Google announced Gemini 4 Carbon on October 28, 2026. The company calls it its strongest model for cybersecurity and long-horizon work. Access arrives in stages, however. The announcement starts Carbon with a subset of cyber defenders this week, and says developers, businesses and consumers follow later.
Google describes that first group only as a subset of cyber defenders, and it names no organizations. The company then plans to extend access in stages to other trusted partners through its Fairwind Program. It adds that it is engaged in the U.S. government’s voluntary process for pre-release model testing. Developers, businesses and consumers get Carbon through Google product surfaces “as soon as possible,” which the announcement never turns into a date.
Carbon builds on Gemini 4 Argon, Google’s previous frontier model. “Carbon illustrates the pace at which we’re pushing the frontier forward,” wrote Koray Kavukcuoglu, SVP of Google DeepMind and Chief AI Architect at Google.
Google frames Carbon as a model for sustained agentic work. It says its own teams have seen Carbon run for days on complex, multi-step engineering tasks, persisting through dead ends. The examples it gives are root-causing and patching subtle bugs across large codebases and low-level systems. That is an internal observation rather than a published test.
The prices Google published are API token prices. Carbon launches at the same introductory price as Argon: $2 per million input tokens and $10 per million output tokens. Cached input tokens cost 95% less than the input token price. A footnote adds the rates after the introductory period: $4 per million input tokens and $20 per million output tokens. Google does not say when that period ends, and it gives no consumer subscription price.
What Google’s benchmark scores claim
Google places Carbon first on the recently updated v5.0 of the Artificial Analysis Intelligence Index, at 59. It also reports three cybersecurity benchmark scores, each evaluated without guardrails. Carbon scores 88.2% on SEC-bench Pro. Google self-computed that figure as pass@1 on a 183-task May 2026 JavaScript engine split, averaged over three attempts per task. On ExploitGym it scores 54.8%, again self-computed, with one attempt per task, no internet access and mitigations off. Google measured that success rate under both the default six-hour timeout per task and an extended ten-hour timeout. Its 71.0% on Collinear’s CWE-bench comes from that benchmark’s public leaderboard, where Collinear AI ranks models by pass@1. Google’s evaluation methodology sets out those conditions. In web development, it says Carbon gains 89 elo points to reach #4 on WebDev Arena, at 1768.
That guardrails-off condition belongs to those three cybersecurity benchmarks, not to the whole comparison table Google published. Two of the table’s rows also go to rivals. GPT-6 Astra scores 65.5% on FrontierSWE 2 against Carbon’s 61.2%. Claude Opus 5.5 scores 87.2% on the OSWorld-2.1 offline subset, against Carbon’s 81.5%.
The table is Google’s own compilation, and it mixes sources. Google self-computed only some of the rows. Those scores are pass@1, and they run on the Gemini API at its highest thinking settings. The methodology notes the exceptions to both. Several rows come from outside evaluators, including the AA Index from Artificial Analysis and CWE-bench from Collinear AI. Other non-Gemini numbers come from providers’ self-reported figures, unless the methodology says otherwise. The results are dated as of October 2026.
The internal results Google reports
Several of the strongest claims come from inside Google. On internal benchmarks, the company says Carbon more than doubles its success rate for generating secure code over Argon. The Chrome team reported Carbon performing more than 10 times better than “another lab’s large frontier model” on high-quality patches. Google names neither the lab nor the benchmark behind that comparison. Wiz, which Google calls its leading Cloud security platform, also observes Carbon leading on web penetration testing benchmarks.
On safety, Google says Carbon reduced successful cheating on Terminal-Bench 4.0 to 0.0%, with cheating attempts dropping to 0.4%. In live coding environments with its own teams, it saw high-severity misalignment alerts fall by almost 80%. Internal testing cut unsupported claims by approximately 2x over Argon. Google also reports a 26% reduction in overreach and a 29% reduction in under-service, without defining either measure. Gray Swan’s Indirect Prompt Injection benchmark is a third-party test, and there Google reports a 0.0% attack success rate for Carbon, against 0.7% for Argon.
For now, the announcement leaves gaps a buyer would notice. It gives no general availability date, no context window or output token limit, and no Carbon model card. The safety and security report it links covers Argon. Its internal figures, from the secure-code uplift to the overreach and under-service reductions, come with no outside check in the announcement.
