Separate verification and product terms apply |
Frequently asked questions
Can I use Carbon through a public API now?
The reviewed launch material describes phased access for cyber defenders and trusted partners. It does not establish broad public availability. Confirm your organization's access and the actual endpoint before planning an integration.
How does Carbon differ from Argon?
Google positions Carbon for stronger cyber defense and long-horizon engineering, with a restricted phased rollout at launch. Argon is a separate model with its own access and evaluation conditions. Compare them only after confirming the configuration available to your organization.
What are Carbon’s context and output limits?
The reviewed Carbon launch source does not establish them. Copying Argon's limits would be an unsupported assumption. Obtain the exact model documentation or account specifications before building around a numeric limit.
Are the reported cyber scores deployment guarantees?
No. Google labels the cited external cyber benchmarks as evaluated without guardrails. Production access controls, safeguards, harnesses and your own task distribution may change the observed behavior substantially.
Related model guides
Compare the full AI model directory
Sources and editorial method
Google Carbon launch and rollout details
Specifications, access conditions and prices were checked against the linked provider sources on November 10, 2026. Provider-reported benchmarks are attributed and are not presented as independently reproduced tests. Missing specifications remain unverified rather than being inferred from a related model. Practical workflow advice is an evaluation recommendation, not a claim that we ran new hands-on trials. Recheck official terms before purchase or deployment.