What Is Gemini 4 Carbon? Google's Second Frontier Model in a Month, Explained: Who Can Use It (Cyber Defenders Only, for Now), What It Costs, the Scores Google Reports vs the Ones Independents Confirm, and Whether to Wait for It

What Google says Gemini 4 Carbon is

The announcement is a 1,100-word post under Koray Kavukcuoglu's byline, the SVP of Google DeepMind who also signed the Argon launch. The first sentence sets the frame: 'Gemini 4 Carbon, our strongest model with state-of-the-art cybersecurity and long horizon capabilities.' That is a general frontier model with two advertised strengths, not a security-only product. Google does not call Carbon a tier, a fine-tune, or a variant; it is the second model in the Gemini 4 series, after Argon, named like Argon for a chemical element.

Two sentences carry the pitch. 'Designed to take on much harder, long-horizon engineering problems, Carbon is built for sustained agentic workflows.' And: 'Internally, our teams have seen Carbon run for days to persist through dead ends to tackle complex, multi-step engineering tasks like root-causing and patching subtle bugs across large codebases and low-level systems.' Logan Kilpatrick's launch post, 1.1 million views by the next morning, condensed it to 'SOTA on cyber, long horizon tasks, ranks #1 on Artificial Analysis V5, significantly improves on usability in domains like coding, and is more aligned.'

What Google has not published matters as much. There is no Carbon model card, no context-window or output-limit spec, no speed figure, and no Carbon safety report. The post's 'Safety and Security report' link goes to the 217-page Argon report from October, which does not mention Carbon once. The only Carbon-specific document is a five-page evaluation methodology PDF with the benchmark table and how each number was run. Artificial Analysis and Vals both list a 1M-token context window, but that comes from them, not from Google's post.

Who can use Gemini 4 Carbon today, and how to get access

Google's rollout paragraph, in full: 'Starting this week, we will make Carbon available to a subset of cyber defenders and will gradually phase access to additional trusted partners through our Fairwind Program. We're continuing to gather feedback and iterate on guardrails before making Carbon available to developers, businesses, and consumers via our product surfaces as soon as possible.' Google also says it is 'actively engaged in the U.S. government's voluntary process for pre-release model testing.' That is the entire access plan. No date for developers, no date for the app, no named partners.

This is the same path Argon took, not a new restriction. Argon was announced September 30 'to a set of trusted cyber defenders through our Fairwind Program' and reached Pro and Ultra subscribers, the paid API, Cursor, and Copilot on October 13, thirteen days later. If Carbon follows the same clock, the broad release lands in the first half of November. That is our inference from one data point; Google has not said it, and it has said it is still iterating on guardrails.

If you run a security team, the Fairwind Program page is the only door, and the interest form is the only form. As of October 29 the page still describes Argon and does not mention Carbon. Its criteria are specific:

• Who gets priority: 'Governments and national cyber authorities,' 'Critical infrastructure operators,' and 'Core technology platforms,' plus 'academic labs that focus on defensive benchmarking.'
• Vetting: 'We vet all applicants to make sure they have a proven track record of ethical operations and research' and 'We conduct background checks on organizations that apply.'
• What you can do with it: partners are 'only permitted to carry out dual-use tasks' such as authorized threat simulation, reverse engineering, and malware analysis. 'Malicious tasks such as creating malware are not permitted.'
• Who inside your company: access is limited to 'internal cybersecurity, incident response, or penetration testing teams,' behind 'user-level authentication, phishing-resistant MFA, and applicable access controls,' and 'we do not allow partner organizations to share, redistribute, or sell access.'

For everyone else, as of October 29: Carbon is not in the Gemini app on Free, Plus, Pro, or Ultra; there is no gemini-4-carbon model ID on the Gemini API or Vertex; it is not in Antigravity, Cursor, or Copilot; and Google's pricing page lists only Argon. If you want the best Gemini you can actually use, that is Argon on the $19.99 Pro plan, which we cover route by route.

What Gemini 4 Carbon costs

Google stated the API price in the post even though the API isn't live: 'Gemini 4 Carbon will launch at the same introductory price as Argon at $2 per million input tokens and $10 per million output tokens, with cached input tokens priced at 95% off input token price.' The footnote: 'After the introductory period expires, the price of $4 per 1M input tokens and $20 per 1M output tokens will apply.' Argon's introductory period ends November 30; Carbon's has no stated end date, which Artificial Analysis also flagged ('a 50% launch discount, with no confirmed end date').

On what a real task costs, two independents have numbers. Artificial Analysis, pricing everything at the standard $4/$20, puts Carbon at $7.76 per Intelligence Index task, about 23% less than Claude Opus 5.5 at max effort ($10.04) and about 1.2× GPT-6 Astra at max ($6.25), using 123,000 output tokens per task. Vals measured $10.51 per test on its index and a median latency of 47 minutes 45 seconds per task, which tells you what 'run for days' looks like from the outside: this is a model that thinks for a long time. When the API is live we'll add it to our token counter and cost estimator at both rates.

The cybersecurity scores: what's confirmed and what's Google's word

Google's three cyber numbers map to the three stages it describes, 'vulnerability detection, validation, and remediation.' They are not equally solid.

SEC-bench Pro is a real benchmark, from the University of Illinois group behind SEC-bench: a model gets a source checkout and must find and trigger a memory-safety bug in a JavaScript engine. Google's methodology says its 88.2% is 'Pass@1 on the 183-task May 2026 JavaScript engine split, averaged over 3 independent attempts per task, using the Antigravity harness,' and that 'competitor numbers are taken from their published system cards and technical reports.' Two things to hold alongside it. The official SEC-bench Pro leaderboard does not list Carbon, Argon, or Astra; its best verified entry is GPT-5.5 at 58.4%, roughly 30 points below every vendor's self-reported score, because the vendors run a different split with their own harnesses and time budgets. And Anthropic has published no SEC-bench Pro score for Opus 5.5 at all; the leaderboard notes that 'newer results for Claude Opus and Mythos models are not available due to safeguard restrictions.' So 'ahead of Opus 5.5 on finding vulnerabilities' is a claim nobody can make from public data.

CWE-bench is the one you can check. Collinear AI's leaderboard, dated October 28, has Carbon first at 71% programmatic pass@1 and 81% pass@4, with a three-way tie at 68% below it (Grok 4.7, Argon, GPT-6 Astra) and Opus 5.5 at 67%. The gap is three points on a 120-task set. The same board also shows the cost column Carbon doesn't have yet: Opus 5.5 in Claude Code averaged $0.79 per rollout, Argon in Antigravity $6.63. Collinear's note: 'Gemini 4 Carbon has no cost figure yet, so it is on the leaderboard but not on this chart.'

ExploitGym sits in between: Google ran it itself, 'in the default setting with mitigations off,' and took rivals' numbers from their system cards. The post's other security claims are unquantified vendor statements: 'more than 2x uplift in success rate for generating secure code over Argon' on internal benchmarks, the Chrome team reporting Carbon 'performed more than 10X better than another lab's large frontier model when generating high quality patches' (no score, no lab named), and Wiz observing 'Carbon leading on benchmarks for web penetration testing.' Wiz is the only outside company named anywhere in the post, and it is named as an observer, not as a Fairwind partner.

Google's full table: where Carbon leads and where it doesn't

Google's evaluation PDF compares Carbon with Argon, GPT-6 Astra, Claude Opus 5.5, and Claude Fable 5.1 on seventeen benchmarks. Gemini scores are pass@1 at the highest thinking setting; the other columns are 'sourced from providers' self-reported numbers unless otherwise mentioned.' Carbon leads fifteen of seventeen. The two it loses are the ones that matter most to developers who ship code and agents that use computers.

Read the two losses with the two near-ties. On FrontierSWE 2, the real-repository coding benchmark, Astra leads by four points and Opus 5.5 by one. On OSWorld, the computer-use benchmark, Opus 5.5 is almost six points ahead. The Vals lead over Opus 5.5 is 0.2 points on a benchmark Vals reports with a ±0.97 error bar; Vals's own page ranks Carbon #2 of 29 because Claude Sonnet 5.5 (70.85%) edges both. The clearest wins are long context (GraphWalks, where Carbon is nearly 25 points ahead of Astra), agentic knowledge work (AutomationBench, Vending-Bench), and the cyber trio.

The Artificial Analysis #1 claim, checked

True, and younger than it sounds. Artificial Analysis published Intelligence Index v5 on October 27 with Claude Opus 5.5 at max effort on top at 58. Carbon was added the next day at 59, twenty-one minutes after Kilpatrick's post, and took #1 by a single point. The live board on October 29: Gemini 4 Carbon (high) 59, Claude Opus 5.5 (max) 58, Opus 5.5 (xhigh) 57, GPT-6 Astra (max) 57, Astra (xhigh and high) 55, GPT-6.1 Sol (max) 55, Claude Sonnet 5.5 (max) 54. Argon scores 50 on v5; the 53 you may have seen for Argon was its v4 score, before the index dropped three evaluations and added harder ones.

Artificial Analysis's own summary is more careful than the headline. Carbon is 'the #1 score in 4 of the 9 Index evaluations' (HLE-Diamond, Terminal-Bench-Science, AA-Omniscience, AutomationBench-AA) and 'makes substantial gains elsewhere but is not leading in coding and knowledge work.' On the Coding Agent Index, Carbon in Antigravity scores 59, 'only 3 points behind Claude Code with Claude Opus 5.5 (max, 62).' On AA-Briefcase, the agentic knowledge-work Elo, it trails Kimi K3.1 Pro, Muse Wonder, and Grok 4.7. Its hallucination rate on AA-Omniscience rose from Argon's 4% to 11%, still 'the second lowest of any model,' against 50% for Opus 5.5 and Astra. And Carbon is absent from Artificial Analysis's separate Cyber Index, which Kimi K3.1 Pro currently leads at 64, because AA runs its own cyber evals and hasn't run Carbon.

One more note on what 'the index result is spreading' looks like in practice. The posts we were pointed to as evidence of momentum ranged from Kilpatrick's launch (1.11 million views, 15,326 likes), to Artificial Analysis's thread (540,000 views, 4,725 likes), to a French commentator declaring Carbon 'la meilleure IA au monde' ahead of GPT-6 and Opus 5.5 (2,843 views, 57 likes). The claim travels; the numbers behind it, above, are narrower than the travel.

The alignment claims, and the safety report that isn't there

The second half of Google's post is about behavior rather than capability, and nearly all of it is internal measurement. Carbon 'reduced successful cheating on Terminal-Bench 4.0 to 0.0%, with attempts to cheat dropping to 0.4%.' In live coding with Google's teams, 'high-severity misalignment alerts dropped by almost 80%.' Carbon 'cuts unsupported claims by approximately 2x over Argon,' 'reduced overreach by 26% and under-service by 29%,' and 'retrieves the relevant sources and surfaces discrepancies to the user before acting.' The one external figure: on Gray Swan's Indirect Prompt Injection benchmark, 'Argon previously led… with a very low 0.7% attack success rate, Carbon achieves 0.0%.'

These are the kind of claims a system card would let you check, and there isn't one. The Argon safety report that the post links is explicit about why the series is gated: 'we cannot rule out the unmitigated model approaching several significant capability thresholds: the Cyber Uplift Level 1 Critical Capability Level,' and 'we cannot rule out that Gemini 4 Argon has reached this CCL, and we therefore developed a safety case for its cyberoffensive capabilities.' Carbon is the stronger model on every cyber benchmark Google ran, with the cyber evals 'evaluated without guardrails,' and Google has published no Carbon-specific Frontier Safety Framework determination. That, more than any benchmark, is the likely reason the rollout is Fairwind-first and 'as soon as possible' has no date.

Carbon vs Argon vs GPT-6 Astra vs Opus 5.5: should you wait?

• If you use the Gemini app: nothing to wait for. Carbon has no consumer timeline, and Argon on the $19.99 Pro plan is in the app today. When Carbon lands it will most likely arrive on the same tiers; Google's post says 'developers, businesses, and consumers via our product surfaces.'
• If you build on the API: Carbon costs the same as Argon, $2/$10 now and $4/$20 later, so there is no price reason to delay an Argon integration. Argon's introductory rate ends November 30; plan for $4/$20 from December 1 regardless of which model you end up on.
• If you're choosing a coding agent: Artificial Analysis still has Claude Code with Opus 5.5 ahead of Carbon in Antigravity (62 vs 59), Astra leads FrontierSWE 2, and Opus 5.5 leads computer use. Our Opus 5.5 vs GPT-6 Sol and Kimi K3.1 Pro vs Opus 5.5 vs Astra comparisons cover the models you can run today.
• If you're a security team: apply to Fairwind now. The program is the only route, vetting takes time, and Google has said the next cohort comes from it. OpenAI's Daybreak program for GPT-6 Astra and Anthropic's Claude Security tiers for Mythos 5.1 are the parallel doors at the other two labs; every frontier lab now gates its strongest cyber capability behind a vetted program, which is the context the 'restricted release' headlines leave out.

What it changes in our rankings

Nothing today. Gemini stays at #2 in AI chatbots at 4.8 behind ChatGPT, because we rate what a subscriber can open, and no subscriber can open Carbon. The review's Gemini 4 FAQ now says so and carries the corrected v5 scores. We'll re-score when Carbon reaches the Pro tier or the API, whichever comes first, and we'll add it to the token counter the day a model ID exists.

What we corrected, and what's still unconfirmed

• 'First Gemini model with a cybersecurity restriction.' Wrong. Argon launched the same way on September 30, Fairwind-first, and went broad on October 13.
• 'Google has not published API pricing.' Wrong. The post states $2/$10 introductory and $4/$20 standard, with cached input 95% off. What's true: no pricing-page row, no model ID, no end date for the introductory period.
• 'Ahead of GPT-6 and Opus 5.5.' True on Artificial Analysis v5 (59 vs 57 vs 58) and on CWE-bench (71 vs 68 vs 67). Not checkable on SEC-bench Pro, where Anthropic has published nothing, and not true on FrontierSWE 2, OSWorld, the AA Coding Agent Index, or the Vals Index.
• Unconfirmed as of October 29: any date for developers or consumers; the API model ID; Carbon's context window and output limit (1M per Artificial Analysis and Vals, not stated by Google); a Carbon model card or safety report; which organizations are in the first cyber-defender cohort; the end of the introductory price.