Gemini 4 Carbon is Google’s newest frontier model, announced on October 28, and almost nobody can use it yet. Google calls it “our strongest model with state-of-the-art cybersecurity and long horizon capabilities,” according to its launch post. Access is limited to a small group of security teams for now. Here is what Google claims, what the numbers do and do not show, and what to expect next.
What Gemini 4 Carbon is
Carbon arrives two weeks after Gemini 4 Argon, and it is an upgrade to that model, not the cheaper Flash-style release many people were waiting for. Ars Technica points out that Google presents Carbon as a new model, but for all outsiders know it could be a post-training improvement on Argon. Carbon edges out Argon by slim margins on every test Google published.
Google says the model is built for long, multi-step engineering work. Internally, its teams saw Carbon run for days on tasks like tracking down and patching subtle bugs across large codebases. That is a company claim from its own testing, not something outsiders have reproduced.
The Gemini 4 Carbon benchmark numbers
Google leads with security results, all reported without guardrails:
- SEC-bench Pro: 88.2% for finding real vulnerabilities
- ExploitGym: 54.8% for checking whether a flaw can be exploited
- CWE-bench: 71.0% for turning a finding into a working fix
- Artificial Analysis Intelligence Index v5.0: first place, with a score of 59
- WebDev Arena: up 89 Elo points to fourth place at 1768
Google adds two partner claims. Its Chrome team reports Carbon was more than 10 times better than another lab’s large frontier model at writing high-quality patches, and the cloud security company Wiz says Carbon leads on web penetration testing benchmarks.
Context matters here. Ars notes that Carbon beats GPT-6 Astra, Claude Opus 5.5 and Claude Fable 5.1 on almost every test Google shows, but every frontier model sits in the same neighbourhood, and the gaps are a few points. Our own Claude versus GPT-6 Astra comparison found the same pattern: the right pick depends on your task more than on a leaderboard.
Safety claims worth reading closely
Google spends as much space on behaviour as on capability. Its post says that, in internal testing:
- Cheating on Terminal-Bench 4.0 fell to 0.0% of successful runs, with attempted cheating at 0.4%.
- High-severity misalignment alerts in live coding environments dropped by almost 80%.
- Unsupported claims fell by about half compared with Argon.
- Overreach fell 26% and under-service fell 29%, so the model stays closer to the scope it was given.
- On the Gray Swan indirect prompt injection benchmark, Carbon resisted every attack, a 0.0% success rate.
The last one is the easiest to compare. Ars lists Argon at 0.7%, Opus 5.5 at 1% and GPT-6 Astra at 8.5% on the same test. Prompt injection is the main risk when an agent reads untrusted web pages or files, the kind of failure behind incidents like the agents that hacked Hugging Face. A score of zero on one benchmark is encouraging, but it is not a guarantee against attacks the benchmark did not include.
Who can use Gemini 4 Carbon, and what it costs
Right now, only a subset of cyber defenders can. Google says it will phase in more trusted partners through its Fairwind Program and is taking part in the US government’s voluntary process for pre-release model testing. It does not give a date for developers, businesses or consumers.
Argon offers a hint at the timeline. Ars reports it reached the Gemini app about two weeks after its announcement, but only for AI Pro ($20 a month) and AI Ultra (from $99) subscribers, and only AI Ultra in Antigravity and AI Studio. Ars guesses Carbon will follow the same path, but Google has not confirmed it.
Pricing is set at an introductory $2 per million input tokens and $10 per million output tokens, with cached input 95% cheaper. After the introductory period, that rises to $4 and $20. Argon’s discount ends November 30. Google has not said when Carbon’s ends, and declined to give Ars an end date. If you plan to build on it, budget for the higher price. Our note on tightening usage limits covers why that matters.
What to watch next
Three things will tell you whether Gemini 4 Carbon lives up to the launch post. First, independent testing once more people get access, since every figure above is Google’s own or from benchmarks Google chose to show. Second, the wide-release date and which subscription tiers get it. Third, whether the price holds after the introductory period.
For most people, nothing changes today. If you use Gemini daily, Argon and the existing models are what you can actually reach. If you work in security or run a software team, Carbon is worth watching, and worth testing against your own code before trusting a benchmark.
Sharing Is Caring