Gemini 4 Carbon launch — Google tops an independent AI index, then gives the model to cyber defenders first
Google DeepMind announced Gemini 4 Carbon on October 28, 2026 (US time), two weeks after Gemini 4 Argon. It is a frontier model tuned for cyber defense and multi-day engineering work. Google reports 88.2 percent on SEC-bench Pro for finding vulnerabilities and 71.0 percent on CWE-bench for patching, and Artificial Analysis puts it first on its new Intelligence Index v5 with 59. It is not generally available: a subset of cyber defenders gets it first, then vetted partners in the Fairwind Program, while Google joins voluntary US pre-release testing. Introductory pricing is $2 per million input tokens and $10 per million output
The three lines
- Launch — October 28 (US time), two weeks after Argon; Google calls it its strongest model, built for security and long-horizon engineering
- Scores — SEC-bench Pro 88.2%, ExploitGym 54.8%, CWE-bench 71.0%; #1 on Artificial Analysis Index v5 at 59
- Access — select defenders first, then Fairwind partners, general release undated; $2/$10 per million tokens to start
Key questions
- how to access gemini 4 carbon
- **Most people cannot yet. It went to a subset of cyber defenders first.** | Stage | Who | When | |---|---|---| | 1 | A subset of cyber defenders | From the week of October 28 | | 2 | Vetted partners in the Fairwind Program | Gradual expansion | | 3 | Developers, businesses, consumers | No date (Google: as soon as possible) | | How to apply | Through a Google Cloud account team | Per the Fairwind page |
- gemini 4 carbon benchmarks
- **Google claims records on three security tests, and it leads an independent index.** | Metric | Carbon | Note | |---|---|---| | SEC-bench Pro (find bugs) | 88.2% | No guardrails | | ExploitGym (exploit) | 54.8% | No guardrails | | CWE-bench (patch root cause) | 71.0% | By Collinear | | Artificial Analysis Index v5 | 59 | #1 | | Gray Swan indirect prompt injection success | 0.0% | Argon 0.7% |
- gemini 4 carbon pricing
- **$2 input and $10 output per million tokens at launch; $4 and $20 at list price.** | Model | Input | Output | Note | |---|---|---|---| | Gemini 4 Carbon (intro) | $2 | $10 | End date not announced; cached input 95% off | | Gemini 4 Carbon (list) | $4 | $20 | — | | Gemini 4 Argon | $2 → $4 | $10 → $20 | Discount through Nov 30 | | Claude Opus 5.5 | $4 | $20 | — | | GPT-6 Astra | $10 | $50 | Standard mode |
Google has released what it calls its strongest model — and most people cannot use it yet. Google DeepMind announced Gemini 4 Carbon on October 28, 2026 (US time), two weeks after Gemini 4 Argon arrived on October 13. Google pitches Carbon as state of the art in cybersecurity and in long-horizon engineering that can run for days. The same day, independent evaluator Artificial Analysis placed it first, with a score of 59, on the newly revised version 5 of its Intelligence Index.
The rollout is unusual for a flagship. Carbon went first to a subset of cyber defenders, and will widen to trusted partners in Google's defender-only Fairwind Program. Developers, businesses and consumers were promised access "as soon as possible", with no date. The reason is the dual-use problem: a model that is very good at finding software flaws is also very good at attacking them.
1. What Google released
| Item | Detail |
|---|---|
| Announced | October 28, 2026 (US time), Google DeepMind |
| Position | Successor to Gemini 4 Argon (Oct 13); Google calls it its strongest model |
| Focus | Cyber defense (find, validate, patch vulnerabilities); long-running agentic coding and engineering |
| Context window | 1 million tokens |
| Input / output | Text, image, video, speech / text |
| Introductory price | $2 input, $10 output per million tokens (same as Argon launch price) |
| List price | $4 input, $20 output; cached input 95% off |
| Access | Select defenders → Fairwind partners → general release (no date) |
| Government testing | Participating in the US government voluntary pre-release testing process |
Google says internal teams have watched Carbon work for days, persisting through dead ends on multi-step engineering problems such as root-causing and patching subtle bugs across large codebases and low-level systems. Argon was marketed on an 11-hour overnight coding run; Carbon stretches the unit of work to days.
2. Security results — find, exploit, fix
Google split security into three stages and published outside benchmark scores for each. All three were run with guardrails switched off.
| Stage | Benchmark | Carbon | Google framing |
|---|---|---|---|
| Find | SEC-bench Pro | 88.2% | Vulnerability discovery, state of the art |
| Exploit | ExploitGym | 54.8% | Writing working exploits, new state of the art |
| Fix | CWE-bench (Collinear) | 71.0% | Patching root causes |
| Secure code | Google internal tests | More than 2x Argon success rate | Internal |
| Real patches | Chrome team use | More than 10x the high-quality patches of another lab model | Rival not named |
The gap between 88.2% for finding and 54.8% for exploiting is telling. Spotting a flaw is much easier than producing attack code that actually works — and as exploit scores climb, so does the risk of an open release. Leading with the patching benchmark lets Google stress the defensive use. Security firm Wiz says Carbon leads its web penetration-testing benchmarks.
Google also published safety metrics.
| Metric | Argon | Carbon |
|---|---|---|
| Gray Swan indirect prompt injection success | 0.7% | 0.0% |
| Terminal-Bench 4.0 successful cheating | — | 0.0% (attempts 0.4%) |
| Unsupported claims | Baseline | Roughly halved |
| Overreach (doing things it was not asked to) | Baseline | −26% |
| Under-service (doing less than asked) | Baseline | −29% |
| High-severity misalignment alerts in internal coding | Baseline | Down almost 80% |
All are Google measurements. A model that works alone for long stretches has more chances to fabricate evidence or take unapproved actions, which is why Google stresses that Carbon was trained to ask rather than guess, and to list what is still needed instead of faking a blocked step.
3. Number one on the independent index — on a new index
| Artificial Analysis metric | Carbon | Comparison |
|---|---|---|
| Intelligence Index v5 | 59, #1 | 9 points above Argon |
| Coding Agent Index | 59 | Claude Code with Opus 5.5 leads at 62 |
| Terminal-Bench 4.0 | 64% | 2nd |
| Cost per index run | $7.76 | Opus 5.5 $10.04; GPT-6 Astra $6.25 |
| Output tokens per task | 123k | 29% fewer than Opus 5.5 |
| Hallucination rate (AA-Omniscience) | 11% | Up from Argon at 4% |
Artificial Analysis switched to version 5 of its index a day before Carbon launched. For the first time most of it is built on private test sets, and it says scores are not directly comparable with earlier versions. The Argon score of 53 and Opus 5.5 score of 58 in our earlier Argon coverage were on the old index. One outlet reported v5 scores of 58 for Opus 5.5 and 57 for GPT-6 Astra, which would make Carbon a one-point leader.
Anthropic still leads on coding agents; Artificial Analysis noted Google has historically lagged there. The rise in hallucination rate is also worth watching: accuracy improved by 10 points, but so did the share of confident wrong answers.
4. Against rival security models
In three months all three leading US labs released top-tier security models, and all three chose the same path: vetted defenders first, the public later or never.
| Model | Lab | Released | General API price (per M tokens) | Access to top cyber capability |
|---|---|---|---|---|
| Gemini 4 Carbon | Oct 28 | $2/$10 → $4/$20 (not yet general) | Select defenders → Fairwind | |
| Gemini 4 Argon | Oct 13 | $2/$10 (to Nov 30) → $4/$20 | Guardrail-relaxed version in Fairwind | |
| GPT-6 Astra | OpenAI | Sep 3 | $10/$50 | Daybreak (Blue and Red tiers) |
| Claude Mythos 5.1 | Anthropic | Early Sep | Not generally available | Cyber Verification Program, 3 tiers |
| Claude Opus 5.5 | Anthropic | — | $4/$20 | Fewer restrictions inside the Cyber Verification Program |
OpenAI rated Astra the first model to hit "Critical" cyber capability under its own framework. Anthropic opened Mythos 5.1 to all three tiers of its Cyber Verification Program on October 6. On September 2 all three labs announced security models and access limits on the same day.
The difference is ordering. Astra shipped to the general API with only its top cyber capabilities locked away. Carbon went as a whole model to defenders first. We explain how this kind of gated release works, and where it falls short, in our explainer on trusted access.
5. Who gets into Fairwind
| Item | Detail (Google DeepMind Fairwind page) |
|---|---|
| Purpose | Early access to frontier models for vetted defenders |
| Priority | Governments and national cyber authorities; healthcare, telecom, energy and financial infrastructure operators; core tech platforms |
| Others | Academic labs doing defensive benchmarking may apply |
| Vetting | Ethical track record, background checks on security history |
| Partners | More than 650 worldwide |
| Allowed | Authorized threat simulation, reverse engineering, malware analysis |
| Banned | Creating malware; sharing or reselling access |
| Conditions | User-level authentication, phishing-resistant MFA, use limited to internal security, incident response or pen-test teams, employee usage tracked |
| How to apply | Through a Google Cloud account team |
The page is still written around Argon. It does not say when or how widely Carbon will reach partners. Participation by organizations in South Korea, where this site is based, has not been disclosed.
6. What remains and what is unconfirmed
- General release date: Google said only "as soon as possible". Reuters reported that Google is still testing safeguards.
- End of the launch discount: Argon has a November 30 cutoff; Carbon has none announced.
- Independent checks on security scores: The three security benchmarks are Google figures, and they were run without guardrails, so they do not describe the model a typical user would receive.
- Government testing: Google did not name the agency or share results. Google DeepMind signed a pre-deployment testing agreement with the US Center for AI Standards and Innovation (CAISI) in May 2026.
- The Chrome 10x comparison: The rival model was not named.
Sources
- Google blog — Gemini 4 Carbon: our next frontier model (2026-10-28)
- Artificial Analysis — Gemini 4 Carbon is the new #1 (2026-10-28)
- Khaleej Times (Reuters) — Google launches Gemini 4 Carbon AI model with cybersecurity focus (2026-10-28)
- The Express Tribune (Anadolu) — US tech giant Google unveils Gemini 4 Carbon AI model (2026-10-29)
- TestingCatalog — Google unveils Gemini 4 Carbon for cyber defenders (2026-10-28)
- Constellation Research — Google rolls out Gemini 4 Carbon (2026-10-28)
- Google DeepMind — Fairwind Program
- MLex — US CAISI enters pre-deployment agreements with Google DeepMind, Microsoft, xAI (2026-05-05)