Gemini 4 Carbon: Benchmarks, Access, Pricing and Risks

Google introduced Gemini 4 Carbon on October 28, 2026 as a frontier model aimed at long-running software-engineering work and cybersecurity defense. The headline is not simply that a new Gemini model exists. Carbon is being rolled out cautiously to selected defenders first, while Google continues pre-release testing and guardrail work before broader developer, business and consumer access.

That limited release matters. Carbon is not a model most Gemini users can select today, and Google has not published a general availability date. The announcement is best read as a capability and pricing preview: strong benchmark claims, a focus on vulnerability discovery and patching, and an introductory API price that is scheduled to rise later.

Gemini 4 Carbon at a glance

Announced: October 28, 2026.
Initial access: selected cyber defenders and trusted partners through Google’s Fairwind Program.
Broader rollout: planned for developers, businesses and consumers, with no firm public date.
Introductory price: $2 per million input tokens and $10 per million output tokens.
Later price: Google says $4 per million input tokens and $20 per million output tokens after the introductory period.
Primary focus: long-horizon coding, agentic engineering and cybersecurity defense.

Google also lists cached input tokens at 95% below the introductory input rate. That can lower the cost of workloads that repeatedly reuse a large codebase or reference corpus, but actual spending will depend on context size, tool calls, retry behavior and how long an agent remains active.

What Carbon is built to do

Carbon is designed for work that cannot be completed reliably in one short response. Google says internal teams have used it on engineering jobs that run for days, including tracing subtle bugs through large repositories, testing hypotheses, and producing patches after earlier approaches fail.

The useful distinction is persistence rather than simple prompt length. A long-horizon system needs to preserve goals, inspect evidence, recover from dead ends and avoid changing unrelated code. Carbon’s announced improvements target that chain of work: coding quality, multimodal understanding, computer use, agentic planning and the ability to operate across very large contexts.

Cybersecurity is the defining angle

Google positions Carbon across three defensive stages. First, it searches for real vulnerabilities. Second, it checks whether a suspected flaw can actually be exploited so teams can prioritize risk. Third, it attempts to repair the underlying cause rather than merely describing the issue.

The company reports an 88.2% score on SEC-bench Pro for vulnerability discovery, 54.8% on ExploitGym for exploitation, and 71.0% on CWE-bench for patching. Google also says Carbon more than doubled the success rate of secure-code generation compared with Gemini 4 Argon in internal testing.

Those figures are meaningful signals, but they are not a warranty. Benchmark environments constrain tools, targets and evaluation criteria. Real organizations add proprietary code, incomplete documentation, permissions, production dependencies and legal limits. Security teams should treat Carbon as an assistant whose findings need reproduction, review and controlled remediation.

The benchmark claims need context

Google says Carbon ranks first on version 5.0 of the Artificial Analysis Intelligence Index with a score of 59. On Google DeepMind’s comparison table, it also posts 65.2% on Terminal-Bench 4.0, 61.2% on FrontierSWE 2 and 81.5% on the listed OSWorld 2.1 offline subset.

Different benchmarks test different skills, and a high aggregate rank does not mean one model leads every task. Carbon’s strongest public case is the combination of competitive general performance with a concentrated jump in cyber-defense evaluations. Buyers should compare the model against their own repository, languages, deployment stack and incident-response process before assuming the benchmark order will transfer.

Safety claims are part of the rollout

Google says Carbon reduced unsupported claims by about half compared with Argon in its internal testing and cut high-severity misalignment alerts by almost 80% in live coding environments. It also reports a 0.0% attack success rate on the evaluated Gray Swan indirect prompt-injection benchmark.

A zero score on one test should not be read as immunity. Prompt-injection defenses can change when an agent connects to email, tickets, browsers, code hosts or internal documents. Least-privilege credentials, isolated environments, approval gates and audit logs remain necessary even when a model performs well in controlled evaluations.

Who can use Gemini 4 Carbon now

Carbon’s first users are selected cybersecurity defenders and trusted partners. Google says it is participating in the U.S. government’s voluntary pre-release testing process and will expand access gradually through the Fairwind Program while collecting feedback.

Regular Gemini app users, Google AI Pro or Ultra subscribers, and general API developers should not assume Carbon is available merely because the model has been announced. Gemini 4 Argon remains the broadly referenced Gemini 4 option in Google’s current consumer and developer surfaces, while Carbon is described as coming later.

Organizations interested in early access should use Google’s official program pages rather than third-party downloads, unofficial endpoints or model files. A fake “Carbon access” page could be especially dangerous because the target audience is likely to grant code, cloud or security-tool permissions.

How the pricing could affect real projects

At the introductory rate, a workload consuming one million input tokens and one million output tokens would carry a published model charge of $12 before discounts, platform fees or other services. After the introductory period, the same token mix would be $24 at Google’s stated future rates.

That simplified example can understate an agentic task. A multi-day workflow may repeatedly inspect files, generate tests, call tools, revise patches and retain a large context. Teams should measure the total run rather than comparing only the price per request.

Set a budget and maximum run time before starting an autonomous task.
Limit the repository, branches and cloud resources the agent can reach.
Require human approval before merging code or changing production systems.
Log prompts, tool calls, retrieved files, patches and test results.
Reproduce every security finding in an isolated environment.

What developers and security teams should prepare

The most valuable preparation is not writing a longer prompt. It is making the environment auditable. Repositories need clear test commands, dependency locks, ownership rules and a defined path from a suspected issue to a reviewed patch.

For vulnerability work, teams should separate detection from exploitation and remediation. A model that finds a suspicious pattern should not automatically receive broad permission to exploit a live system. Use replicas or purpose-built test environments, record the evidence and route high-risk actions through authorized staff.

A classic reference such as Hacking: The Art of Exploitation, 2nd Edition by Jon Erickson can help readers understand the low-level concepts behind memory errors, networking and exploit development. Compare the book on Amazon before ordering, and verify the edition, seller, format and current price.

Affiliate disclosure: ReaderSpice may earn a commission from qualifying Amazon purchases made through the link above, at no additional cost to you.

What regular Gemini users should know

Carbon’s announcement does not replace the Gemini model already selected in a user’s account. It also does not guarantee that every benchmarked capability will arrive unchanged in the consumer app. Google may apply different tools, limits, safety controls and context windows across Gemini, Google AI Studio, enterprise products and the API.

The practical takeaway is to wait for the official availability notice and model documentation. When Carbon reaches broader access, compare its permissions, pricing and data controls with the task at hand. For coding help, begin with a disposable branch and tests. For security analysis, keep sensitive systems out of reach until the workflow has been validated.

The bottom line

Gemini 4 Carbon is a notable model announcement because Google is pairing long-horizon engineering claims with unusually specific cybersecurity results. Its 88.2% SEC-bench Pro, 54.8% ExploitGym and 71.0% CWE-bench scores suggest a stronger focus on the full defensive cycle from discovery to patching.

The immediate limitation is access. Carbon is starting with selected defenders, not the general public, and broader availability has no fixed date. Its introductory pricing is attractive on paper, but long-running agents can consume far more tokens and tool time than a single chat. The safest reading is promising but provisional: validate the model on controlled workloads, keep humans in the approval path and wait for official access.