Gemini 4 Carbon: Google's "strongest" model goes to cyber defenders first

In short

• According to Google's table, Carbon ranks first on the Artificial Analysis Intelligence Index v5.0 with 59 points, ahead of Claude Opus 5.5 (58) and GPT-6 Astra (57).
• In cybersecurity, Google reports 88.2% on SEC-bench Pro, 54.8% on ExploitGym and 71.0% on CWE-bench.
• Announced price: $2 per million input tokens and $10 per million output tokens at launch, then $4 and $20.

What is announced

Google presents Carbon as built to last on hard engineering problems:

• Long tasks: internally, Carbon ran "for days" on multi-step tasks, such as root-causing a subtle bug in a large codebase and patching it.
• The web: 4th place on WebDev Arena with 1768 points, "+89 elo points", without saying compared with which model.
• Cybersecurity: finding a vulnerability, checking that it can be exploited, patching it. Google says it is state of the art on all three steps.

The three cybersecurity figures were measured "without guardrails":

• SEC-bench Pro, 88.2% (finding real vulnerabilities): computed by Google itself, on 183 tasks (JavaScript engines), averaged over 3 attempts per task.
• ExploitGym, 54.8% (proving a vulnerability can be exploited): computed by Google itself, one attempt per task, no internet, "mitigations off" setting.
• CWE-bench, 71.0% (patching the vulnerability): taken from the official public leaderboard, where all models are evaluated by Collinear AI.

Who measured the competitors? By default, Google uses the numbers they published themselves. That is the case for SEC-bench Pro and ExploitGym; the AA Index comes from Artificial Analysis.

And Carbon is not first everywhere in that same table:

• OSWorld-2.1: Claude Opus 5.5 scores 87.2%, Carbon 81.5%;
• FrontierSWE 2: GPT-6 Astra scores 65.5%, Carbon 61.2%.

A lab that leaves its own losses in its table, I like that ^^

In-house numbers, to take as such

The rest comes from Google's internal tests:

• Secure code: "more than 2x uplift" in success rate compared with Argon, without the rates themselves.
• Patches: the Chrome team reports a result "more than 10X better" than "another lab's large frontier model", without naming that model or giving the scores.
• Cheating: on Terminal-Bench 4.0, successful cheating at 0.0% and attempts at 0.4%, without the previous value.
• Misbehavior: high-severity "misalignment" alerts down "almost 80%" in internal coding environments.
• Unsupported claims: roughly half as many as Argon; overreach -26%, under-service -29%.
• Prompt injection: 0.0% successful attacks on Gray Swan's benchmark, versus 0.7% for Argon.

Except for prompt injection, no starting values. "More than double", "-80%": of what? I note it, I don't count it.

Who can use it

Not you, not yet. Staged rollout:

• this week: a subset of "cyber defenders";
• next: other trusted partners, gradually, through the Fairwind Program;
• later: developers, businesses and consumers, "as soon as possible".

Google also says it takes part in the U.S. government's voluntary process for testing models before release.

At 18:12 UTC, the Fairwind page still only mentions Argon. It targets governments, critical infrastructure operators and core technology platforms, and forbids partners from sharing, redistributing or selling access.

What it costs

The price comes from the blog post alone: the same introductory price as Argon.

• Input: $2 per million tokens;
• Output: $10 per million tokens;
• Cached input: 95% off the input price, i.e. $0.10 per million (our math: 5% of $2).

After the introductory period: $4 input and $20 output. The price doubles. If you send 10 million tokens and get 2 million back, your bill goes from $40 ($20 + $20) to $80 ($40 + $40).

For Argon, the official docs show $2 and $10 through November 30, 2026, then $4 and $20 starting December 1. For Carbon, no date is given.

What we don't know

• When Carbon reaches the Gemini API, Vertex AI or the Gemini app: not published. At 18:12 UTC, it is missing from the API docs, pricing page and changelog.
• Context window size: not published for Carbon (Argon announces 1 million tokens).
• A model card or safety report specific to Carbon: not found. The report cited in the post is Argon's.
• ExploitGym: Google measured with a 6-hour and a 10-hour timeout per task. Neither the text nor the PDF's results table says which one gives 54.8%.

Key terms

• Token: a small piece of text (often part of a word), the billing unit of the API.
• Long horizon: a task that takes many steps and a lot of time, which the model has to sustain without getting lost.
• Pass@1: the success rate when the model gets only one attempt per task; Google specifies that its "single attempt" settings allow no voting between several answers.
• Prompt injection: an instruction hidden in a document or web page to hijack the model.
• Guardrails: the protections Google is still tuning before opening access; the cybersecurity scores were measured without them.

About the source

• Who announces it: Google, post signed by Koray Kavukcuoglu (Google DeepMind); shared by Sundar Pichai on X at 17:01 UTC.
• Date: the page shows "Oct 28, 2026", published at 17:00 UTC, modified at 18:02 UTC.
• Links: Google blog post · Google DeepMind Gemini page · evaluation methodology (PDF) · Fairwind Program · Gemini API pricing · Sundar Pichai's post

Source passages

Show the 28 sources

Ref.	Quote (original language)	URL
S1↑	"Today, we’re announcing the next frontier model: Gemini 4 Carbon, our strongest model with state-of-the-art cybersecurity and long horizon capabilities."	https://blog.google/innovation-and-ai/models-and-research/gemini-models/introducing-gemini-4-carbon/
S2↑	"Carbon ranks #1 on the recently updated v5.0 of Artificial Analysis Intelligence Index at 59."	https://blog.google/innovation-and-ai/models-and-research/gemini-models/introducing-gemini-4-carbon/
S3↑1↑2	"landing a firm lead in SEC-bench Pro (88.2%) for finding vulnerabilities, ExploitGym (54.8%) for exploitation, and CWE-bench (71.0%) for patching." / "It achieves state-of-the-art performance across the cybersecurity defense lifecycle — vulnerability detection, validation, and remediation."	https://blog.google/innovation-and-ai/models-and-research/gemini-models/introducing-gemini-4-carbon/
S4↑1↑2↑3	"Starting this week, we will make Carbon available to a subset of cyber defenders and will gradually phase access to additional trusted partners through our Fairwind Program. We’re continuing to gather feedback and iterate on guardrails before making Carbon available to developers, businesses, and consumers via our product surfaces as soon as possible."	https://blog.google/innovation-and-ai/models-and-research/gemini-models/introducing-gemini-4-carbon/
S5↑	"We’re taking a deliberate approach to rollout and are actively engaged in the U.S. government’s voluntary process for pre-release model testing."	https://blog.google/innovation-and-ai/models-and-research/gemini-models/introducing-gemini-4-carbon/
S6↑1↑2↑3	"Gemini 4 Carbon will launch at the same introductory price" (footnote 1) "as Argon at $2 per million input tokens and $10 per million output tokens, with cached input tokens priced at 95% off input token price."	https://blog.google/innovation-and-ai/models-and-research/gemini-models/introducing-gemini-4-carbon/
S7↑1↑2↑3	"After the introductory period expires, the price of $4 per 1M input tokens and $20 per 1M output tokens will apply."	https://blog.google/innovation-and-ai/models-and-research/gemini-models/introducing-gemini-4-carbon/
S8↑1↑2↑3	"Designed to take on much harder, long-horizon engineering problems, Carbon is built for sustained agentic workflows. Internally, our teams have seen Carbon run for days to persist through dead ends to tackle complex, multi-step engineering tasks like root-causing and patching subtle bugs across large codebases and low-level systems."	https://blog.google/innovation-and-ai/models-and-research/gemini-models/introducing-gemini-4-carbon/
S9↑	"Carbon jumps +89 elo points to land at #4 (1768) on WebDev Arena."	https://blog.google/innovation-and-ai/models-and-research/gemini-models/introducing-gemini-4-carbon/
S10↑1↑2	"On internal benchmarks, Carbon achieves more than 2x uplift in success rate for generating secure code over Argon. As another example, the Chrome team has reported that Carbon performed more than 10X better than another lab's large frontier model when generating high quality patches."	https://blog.google/innovation-and-ai/models-and-research/gemini-models/introducing-gemini-4-carbon/
S11↑1↑2	"Carbon excels across key external benchmarks (evaluated without guardrails)"	https://blog.google/innovation-and-ai/models-and-research/gemini-models/introducing-gemini-4-carbon/
S12↑1↑2	"Carbon reduced successful cheating on Terminal-Bench 4.0 to 0.0%, with attempts to cheat dropping to 0.4% — all while improving overall accuracy. In live coding environments with our internal teams, we observed that high-severity misalignment alerts dropped by almost 80%."	https://blog.google/innovation-and-ai/models-and-research/gemini-models/introducing-gemini-4-carbon/
S13↑	"In our internal testing, Carbon cuts unsupported claims by approximately 2x over Argon." / "Carbon simultaneously reduced overreach by 26% and under-service by 29%"	https://blog.google/innovation-and-ai/models-and-research/gemini-models/introducing-gemini-4-carbon/
S14↑	"While Argon previously led the Gray Swan’s Indirect Prompt Injection (IPI) Benchmark in prompt injection resistance with a very low 0.7% attack success rate, Carbon achieves 0.0% — resisting every evaluated attack attempt."	https://blog.google/innovation-and-ai/models-and-research/gemini-models/introducing-gemini-4-carbon/
S15↑	"Building on Gemini 4 Argon, which was launched two weeks ago, Carbon illustrates the pace at which we’re pushing the frontier forward."	https://blog.google/innovation-and-ai/models-and-research/gemini-models/introducing-gemini-4-carbon/
S16↑1↑2↑3	"Performance" table, columns Gemini 4 Carbon / Gemini 4 Argon / GPT-6 Astra / Claude Opus 5.5 / Claude Fable 5.1. Rows: AA Index v5.0: 59 / 50 / 57 / 58 / 49; SEC-bench Pro: 88.2% / 83.4% / 85.4% / — / —; ExploitGym: 54.8% / 42.0% / 42.4% / 34.5% / —; CWE-bench: 71.0% / 68.0% / 68.0% / 67.0% / 58.0%	https://deepmind.google/models/gemini/
S17↑1↑2	"All Gemini 4 Carbon and Gemini 4 Argon scores are pass @1 except where otherwise noted. \"Single attempt\" settings allow no majority voting or parallel test-time compute." / "All of the results are run with the Gemini API with the highest thinking settings unless indicated otherwise below." / "All the results for non-Gemini models are sourced from providers' self-reported numbers unless otherwise mentioned below."	https://deepmind.google/models/evals-methodology/gemini-4-carbon
S18↑	"SEC-bench Pro results are self computed using the open source evaluation setup. We report Pass@1 on the 183-task May 2026 JavaScript engine split, averaged over 3 independent attempts per task"	https://deepmind.google/models/evals-methodology/gemini-4-carbon
S19↑1↑2	"ExploitGym results are self computed using the open source evaluation setup. We evaluated our models with a single attempt per task using the Antigravity harness, without any access to the internet." / "We ran the evaluation in the default setting with mitigations off, and measured the success rate under both the default 6 hour timeout per task, as well as an extended 10 hour timeout."	https://deepmind.google/models/evals-methodology/gemini-4-carbon
S20↑	"CWE-bench v1 results are sourced from the official public leaderboard and evaluated across all models by Collinear AI."	https://deepmind.google/models/evals-methodology/gemini-4-carbon
S21↑	Gemini 4 Argon: "Input price | Not available | $2.00 through November 30, 2026. $4.00 starting December 1, 2026." / "Output price (including thinking tokens) | Not available | $10.00 through November 30, 2026. $20.00 starting December 1, 2026."	https://ai.google.dev/gemini-api/docs/pricing
S22↑	"Gemini 4 Argon" / "Our flagship reasoning model with a unified 1M context window and long decodes up to 1M tokens."	https://ai.google.dev/gemini-api/docs/models
S23↑	"Organizations may only grant Gemini 4 Argon access to internal cybersecurity, incident response, or penetration testing teams" / "we do not allow partner organizations to share, redistribute, or sell access to our frontier models." / "Governments and national cyber authorities." / "Critical infrastructure operators." / "Core technology platforms."	https://deepmind.google/fairwind-program/
S24↑	"I did say we'd be releasing our models periodically...introducing Gemini 4 Carbon, our next frontier model." (created_at "2026-10-28T17:01:48.000Z")	https://x.com/sundarpichai/status/2115489219804352921
S25↑1↑2	Displayed date: "Oct 28, 2026". Metadata: datePublished "2026-10-28T17:00:00+00:00"; dateModified "2026-10-28T18:02:36.657805+00:00"	https://blog.google/innovation-and-ai/models-and-research/gemini-models/introducing-gemini-4-carbon/
S26↑	Même tableau. Rows: OSWorld-2.1 (Offline subset): 81.5% / 74.7% / 80.9% / 87.2% / 76.8%; FrontierSWE 2: 61.2% / 55.0% / 65.5% / 62.3% / 56.3%	https://deepmind.google/models/gemini/
S27↑	"Competitor numbers are taken from their published system cards and technical reports." (under ExploitGym and under SEC-bench Pro) / "AA Index v5.0 (with tools) results are sourced from the Artificial Analysis Intelligence Index."	https://deepmind.google/models/evals-methodology/gemini-4-carbon
S28↑	Page 5 "Results" of the PDF (image, read on 10/28/2026 at 18:12 UTC): same table as the Gemini page, ExploitGym "54.8%" for Gemini 4 Carbon, no timeout mentioned; only caption: "Methodology: deepmind.google/models/evals-methodology/gemini-4-carbon".	https://deepmind.google/models/evals-methodology/gemini-4-carbon