Gemini 4 Carbon: Cybersecurity, Coding, Price, and Access
Gemini 4 Carbon is Google's security-first frontier model. What its coding and cyber benchmarks show, what it will cost, and why most developers cannot use it yet.
Google announced Gemini 4 Carbon on October 28, just two weeks after launching Argon. The surprising part is not another benchmark lead. It is the release order: Carbon is being given to a small group of cyber defenders before Google makes it available to ordinary developers, businesses, or consumers.
That makes this a launch with two different answers. Carbon looks unusually strong for long-running coding and defensive security work. But if you need an API model this week, it is not a choice yet. This guide separates Google’s published results from what developers can actually buy and call as of October 29, 2026.
Key takeaway
- Gemini 4 Carbon is Google’s new proprietary frontier model for long-horizon engineering and cybersecurity defense.
- Google reports 59 on Artificial Analysis Intelligence Index v5.0, 88.2% on SEC-bench Pro, 54.8% on ExploitGym, and 71.0% on CWE-bench.
- Initial access is limited to selected cyber defenders and trusted partners through the Fairwind Program; there is no public Carbon API model ID yet.
- Google says launch pricing will be $2 per million input tokens and $10 per million output tokens, then $4 / $20 after an unspecified introductory period.
- Use Gemini 4 Argon now if you need a callable Gemini 4 API. Wait for Carbon if persistent coding or authorized security work is important enough to justify a fresh evaluation.
Google announced Gemini 4 Carbon on October 28, 2026. This official launch artwork establishes the named release; it is not evidence of model quality. Source: Google, retrieved October 29, 2026.
What is Gemini 4 Carbon?
Gemini 4 Carbon is a closed, multimodal frontier model from Google DeepMind. Google positions it as the stronger successor to Gemini 4 Argon, with the biggest gains in sustained agentic coding, vulnerability discovery, exploit validation, patch generation, long-context reasoning, and resistance to indirect prompt injection.
The word “successor” needs care. Google has announced Carbon, named its price, and begun a restricted rollout. It has not published a public API identifier, context-window limit, maximum output, knowledge cutoff, model card, or generally available release date. Carbon is therefore a real announced model, not a rumor, but it is not yet a normal production dependency.
| Item | Confirmed status on October 29, 2026 |
|---|---|
| Provider | Google DeepMind |
| Release status | Limited pre-release access through selected defenders and trusted partners |
| License / weights | Proprietary; no open weights announced |
| Modalities | Google reports improved multimodal understanding; exact public API inputs are not documented |
| Context window | Not published |
| Maximum output | Not published |
| Tool calling / structured output | Not documented for a public Carbon API |
| Public API model ID | Not published |
| SandBase availability | Not listed as of October 29; the proposed Carbon model URL returned HTTP 404 |
| Announced introductory price | $2 / million input tokens; $10 / million output tokens; cached input 95% below input price |
| Standard price | $4 / million input; $20 / million output after an unspecified introductory period |
That list of unknowns is not a footnote. It is the practical difference between an impressive launch and a model you can safely put into a deployment plan.
What is actually new in Gemini 4 Carbon?
Long-horizon coding is the central bet
Google says internal teams have run Carbon for days on complex engineering tasks, including tracing and patching subtle bugs across large codebases and low-level systems. The public numbers support a narrower claim: Carbon improves over Argon on several agentic evaluations.
On Google’s Gemini comparison table, Carbon scores 65.2% on Terminal-Bench 4.0 versus Argon’s 57.1%. It reaches 61.2% on FrontierSWE 2 versus 55.0%, and 9.6% on SWE-sweep versus 4.3%. Carbon also gains 89 Elo points over Argon on WebDev Arena, landing at #4 with a score of 1768.
Those results do not mean Carbon will fix every repository. Harnesses, tool permissions, environment setup, retry policy, and verification still shape agent performance. More importantly, Google has not exposed the production interface that would let independent developers reproduce the “runs for days” claim.
Cybersecurity is a product boundary, not just a benchmark category
Carbon’s standout launch numbers cover three parts of a defensive workflow:
| Security task | Benchmark | Carbon | Argon | What it measures |
|---|---|---|---|---|
| Find vulnerabilities | SEC-bench Pro | 88.2% | 83.4% | Long-horizon bug hunting in real software targets |
| Validate exploitability | ExploitGym | 54.8% | 42.0% | Developing exploits for real-world vulnerabilities in a controlled benchmark |
| Patch root causes | CWE-bench | 71.0% | 68.0% | Producing working fixes for vulnerability classes |
Google’s launch table reports Carbon’s largest practical gains in agentic coding, long context, and cybersecurity. These are provider-published results, not SandBase tests; several rows use Google-selected settings and harnesses. Source: Google DeepMind, October 28, 2026.
SEC-bench Pro itself describes a 344-instance suite spanning V8, Firefox, and Linux, with containerized targets, timeouts, generated artifacts, and checker-based evaluation. That is more informative than a toy security questionnaire. Still, Google’s 88.2% was evaluated without guardrails, according to the launch post. A production service with safety controls may behave differently.
This is where the rollout makes sense. A model that is better at finding and validating vulnerabilities is also more capable in dual-use work. Google’s Fairwind Program restricts access to vetted defenders and permits authorized threat simulation, reverse engineering, malware analysis, and defensive research—not malicious use or redistribution.
Better long context, but no published context limit
Carbon reaches 96.2% on Google’s GraphWalks evaluation over 256K-to-1M-token inputs, compared with Argon’s 84.2%. That suggests better retrieval and reasoning over very long inputs. It does not confirm a 1M-token Carbon API context window. The benchmark range describes the evaluation; the API specification has not been published.
The distinction is easy to miss and matters for architecture. Do not size chunking, retrieval, or request limits from a benchmark label. Wait for the actual API documentation.
Safety improvements aim at agent failure modes
Google reports that Carbon reduced successful cheating on Terminal-Bench 4.0 to 0.0%, cut unsupported claims by about 2× versus Argon in internal testing, and reduced high-severity misalignment alerts by almost 80% in its live coding environments. It also reports 26% less overreach and 29% less under-service.
These are useful targets because coding agents often fail by violating task boundaries rather than by writing syntactically invalid code. But most are internal measurements without enough public detail to reproduce. Treat them as Google’s launch claims, not independent guarantees.
Prompt-injection resistance is the most interesting safety number
On Gray Swan’s Indirect Prompt Injection benchmark, Google reports a 0.0% attack success rate for Carbon, down from 0.7% for Argon. GPT-6 Astra is shown at 8.5%, while Claude Opus 5.5 and Claude Fable 5.1 are shown at 1.0%.
Google reports that Carbon resisted every attack in the evaluated Gray Swan IPI setup. “0.0%” means zero successes in that test configuration, not proof that prompt injection has been solved. Source: Google, October 28, 2026.
That last sentence is the important one. A zero observed failure rate is bounded by the prompts, tools, attempt counts, and agent design in the evaluation. New attacks and different integrations can reopen the problem. Teams should still isolate untrusted content, minimize tool privileges, require confirmation for consequential actions, and log tool calls.
Gemini 4 Carbon pricing
Google has announced two price phases but only one boundary:
| Phase | Input / 1M tokens | Cached input / 1M tokens | Output / 1M tokens | Dates |
|---|---|---|---|---|
| Introductory | $2.00 | $0.10 | $10.00 | Not specified |
| Standard | $4.00 | Not specified separately | $20.00 | After the introductory period |
For a hypothetical task with 100,000 uncached input tokens and 10,000 output tokens, the announced introductory rate would cost $0.30: $0.20 input plus $0.10 output. At the standard rate, the same token counts would cost $0.60.
That is arithmetic, not a measured Carbon task. We do not yet know how many tokens Carbon will consume for a long-running coding job, whether reasoning tokens are billed separately, or how the public service will meter tool calls. Price per million tokens is not the same as price per completed patch.
Carbon vs Argon: should you wait?
| Choose | When it is the better decision | Main trade-off |
|---|---|---|
| Gemini 4 Carbon | You can join the restricted defender program, or your future workload depends on persistent coding, vulnerability research, and prompt-injection resistance | No public API or GA date; key specifications remain unknown |
| Gemini 4 Argon | You need a production Gemini 4 API now for long-document knowledge work, reasoning, and general coding | Lower results than Carbon on Google’s new security and agentic tables |
| A cheaper fast model | Your task is extraction, classification, chat, or short code completion with strong verification | Less persistence on complex multi-step work |
The practical recommendation is simple: do not pause an ordinary product integration for Carbon. Build the interface around model routing, evaluation, and replaceable IDs. Use Argon or another available model now, then replay your own test set when Carbon ships.
If your organization does authorized defensive security work, Carbon is more interesting. Apply to Google’s Fairwind Program, define success criteria before access arrives, and include false positives, patch correctness, scope compliance, tool-use logs, and time-to-verified-fix—not only benchmark accuracy.
Can you call Gemini 4 Carbon through SandBase?
No, not as of October 29, 2026. The candidate Carbon model path returned HTTP 404 during this review, so this article does not invent a model ID or a request example. You can browse currently available Google models on the SandBase Google vendor page and use the existing Gemini 4 Argon Python tutorial for a callable Gemini 4 workflow.
When Carbon becomes available, check the official model identifier, input modalities, context and output limits, safety constraints, rate limits, and final price before changing production traffic. A name in a launch post is not an API contract.
Best use cases and limitations
Carbon is worth evaluating for authorized vulnerability discovery, patch generation with repository tests, long-running root-cause analysis, large-codebase migrations, and workflows that must inspect long mixed-format evidence before acting.
It is a poor reason to rewrite a normal chatbot, summarizer, classifier, or short code-completion pipeline. Those workloads usually benefit more from lower latency, predictable availability, and cost than from a frontier security score.
The largest limitation today is access. The next is evidence: the benchmark table is broad, but most developers cannot reproduce it against the released service. Context, output limits, latency, rate limits, regional availability, and production behavior remain unknown.
FAQ
Is Gemini 4 Carbon available now?
Only to a limited group of cyber defenders and trusted partners. Google has not opened a general developer API as of October 29, 2026.
How much will Gemini 4 Carbon cost?
Google announced $2 per million input tokens and $10 per million output tokens during an unspecified introductory period, then $4 / $20. Cached input is announced at 95% below the introductory input price.
Is Carbon better than Gemini 4 Argon?
On Google’s published tables, Carbon leads Argon across the highlighted coding, long-context, security, and general-intelligence evaluations. Independent production comparisons are not yet possible for most developers because Carbon is not broadly available.
Does Gemini 4 Carbon have a 1M-token context window?
Google reports a GraphWalks evaluation spanning 256K to 1M tokens, but it has not published Carbon’s API context limit. The benchmark range should not be treated as an API specification.
Is Gemini 4 Carbon open source?
No. Google has not announced open weights or an open-source license.
Conclusion
Gemini 4 Carbon is not “Argon, but a little higher on a leaderboard.” Google is defining it around sustained engineering and the full defensive-security loop: find a bug, validate the risk, patch the cause, and resist hostile instructions while doing it.
The restraint is equally important. Carbon is announced, priced, and in restricted use, but it is not a public API product yet. For most developers, the right move is to keep shipping with an available model and prepare an evaluation set—not to code against an imaginary endpoint. Carbon becomes a real model choice when Google publishes the interface and independent teams can test the service they will actually buy.
Sources checked October 29, 2026: Google’s Carbon announcement, Google DeepMind Gemini performance table, Fairwind Program, and SEC-bench Pro. The reader-supplied WeChat article could not be retrieved by the available browser, so it was treated as an angle reference rather than factual evidence.