)
Last updated: October 29, 2026
What is Gemini 4 Carbon? It is Google's strongest model so far, announced on October 28, 2026 with a focus on cybersecurity and long-running coding work. Google released it first to a subset of cyber defenders, so most developers and enterprises cannot use it yet. This guide covers what Google and independent testers report, what it costs, and what its dual-use security risk means for teams that cannot touch it today.
TL;DR: Key Takeaways
- Google announced Gemini 4 Carbon on October 28, 2026 and started with a subset of cyber defenders, adding trusted partners through the Fairwind Program. It has not given a date for general access.
- Pricing is $2 per million input tokens and $10 per million output tokens during an introductory period, then $4 and $20. Cached input is 95% cheaper.
- Artificial Analysis ranks it first on its Intelligence Index v5 at 59, about nine points above Gemini 4 Argon. It trails Claude Opus 5.5 on the Coding Agent Index, 59 to 62.
- Google's cyber scores (88.2% on SEC-bench Pro, 54.8% on ExploitGym, 71.0% on CWE-bench) were run without guardrails and have not been independently replicated.
- The model is dual-use. For most enterprises the work now is governance: map its risks to the OWASP lists and put controls outside the model before access opens.
Gemini 4 Carbon at a Glance
Gemini 4 Carbon is a proprietary reasoning model from Google DeepMind that arrives about two weeks after Gemini 4 Argon. It scores higher than Argon on most reported tests, costs the same during the introductory period and is much harder to get. The table compares the two on the facts that matter for deployment.
| Item | Gemini 4 Carbon | Gemini 4 Argon |
|---|---|---|
| Announced | October 28, 2026 | Model card dated October 13, 2026 |
| Access | Selected cyber defenders, then trusted partners via Fairwind; no general date | Available to developers |
| Introductory price (input / output per 1M tokens) | $2 / $10 | $2 / $10 |
| Standard price (input / output per 1M tokens) | $4 / $20 | $4 / $20 |
| Context window | 1M tokens, as reported by Artificial Analysis and Vals | Up to 1M combined input and output, per its model card |
| Artificial Analysis Intelligence Index v5 | 59 (first of 52 models) | About 50 |
| Hallucination rate (AA-Omniscience) | 11% | 4% |
| Gray Swan indirect prompt injection, attack success | 0.0%, Google-reported | 0.7%, Google-reported |
| Inputs and outputs | Text, image, video and speech in; text out | Text, image, audio and video in; text out |
What Is Gemini 4 Carbon and Who Can Use It Today?
Gemini 4 Carbon is Google's strongest Gemini 4 model, built for cybersecurity defense and long-running agentic coding. Access is limited: Google began with a subset of cyber defenders and plans to add trusted partners through the Fairwind Program, with no date yet for developer, business or consumer access.
Where Carbon sits in the Gemini 4 line
Google positions Carbon as the follow-up to Argon, with gains in coding, agentic tasks, science, web development and multimodal understanding. It says the model has run internally for days on multi-step jobs such as root-causing and patching bugs across large codebases.
On security, Google lists vulnerability detection and validation, autonomous discovery of complex flaws, exploitability checks to prioritize fixes, and root-cause patching. The weights are closed, and the launch post gives no API model ID.
Who has access right now
The path in is the Fairwind Program. Its program page says access is prioritized for governments and national cyber authorities, critical infrastructure operators and core technology platforms, and that applicants apply through their Google Cloud account team. Google runs background checks and says it works with more than 650 partners.
The terms on that page are strict. Partners need phishing-resistant multi-factor authentication and user-level authentication. Access is limited to internal security, incident response or penetration testing teams, usage must be tracked, and access cannot be shared or resold. Authorized threat simulation, reverse engineering and malware analysis are allowed, and creating malware is not.
One caveat: as of October 29, 2026 that page describes Argon access and does not mention Carbon, so Carbon's terms may differ. Google also says it takes part in the U.S. government's voluntary pre-release testing.
)
Gemini 4 Carbon Pricing: What Does It Cost?
Google lists Gemini 4 Carbon at $2 per million input tokens and $10 per million output tokens as an introductory price, rising to $4 and $20 afterward. Cached input is 95% cheaper. Google gave no end date for the introductory rate, and most buyers cannot use the model yet, so treat these figures as planning inputs.
| Price component | Introductory (Google) | Standard |
|---|---|---|
| Input, per 1M tokens | $2 | $4 |
| Output, per 1M tokens | $10 | $20 |
| Cached input | 95% off the input price | $0.20 per 1M tokens (Artificial Analysis) |
Price per token is only half of the cost. Artificial Analysis also measures what a task costs at standard pricing, which captures how many tokens a model spends.
| Model | Cost per Intelligence Index task | Output tokens per task |
|---|---|---|
| Gemini 4 Carbon | $7.76 | 123k |
| Gemini 4 Argon | $7.68 | Not stated |
| Claude Opus 5.5 (max) | $10.04 | 173k |
| GPT-6 Astra (max) | $6.25 | Not stated |
By this measure Carbon costs about 23% less per task than Opus 5.5 and about 1.2 times what GPT-6 Astra costs. Artificial Analysis also calls Carbon very verbose, at 200 million output tokens for a full index run against a median of 64 million.
Gemini 4 Carbon Benchmarks: What Google Reports
Google reports that Gemini 4 Carbon scores 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on ExploitGym for exploitation and 71.0% on CWE-bench for patching. These are Google's own figures, and the company states that it ran its cybersecurity benchmarks without guardrails.
| Benchmark | What it measures | Gemini 4 Carbon (Google-reported) |
|---|---|---|
| SEC-bench Pro | Finding vulnerabilities | 88.2% |
| ExploitGym | Exploiting vulnerabilities | 54.8% |
| CWE-bench (Collinear) | Patching vulnerabilities | 71.0% |
| Terminal-Bench 4.0 | Successful cheating | 0.0% (attempts 0.4%) |
| Gray Swan indirect prompt injection | Attack success rate | 0.0% (Argon 0.7%) |
| WebDev Arena | Web development | Fourth place, +89 Elo |
Google adds internal comparisons with Argon: more than twice the secure-code success rate, about half the unsupported claims, overreach down 26% and almost 80% fewer high-severity misalignment alerts in internal coding. It also says the Chrome team found Carbon more than 10 times better at generating patches than another lab's large frontier model, and that Wiz reports it leads on web penetration testing benchmarks.
How to read the cyber numbers
Three conditions apply. First, guardrails were off, so a restricted deployment can score differently. Second, Jake Handy's review notes the ExploitGym headline used a 10-hour cap against 6 hours for Opus 5.5, and that at 6 hours Carbon scores 53.5%. Third, the Chrome comparison names no model and the Wiz claim comes without numbers.
Treat all of these as vendor claims until a third party reproduces them.
What Independent Evaluations Say About Gemini 4 Carbon
Independent testers place Gemini 4 Carbon first on the Artificial Analysis Intelligence Index v5 at 59, about nine points above Argon. It ranks second on the Vals Index and first on the Vals Finance Index, but trails Claude Opus 5.5 on coding agent tests, and its hallucination rate is higher than Argon's.
| Evaluation | Result | Source |
|---|---|---|
| Intelligence Index v5 | 59, first of 52 models | Artificial Analysis |
| Coding Agent Index | 59 with Antigravity CLI; Claude Code with Opus 5.5 scores 62 | Artificial Analysis |
| AA-Omniscience hallucination rate | 11% (Argon 4%) | Artificial Analysis |
| Vals Index | 70.36%, second of 29 (Opus 5.5 scores 70.18%) | Vals |
| Vals Finance Index | 66.35%, first of 33 | Vals |
| Legal Research Bench | 55.77%, first of 87 | Vals |
Two cautions apply. Artificial Analysis found Carbon answers more knowledge questions correctly than Argon but guesses more often when unsure. And its coding result was measured in one harness, the Antigravity CLI, so other setups are untested. Handy also reports that Carbon trails GPT-6 Astra and Opus 5.5 on FrontierSWE and Opus 5.5 on computer use.
Context Window and Output Limits
Artificial Analysis and Vals both list a 1M-token context window for Gemini 4 Carbon. Google's launch post does not state a context window or an output limit, so treat the 1M figure as third-party reporting until Google publishes a model card for Carbon.
Both sources list text, image, video and speech as inputs and text as output. Vals shows a maximum output of 1,048,576 tokens, which matches how Argon's model card describes a combined 1M input and output window.
Gemini 4 Carbon Security: What Enterprises Need to Know
Gemini 4 Carbon is a dual-use model: the ability that finds and patches vulnerabilities can also find and exploit them. That is why Google restricted access, and why most enterprises cannot use it yet. The work to do now is governance: map its risks to the OWASP lists and put controls outside the model before access opens.
Why Google restricted access
Google describes Carbon as strong across the defense lifecycle, from detection to patching. Its ExploitGym score measures exploitation, the offensive half of the work. Google ran its cyber benchmarks without guardrails and limits the model to vetted defenders under terms that require strong authentication, tracked usage and a ban on creating malware.
The closest published safety evidence is for Argon. Google's announcement links Argon's Safety and Security Report, and we found no separate Carbon system card as of October 29, 2026. That report says Google cannot rule out that the unmitigated Argon model reaches its cybersecurity critical capability level and that its safeguards bring the risk below it. It estimates that, without mitigations, an attacker could complete a severe historical cyberattack at 16.7 times lower cost on average. Google has not published equivalent figures for Carbon in the material linked from its announcement.
What Google says it built in
Google says Carbon uses the same layered stack as Argon: model training, real-time misuse defenses, prompt injection resilience and chain-of-thought monitoring. For Argon, Google's safety post describes smaller models that screen requests, activation probes that detect attack-related knowledge, and monitoring across reasoning steps that can cut an agent off mid-run.
For Carbon, Google reports 0.0% attack success on Gray Swan's indirect prompt injection benchmark, almost 80% fewer high-severity misalignment alerts in live internal coding, and behavior that pauses to ask rather than guess. All of this is self-reported. A 0.0% on one benchmark is not a guarantee against adaptive attackers working through your own tools and data.
How the risks map to OWASP
The table maps Carbon-specific facts to the OWASP Top 10 for LLM Applications 2026 and the OWASP Top 10 for Agentic Applications. The mapping is our analysis, not OWASP's or Google's.
| OWASP risk | How it shows up with Carbon | Control outside the model |
|---|---|---|
| LLM01 Prompt Injection, ASI01 Agent Goal Hijack | Carbon reads untrusted code, advisories and web pages as part of its work, and Google's 0.0% covers one indirect injection benchmark | Inspect inputs and tool results inline; test with your own injection cases |
| LLM03 Excessive Agency, ASI02 Tool Misuse, ASI03 Identity and Privilege Abuse | Built to run for days on multi-step tasks, so credentials and tool scopes accumulate | Task-scoped credentials, per-agent identity, tool allowlists, approval before exploit execution |
| LLM02 Sensitive Information Disclosure, LLM08 Hidden Context Exposure | A 1M-token window can hold source code, secrets and system prompts that long outputs may reveal | Data classification, redaction, output filtering, minimal context |
| LLM06 Unbounded Consumption | Artificial Analysis reports 200M output tokens for a full index run against a 64M median | Token budgets, rate limits, per-agent cost caps |
| LLM07 Misinformation, ASI09 Human-Agent Trust Exploitation | Hallucination rate of 11% against Argon's 4%; confident vulnerability reports and patches can mislead reviewers | Require reproducible evidence, test AI patches independently, keep human approval |
| LLM10 Improper Output Handling | Generated patches and proof-of-concept exploit code can be merged or run without validation | Sandboxed execution, CI gates, code review before merge |
| ASI10 Rogue Agents, ASI08 Cascading Failures | Google reports misalignment alerts in internal use, down by almost 80% but not to zero | Behavior baselines, circuit breakers, a tested kill switch |
What if you never get access?
Carbon matters even to teams that will not use it. Google's framing is defenders first, which gives vetted partners a head start but does not stop comparable capability from reaching others. We read this as a reason to tighten patch timelines, inventory the software you expose, and secure your own AI agents.
Govern before access opens
Do the model-agnostic work now, so that adopting Carbon later is a configuration change and not a new security project.
| Control | What to do before access opens | Why it still matters later |
|---|---|---|
| Inventory | Map every place Gemini models run, with owners, tools and credentials | You cannot restrict what you cannot see |
| One policy layer | Route Gemini, Claude and GPT traffic through a single gateway | Moving to Carbon keeps the same rules |
| Runtime inspection | Inspect prompts, tool calls and outputs, and block or redact violations | Model-side defenses are self-reported and can be bypassed |
| Least agency | No autonomous exploit execution; human approval for merges and active scans | Long-horizon agents accumulate permissions |
| Red teaming | Test with your own scenarios and rerun on every model version | Hallucination moved from 4% to 11% between two models released two weeks apart |
How NeuralTrust addresses this
This section makes no claim that NeuralTrust has access to Gemini 4 Carbon. The controls are model-agnostic and apply to whichever models you can reach today. Agent Gateway (TrustGate) enforces policy across agents, tools and model providers. Agent Runtime Security (TrustGuard) inspects prompts, tool calls and outputs. AI Red Teaming (TrustTest) lets you run your own injection and misuse tests before go-live, and Agent Posture Management (TrustLens) shows which agents and tools have access to what. NeuralTrust delivers them together as the Runtime Security Mesh.
Which Model Should You Choose?
Choose by access first. Most teams can only deploy Gemini 4 Argon, Claude Opus 5.5 or GPT-6 Astra today, while Gemini 4 Carbon suits vetted defenders in Fairwind. Build so that changing models is a configuration change, and compare models on your own tasks.
| Your situation | Practical choice | Why |
|---|---|---|
| Vetted cyber defender | Request Carbon through your Google Cloud account team | Fairwind is the only current path in |
| Need a Gemini model in production now | Gemini 4 Argon | Carbon has no general access |
| Coding agents and computer use | Test Claude Opus 5.5 on your tasks | Opus 5.5 scores 62 on the Coding Agent Index against Carbon's 59 |
| High-volume, cost-sensitive work | Compare GPT-6 Astra and Carbon on cost per task | $6.25 against $7.76 on Artificial Analysis |
| Several models in production | Put a gateway in front of all of them | Policy and failover stay constant when models change |
Conclusion
Gemini 4 Carbon is a strong model with a restricted audience: the headline scores are Google's and unreplicated, the independent numbers are good but not leading everywhere, and the cyber capability is the reason access is gated. For most teams the useful response is not to wait for Gemini 4 Carbon but to put governance in place now, with inventory, one policy layer, runtime inspection and your own red teaming, so that any model change stays safe.
Secure Gemini and Multi-Model AI Agents in Production with NeuralTrust
Run Gemini, Claude and GPT behind one policy layer, and test each model against your own threats before go-live. Agent Gateway (TrustGate) and Agent Runtime Security (TrustGuard) enforce and inspect at runtime, and AI Red Teaming (TrustTest) checks the result. Start free with the AI Gateway or book a demo.
)
Related Reading
- Gemini 4 Argon: Benchmarks, Pricing & Security (2026)
- Gemini 4 Carbon vs Argon
- OWASP Top 10 for LLM Applications 2026
- OWASP Top 10 for Agentic Applications 2026
FAQs about Gemini 4 Carbon
1. What is Gemini 4 Carbon?
Gemini 4 Carbon is Google DeepMind's strongest model, announced on October 28, 2026. It is aimed at cybersecurity defense and long-running agentic coding, with a reported 1M-token context window. Google released it first to a subset of cyber defenders, and it builds on Gemini 4 Argon, which launched two weeks earlier.
2. Is Gemini 4 Carbon available to the public?
Not yet. Google started with a subset of cyber defenders and will add trusted partners through the Fairwind Program. It says developers, businesses and consumers will get access as soon as possible, pending feedback and guardrail work, but it has given no date. Check Google's announcement for updates before planning a rollout.
3. How much does Gemini 4 Carbon cost?
Google lists an introductory price of $2 per million input tokens and $10 per million output tokens, with cached input 95% cheaper. The standard price afterward is $4 and $20. Google gave no end date for the introductory rate. Since access is restricted, most teams cannot buy it yet.
4. What is the context window of Gemini 4 Carbon?
Artificial Analysis and Vals list 1M tokens. Google's launch post does not state a context window or output limit, so treat 1M as third-party reporting until a Carbon model card appears. Argon's model card describes a combined 1M input and output window, and Vals shows a 1M maximum output for Carbon.
5. How is Gemini 4 Carbon different from Gemini 4 Argon?
Carbon scores 59 on the Artificial Analysis Intelligence Index against about 50 for Argon, and Google reports stronger cyber and prompt injection results. Both share the same introductory price. Carbon is harder to get, and its hallucination rate is 11% against Argon's 4%, which matters for work that needs verified answers.
6. Is Gemini 4 Carbon safe for enterprise use?
Google reports strong safeguards, including 0.0% attack success on one indirect prompt injection benchmark, but the figures are self-reported and its cyber benchmarks ran without guardrails. Most enterprises cannot use Carbon yet anyway. Prepare with inventory, a policy layer, runtime inspection and your own red teaming, and keep human approval for risky actions.
7. How do I get access to Gemini 4 Carbon?
Apply to the Fairwind Program through your Google Cloud account team. Google prioritizes governments, critical infrastructure operators and core technology platforms, runs background checks, and requires strong authentication and tracked usage. The program page currently describes Argon access, so confirm Carbon terms directly with Google.
8. Is Gemini 4 Carbon better than Claude Opus 5.5 or GPT-6 Astra?
It depends on the task. Artificial Analysis ranks Carbon first overall at 59, but Claude Code with Opus 5.5 scores 62 on its Coding Agent Index, and Carbon trails Opus 5.5 and GPT-6 Astra on some coding tests. Carbon's cyber scores come from Google alone. Compare models on your own workloads.
About the Author
Roger Howroyd is Head of Global SEO and AI at NeuralTrust, where he leads the company's search strategy across SEO, AEO, GEO, and LLM optimization. He specializes in AI-powered search, content strategy, and SEM. Connect on LinkedIn.
NeuralTrust is the leading platform for securing and scaling AI agents. Named a Pioneer in the Gartner Emerging Market Quadrant for AI Application Security 2026, recognized across four Gartner Hype Cycle reports in 2026, and featured in the Gartner Market Guide for Guardian Agents 2026, the Gartner Market Guide for AI Gateways 2025 and the KuppingerCole Leadership Compass for Generative AI Defense 2025. Headquartered in Barcelona with offices in London and New York. ISO 27001 certified.
Sources
- Google, Gemini 4 Carbon: our next frontier model, October 28, 2026.
- Artificial Analysis, Gemini 4 Carbon is the new #1 on the Artificial Analysis Intelligence Index v5, accessed October 29, 2026.
- Artificial Analysis, Gemini 4 Carbon (high) model page, accessed October 29, 2026.
- Vals AI, Gemini 4 Carbon benchmarks, cost and capabilities, accessed October 29, 2026.
- Google DeepMind, Fairwind Program, accessed October 29, 2026.
- Google DeepMind, Gemini 4 Argon Safety and Security Report, October 2026.
- Google, Developing Gemini 4 Argon responsibly and safely, accessed October 29, 2026.
- Jake Handy, Handy AI, Model Drop: Gemini 4 Carbon, accessed October 29, 2026.
- OWASP GenAI Security Project, OWASP Top 10 for LLM Applications 2026, August 2026.
- OWASP GenAI Security Project, OWASP Top 10 for Agentic Applications for 2026, December 9, 2025.
)
)
)
)