Gemini 4 Carbon: Benchmarks, Price and When You Can Use It

Gemini 4 Carbon Is Here: Google’s New #1 AI Model Goes to Cyber Defenders First

Google says Gemini 4 Carbon is its strongest model yet and tops the Artificial Analysis Intelligence Index. Here’s what it does, where it trails rivals, and when you can use it.

[email protected]

Oct 29, 2026, 3:38 AM6 min read

Indigo illustration of a carbon-style hexagonal lattice around a security shield with a check mark, beside code showing a vulnerability found and patched

Two weeks ago Google finally put Gemini 4 Argon in people’s hands. On Wednesday it announced the model that replaces it at the top of the stack. Gemini 4 Carbon is, in Google’s words, its “strongest model”, with “state-of-the-art cybersecurity and long horizon capabilities.” It also edges out Anthropic and OpenAI on one of the most-watched independent leaderboards. There’s a catch, though: almost nobody can use it yet.

The launch was the biggest AI story of the past day. A post from Google CEO Sundar Pichai passed 3.8 million views on X in roughly 10 hours, and the Hacker News thread drew more than 800 points and nearly 700 comments. X counted close to 12,000 posts mentioning Gemini 4 Carbon on 28 October (UTC), up from about 160 the day before. Here’s what Google announced, what the benchmarks do and don’t show, and when you might actually get it.

What Google announced

Koray Kavukcuoglu, Google DeepMind’s SVP and Google’s chief AI architect, introduced Carbon in a blog post on 28 October. He described it as building on Argon and as evidence of “the pace at which we’re pushing the frontier forward.” Pichai, on X, put it more bluntly: “I did say we’d be releasing our models periodically.”

The pace is real. Google announced Argon on 30 September, rolled it out first to cybersecurity partners, then opened it to paid API developers and Google AI Pro and Ultra subscribers on 13 October. Carbon arrived 15 days later. Google pitches it at two kinds of work: long software engineering jobs and cyber defence.

On the first, Google says Carbon is “built for sustained agentic workflows” and that its own teams have watched it “run for days to persist through dead ends” while root-causing and patching subtle bugs in large codebases and low-level systems. It also claims a jump of 89 Elo points on WebDev Arena, landing at #4 with a score of 1768.

The cybersecurity pitch

Security is where Google makes its biggest claims. It says Carbon covers the whole defence cycle (finding a flaw, checking whether it can really be exploited, then fixing it) and reports leading scores on three public tests, run without its usual guardrails:

Finding bugs: 88.2% on SEC-bench Pro, which measures discovering real vulnerabilities in real software.
Proving they’re exploitable: 54.8% on ExploitGym, up from 42.0% for Argon.
Patching them: 71.0% on Collinear’s CWE-bench, up from Argon’s 68.0%.

Google adds a few internal anecdotes. Carbon more than doubled Argon’s success rate at generating secure code on internal benchmarks, according to the company, and Google’s Chrome team reported it performed “more than 10X better than another lab’s large frontier model” when generating high-quality patches. Google doesn’t name that lab. Wiz, which Google calls its leading cloud security platform, also sees Carbon leading its benchmarks for web penetration testing.

Late-night security desk: a vulnerability triage screen shows an AI agent has found and validated a critical heap overflow and proposed a patch awaiting approval, with an alert feed on a second monitor — Illustration

That’s exactly why the rollout is so cautious. A model that’s good at finding and exploiting holes is useful to defenders and attackers alike, and we’ve already seen what happens when an AI hacking agent gets pointed at real systems.

Number one, but only just

Google’s headline claim checks out. Artificial Analysis, the independent benchmarking firm that relaunched its Intelligence Index as version 5 on 27 October, now ranks Carbon first with a score of 59. Claude Opus 5.5 is on 58 and OpenAI’s GPT-6 Astra on 57. Argon scored 50, so Carbon is a nine-point jump in about a fortnight.

Look closer and the lead is narrow. Artificial Analysis says Carbon is #1 on four of the index’s nine evaluations, mostly complex reasoning, knowledge and science, but “it is not leading in all these areas.” On its Coding Agent Index, Carbon scores 59, three points behind Claude Code running Opus 5.5 (62). Even Google’s own comparison table shows rivals ahead in places: GPT-6 Astra beats Carbon on the FrontierSWE 2 coding test (65.5% to 61.2%), and Claude Opus 5.5 leads on the OSWorld-2.1 computer-use test (87.2% to 81.5%).

There’s a trade-off on accuracy too. Artificial Analysis found Carbon answers more of its knowledge questions correctly than Argon did (58%, up 10 points), but its hallucination rate rose from 4% to 11%. That’s still the second-lowest of any model it has tested; Opus 5.5 and GPT-6 Astra both sit at 50%.

Ars Technica’s Ryan Whitwam noted that Google presents Carbon as a new model, but “for all we know, it could be a post-training upgrade of Argon,” and that every frontier model is now within a few points of the others. If you’ve followed our coverage of Kimi K3.1 Pro nearly catching Claude Opus 5.5, that pattern will be familiar: the top of the leaderboard keeps changing hands by a point or two.

Infographic comparing Gemini 4 Carbon with Gemini 4 Argon, GPT-6 Astra and Claude Opus 5.5 on Google-reported benchmarks, a timeline from Argon's 30 September announcement to Carbon's 28 October debut, and key facts on price, Fairwind partners and prompt-injection results — Gemini 4 Carbon at a glance, using figures reported by Google and Artificial Analysis. Graphic: powerhumans

What Google says it fixed on safety

Google spends a lot of the announcement on behaviour, not just raw skill. These are all the company’s own measurements:

Less cheating. Successful cheating on Terminal-Bench 4.0 fell to 0.0%, and attempts to cheat dropped to 0.4%. In live coding with Google’s own teams, high-severity misalignment alerts fell by almost 80%.
Fewer made-up claims. Carbon cuts unsupported claims by about half compared with Argon, Google says, and flags caveats or missing steps instead of papering over them.
Staying in scope. Overreach (doing more than asked) fell 26%, and under-service (doing less) fell 29%.
Prompt injection. On Gray Swan’s indirect prompt-injection benchmark, Carbon resisted every attack attempt, a 0.0% success rate, versus 0.7% for Argon. Google’s chart, as reported by Ars, puts Opus 5.5 at 1% and GPT-6 Astra at 8.5%.

Those numbers matter most for anyone planning to let an agent work unattended for hours or days. As we saw with GPT-6.1 Terra, OpenAI’s computer-using model, injection attacks hidden in web pages and documents are the main risk once an AI starts acting on your behalf.

So when can you use it?

Not yet, unless you’re a vetted security team. Google says that, starting this week, Carbon goes to “a subset of cyber defenders,” with access widening in phases through its Fairwind Program. Fairwind already has more than 650 partners, according to its program page, with priority for governments and partners “most critical to societal resilience.” Google runs background checks on applicants, partners must use phishing-resistant multi-factor authentication, and only internal security, incident response and penetration testing teams can get access. Google is also taking part in the US government’s voluntary process for testing models before release.

Laptop showing an AI workspace model picker where the newest frontier model is locked for trusted partners only, with a 'Not available on your plan yet' waitlist dialog and a long-running agent log — Illustration

For developers, businesses and consumers, Google promises Carbon “as soon as possible” but gives no date. One internet joke sums up the mood: “google released gemini 4 carbon but didn’t release gemini 4 carbon.” Argon offers the best clue. It took 13 days to go from its cyber-defender debut to the Gemini API, the Gemini app and AI Mode in Search for paying subscribers. Ars suggests Carbon could follow a similar path, likely reaching AI Ultra subscribers and API developers first, but Google hasn’t confirmed that.

When it does arrive, Carbon will cost the same as Argon at launch: an introductory $2 per million input tokens and $10 per million output tokens, with cached input 95% cheaper. After the introductory period, the price doubles to $4 and $20. Argon’s discount ends on 30 November; Google hasn’t given an end date for Carbon’s.

Why it matters

For most people, Carbon changes nothing today. What it signals is a new pattern. Google now treats its most capable models as something to hand first to defenders before anyone else, because the same skills that patch a bug can exploit one. It’s also shipping frontier upgrades every couple of weeks, after what Ars calls a break from frontier releases earlier this year, alongside launches like its Genie 4 world model earlier this week.

If you build with Gemini, the practical move is to keep working on Argon, which is available now, and expect a switch to Carbon at the same introductory price whenever it opens up. If you run security for a large organisation or critical service, Fairwind is the way in. Everyone else gets to watch the leaderboard change hands again.

Related, 29 October: leaderboards aren’t the only race. GitHub now lets a router choose the model for you; see how GitHub Copilot Fusion works and what it costs.

Sources

AI safety Explainer