Gemini 4 Carbon: Why Google's New AI Goes to Defenders First

Google has released a second Gemini 4 model, and this one was built for security work first. Gemini 4 Carbon, announced on October 28, 2026, is tuned to find software vulnerabilities, write safer code and resist the tricks attackers use against AI agents. It arrived about two weeks after Gemini 4 Argon reached developers.

The catch: most people cannot use it yet. Google is handing Carbon to a small group of cyber defenders first and widening access slowly. Several API-reseller blogs ranking for the name describe it as a leak or an internal build. It is neither. Google announced it on its official blog, with benchmarks and prices.

By the end of this piece you will know what Carbon is, how it differs from Argon, what the security scores actually measure, when you might get access and what it will cost.

What is Gemini 4 Carbon?

Carbon is a Gemini 4 model aimed at defensive security and safe coding. Koray Kavukcuoglu, SVP of Google DeepMind and Google's Chief AI Architect, introduced it. Think of Argon as the general model for developers and Carbon as a sibling trained to be a better security engineer and a more careful agent.

It is not a narrow tool, though. According to Google's announcement, Carbon ranks first on the Artificial Analysis Intelligence Index v5.0 with a score of 59, a broad measure of general capability. It also gained 89 Elo points on WebDev Arena, reaching fourth place with a rating of 1768. So it is a strong all-round model that happens to be pointed at security first.

A model that is very good at finding and exploiting bugs is useful to defenders and attackers alike, so the staged rollout is worth understanding. Google is choosing who gets it first.

The Gemini 4 Carbon benchmark scores, in plain English

Google published a long list of numbers. They fall into three groups: finding bugs, fixing them, and behaving safely while working.

Finding and exploiting vulnerabilities

• SEC-bench Pro: 88.2%. This test checks whether a model can find real vulnerabilities in code. Google calls the score state-of-the-art.
• ExploitGym: 54.8%. This measures whether the model can turn a bug into a working exploit, which is how security teams prove a flaw is real and urgent. Also a new state-of-the-art, per Google.

Fixing what it finds

• CWE-bench: 71.0%. CWE is the standard catalogue of software weakness types, and this benchmark tests patching them.
• Secure code generation: on Google's internal benchmarks, Carbon's success rate is more than 2x higher than Argon's.
• Chrome's verdict: the Chrome team reported more than 10x better patch quality than another lab's large frontier model. Google does not name that lab.

Behaving safely

This group matters most if you plan to let an AI agent work on your code or inbox.

• Gray Swan prompt injection: 0.0% attack success rate, versus 0.7% for Argon. Prompt injection is when hidden text in a web page, document or email tells the AI to do something its user never asked for.
• Terminal-Bench 4.0 cheating: successful cheating fell to 0.0% and cheating attempts to 0.4%. "Cheating" here means gaming a task, for example making tests pass without fixing the real problem.
• Misalignment alerts: high-severity alerts in live coding dropped by almost 80%.
• Honesty and judgement: unsupported claims were cut about 2x, overreach (doing more than asked) fell 26%, and under-service (doing less than asked) fell 29%.

One caveat: these are Google's own reported results, and several, like the secure-code and patch-quality claims, come from internal tests. Independent testers will need time with the model before anyone can confirm them.

Gemini 4 Carbon vs Gemini 4 Argon: what actually changed?

Both belong to the same Gemini 4 generation. The difference is focus and availability.

Argon is the one you can build with today. Its Gemini API model page lists the model ID gemini-4-argon, a context window of 1,048,576 tokens and 65,536 default max output tokens, rising to 1,048,576 with long decode. In plain terms, Argon can read an enormous codebase or document set in one go.

Google has not published equivalent context-window specs for Carbon in the material covered here, so treat any reseller table that lists them as unconfirmed.

If you are choosing today, the answer is easy: Gemini 4 Argon is what you can actually call. Carbon matters when your work involves security reviews, patching, or agents that read untrusted content.

When is Gemini 4 Carbon released, and who can use it?

The Carbon release date depends on who you are. Google's rollout runs in three stages:

1. Now: from the week of the October 28 announcement, a subset of cyber defenders.
2. Next: trusted partners, added gradually through what Google calls the Fairwind Program.
3. Later: broader availability for developers, businesses and consumers, which Google describes only as "coming soon." There is no date.

So if you searched for a Gemini 4 release date expecting a public switch-on, the honest answer for Carbon is: not yet, and Google has not said when. Argon, by contrast, has been in developers' hands since mid-October.

This staged approach is the story's real tension. The same skills that make Carbon good at spotting a flaw in a browser could help someone attack that browser. Google's stated approach is to give defenders access first and widen it gradually.

How much does Gemini 4 Carbon cost?

Google has already set prices, which is a sign the wider launch is planned rather than hypothetical. Per the pricing in Google's Carbon announcement:

Cached input, meaning text the model has already seen and you send again, gets a 95% discount. That matters for security work, where you often feed the same large codebase to the model over and over.

The key detail: prices double once the introductory window ends, and Google has not said how long that window lasts. If you are budgeting a project, plan around the higher rate. For a wider view of where model prices are heading, see our breakdown of why LLM API prices fell up to 80%.

Who wins, who loses, and what it means for you

Security teams are the clear early winners. If the reported numbers hold up in real codebases, a model that finds bugs at 88.2% on SEC-bench Pro and patches them well could shorten the gap between a flaw existing and a fix shipping.

Developers building AI agents should watch the safety numbers more than the hacking ones. A 0.0% prompt-injection success rate on Gray Swan, if it survives outside testing, removes one of the biggest worries about letting an agent read email or browse the web.

Everyone else may benefit indirectly. Google says its Chrome team already tested Carbon on patch quality, so browser fixes are one place the gains could show up.

The losers, for now, are developers who want Carbon today and cannot get it, plus anyone relying on reseller blogs that promise access Google itself is not yet offering. The interest is real: the announcement reached 766 points on the Hacker News front page the day after launch.

What to watch next

• A date for broad access. "Coming soon" is the most important missing detail.
• The end of introductory pricing. Rates double after it, so its length shapes real costs.
• Independent benchmarks. Outside testers rerunning SEC-bench Pro and the prompt-injection tests will show whether Google's numbers travel.
• Fairwind Program partners. Who joins will hint at where Carbon is used first.

Google DeepMind is shipping fast across its lineup, from Gemini to world models like Genie 4. Carbon shows that safety results, not just raw capability, are now part of how Google pitches a model.