Google announced Gemini 4 Carbon on October 28 in a post by Koray Kavukcuoglu that calls it “our strongest model with state-of-the-art cybersecurity and long horizon capabilities”. Almost nobody can call it. Access starts “this week” for “a subset of cyber defenders”, then widens to trusted partners through the Fairwind Program, and reaches “developers, businesses, and consumers via our product surfaces as soon as possible”, with no date. S5 Labs has not used Carbon; every performance figure below is Google’s or Artificial Analysis’s. Launch post · 9to5Google
Not on the API, and no model card
The Gemini API changelog has no Carbon entry; its newest items are the Gemini API CLI beta (October 27), requests stored by default for new paid-tier projects (October 26) and Argon’s general availability (October 13). The pricing page lists Argon as the only Gemini 4 model. Google gives no model ID, context window, output limit or product surface, and there is no Carbon model card: the DeepMind models page links only the blog post and an evaluation methodology page for Carbon, and the “Safety and Security report” linked from the post is Argon’s October report, which never mentions Carbon. Artificial Analysis’s Carbon page lists a 1M-token context window, but that is AA’s figure, and the page contradicts itself on availability: the charts say “No publicly available API”, the FAQ says one provider. Changelog · Pricing · DeepMind models · Safety report (PDF) · Artificial Analysis
Google says it is “continuing to gather feedback and iterate on guardrails” before the wider release and is “actively engaged in the U.S. government’s voluntary process for pre-release model testing”. It does not say whether defender and Fairwind access runs with or without guardrails; “evaluated without guardrails” in the post refers to the benchmark runs. Argon’s Fairwind access was explicitly “without cyber guardrails”. A day earlier, Anthropic published exploit chains built by a model it has not released either; our patch checklist covers what they hit. Launch post · Argon launch post
The Argon precedent
Argon took the same route. Its public API launch was October 13; the defender-first stage reportedly began September 30, a date many outlets repeat, though we found no Google page for it. If Carbon follows that schedule, public access is about two weeks out. Google has committed to no such thing, and the Fairwind page still says partners get “exclusive access to Gemini 4 Argon” without mentioning Carbon. Argon launch post · Fairwind Program · Our Argon pricing and migration article
Fairwind, introduced in the September 2 post for Gemini 3.8 Flash Cyber, has over 650 partners. Priority goes to governments and national cyber authorities, critical infrastructure operators (healthcare, telecom, energy, finance) and core technology platforms, and applicants need a “proven track record of ethical operations and research”. Access is limited to internal security, incident response or penetration-testing teams, with phishing-resistant MFA and tracked employee use, and partners may not share, redistribute or sell it. Defensive dual-use work such as malware analysis is permitted; creating malware is not. Fairwind Program · Gemini 3.8 Flash Cyber post
Same price as Argon, with no end date
Carbon “will launch at the same introductory price” as Argon, with cached input “priced at 95% off input token price”. The footnote gives the later price but no date. Argon’s footnote named November 30. Launch post · Argon launch post
| Per 1M tokens, Standard tier | Carbon, introductory | Carbon, after | Argon through Nov 30 | Argon from Dec 1 |
|---|---|---|---|---|
| Input | $2.00 | $4.00 | $2.00 | $4.00 |
| Output | $10.00 | $20.00 | $10.00 | $20.00 |
| Cached input | $0.10* | $0.20* | $0.10 | $0.20 |
*Our arithmetic from the 95% statement; Google prints no cached dollar figure for Carbon. Argon’s rate card also has Batch, Flex, Priority and an invite-only Contributor tier, all doubling on December 1; nothing comparable is published for Carbon. Pricing
For a team that moved to Argon this month, the sticker does not change if Carbon arrives at this price. Argon’s discount ends on a known date; Carbon’s introductory period has no stated length, so a budget that assumes Carbon at $2/$10 past December 1 is a guess. Argon bills thinking tokens as output, which is where its migration costs hide; Google has not said how Carbon counts them.
Google’s numbers, with their conditions
The cyber rows in Google’s table were run “without guardrails”, and the competitor figures for ExploitGym and SEC-bench Pro come from those vendors’ own system cards and reports. Launch post · DeepMind models · Methodology
| Google’s table | Carbon | Argon | GPT-6 Astra | Claude Opus 5.5 | Claude Fable 5.1 |
|---|---|---|---|---|---|
| CWE-bench | 71.0 | 68.0 | 68.0 | 67.0 | 58.0 |
| ExploitGym | 54.8 | 42.0 | 42.4 | 34.5 | – |
| SEC-bench Pro | 88.2 | 83.4 | 85.4 | – | – |
CWE-bench scores come from Collinear AI’s public leaderboard. ExploitGym is Google’s own single-attempt run in its Antigravity harness, offline, with mitigations off, measured at both a 6-hour and a 10-hour timeout; Google does not say which produced 54.8%. SEC-bench Pro is pass@1 averaged over three attempts on the 183-task May 2026 JavaScript engine split. The Agents’ Last Exam and OSWorld rows in the same table ran with safety filters on. Carbon trails on two rows of its own table: FrontierSWE 2 (61.2 against Astra’s 65.5 and Opus 5.5’s 62.3) and OSWorld-2.1 offline (81.5 against Opus 5.5’s 87.2). Methodology · DeepMind models
On the Artificial Analysis Intelligence Index v5.0, Carbon (High) scores 59, one point above Claude Opus 5.5 (Max) at 58, with Argon (High) at 50. The page shows no error bars, marks its methodology “Updated” and does not say whether v5.0 compares with earlier versions; early-October coverage had Argon at 53 on the previous index, so do not line these up against older scores. AA Intelligence Index · AA model page
Google says Argon “previously led” Gray Swan’s Indirect Prompt Injection Benchmark at 0.7% attack success and that Carbon “achieves 0.0%, resisting every evaluated attack attempt”. For Argon, the October 13 post specified 15 adaptive attempts, and the safety report says Gray Swan ran the benchmark on Google’s endpoint by replaying held-out successful attacks from its competitions. The Carbon post names neither an attempt count nor who ran the test. Launch post · Argon launch post · Safety report (PDF)
The post’s other figures are internal: more than 2x Argon’s success rate at generating secure code, a Chrome-team claim of “more than 10X” better patches than an unnamed lab’s model, and unsupported claims cut about 2x. Launch post
What to check
- If you migrated to Argon, keep the December 1 doubling in the forecast and treat Carbon’s price as Argon’s with an unknown expiry. Watch the pricing page for a Carbon column with a date.
- If you want early access, Fairwind takes internal security teams at the priority organizations above, under its MFA and no-resale terms. Ask whether Carbon access is the guardrail-free build; the post does not say.
- If you build agents, the 0.0% injection figure has no published attempt count or operator. Re-run your own injection suite when Carbon reaches the API.
- If you compare cyber numbers, ask which ExploitGym timeout a figure used and whether guardrails were on; Google’s own table mixes both conditions.
Still open: Carbon’s model ID, context window, output limit, intro-period end date, any Frontier Safety Framework statement, and any independent reproduction of a Carbon score.
Sources
- Gemini 4 Carbon: our next frontier model — Google
- Gemini 4 Argon: built to solve your hardest problems — Google
- Gemini 4 Argon, Safety & Security Report, October 2026 (PDF) — Google DeepMind
- Gemini models, Gemini 4 Carbon evaluation methodology, Fairwind Program — Google DeepMind
- Introducing Gemini 3.8 Flash and 3.8 Flash Cyber — Google
Developer documentation
- Gemini API changelog, Gemini API pricing — Google AI for Developers
Independent and press
- Gemini 4 Carbon (High), Intelligence Index — Artificial Analysis
- Google announces Gemini 4 Carbon — 9to5Google