Gemini 4 Carbon: What Google's Launch Post Claims, Who Can Use It Now, and the Benchmark Caveats

On October 28 Google announced Gemini 4 Carbon, which it calls its strongest model, two weeks after Gemini 4 Argon. The headline for builders is not a benchmark. It is access: per the launch post, Carbon goes first to "a subset of cyber defenders" and then to more trusted partners through a Fairwind Program, and it is not yet available to developers, businesses or consumers.

I read Google's launch post in full. I did not read a model card, the Safety and Security report it mentions, the benchmark sources, or any independent evaluation, and I did not run the model. Every number below is Google's own, from one page.

Access and pricing, as stated

• Access. Starting the week of the post, Carbon is available to a subset of cyber defenders, with access phased to additional trusted partners through the Fairwind Program. Google says it is "actively engaged in the U.S. government's voluntary process for pre-release model testing" and wants to "gather feedback and iterate on guardrails" before making it available to developers, businesses and consumers "as soon as possible". No date is given.
• Price. The post says Carbon launches at the same introductory price as Argon: $2 per million input tokens and $10 per million output tokens, with cached input tokens priced at 95% off the input price. At the end the post says that after the introductory period expires, $4 per million input tokens and $20 per million output tokens will apply. It does not say when the period ends, in what I read.

So the price is announced, but most developers cannot buy at it yet. Plan around the $4 and $20 figures if you are budgeting.

The cybersecurity claims

Google says Carbon ranks #1 on version 5.0 of the Artificial Analysis Intelligence Index at 59, and lists three external security benchmarks, "evaluated without guardrails":

• SEC-bench Pro, finding vulnerabilities: 88.2%, described as state of the art.
• ExploitGym, exploitation: 54.8%, described as a new state of the art.
• Collinear's CWE-bench, patching: 71.0%.

It adds internal results: more than 2x uplift in the success rate for generating secure code over Argon, and a report that the Chrome team found Carbon "performed more than 10X better than another lab's large frontier model when generating high quality patches". The post also says Wiz observes Carbon leading on web penetration testing benchmarks.

Read these as claims, not as measurements you can reproduce:

• The post does not name the "another lab's" model in the 10X comparison, or say how patch quality was judged.
• "Internal benchmarks" are not described.
• The benchmark charts are images, and I did not read their detail.
• "Without guardrails" means the numbers describe the model before the safeguards that real users would meet.

Coding and agentic claims

Google says Carbon is built for sustained agentic work, and that internal teams saw it "run for days" through dead ends on tasks like root-causing and patching subtle bugs across large codebases and low-level systems. It reports a jump of 89 Elo points to #4 (1768) on WebDev Arena. No task counts, success rates for the multi-day runs or failure examples are given.

The safety and alignment claims

The post lists several measured changes versus Argon, all from Google's own testing:

• Successful cheating on Terminal-Bench 4.0 reduced to 0.0%, with attempts to cheat at 0.4%, with overall accuracy improving.
• High-severity misalignment alerts in live coding environments with internal teams dropped by almost 80%.
• Unsupported claims cut by about 2x over Argon in internal testing.
• Overreach reduced by 26% and under-service by 29%.
• Indirect prompt injection: Argon had a 0.7% attack success rate on Gray Swan's benchmark, and Carbon achieves 0.0%, "resisting every evaluated attack attempt".

A 0.0% score on a fixed benchmark means it resisted every attack in that benchmark. It does not mean the model cannot be prompt injected. The post does not say how many attacks the benchmark contains or which kinds. If you give an agent tools and untrusted input, you still need the controls outside the model.

The post also describes behaviors, such as retrieving sources and surfacing discrepancies before acting, and putting methodological caveats into deliverables. These are descriptions of intended behavior, not tests you can check from the page.

What the post does not tell you

• When developers get access, and on which surfaces.
• When the introductory price ends.
• The context window, latency, rate limits or regions. I did not see them in the post.
• How the benchmarks were run, how many tasks they have, or which other models were compared.
• Anything about Carbon from a source other than Google.

What I would check

These are my untested suggestions.

1. Do not plan a migration yet. Wait for developer access and a model page with limits.

2. Budget with the post-introductory price of $4 and $20 per million tokens, and check the cached input discount against your usage.

3. Read the Safety and Security report the post links for Argon, and look for one for Carbon, before you rely on the alignment numbers.

4. If you do security work, look at how to apply to the Fairwind Program.

5. When access opens, run your own tests. Use your own repos and your own prompt injection cases, not the vendor's benchmarks.

6. Keep external controls such as least-privilege tool access and human approval for risky actions, whatever the injection score.

What I would not conclude

• That Carbon is better than every other model on security. The post compares against unnamed models in places and gives no independent results.
• That the benchmark percentages predict results on your code.
• That Carbon is safe to give broad autonomy. The post says Google is still iterating on guardrails.
• That the model is generally available. It is not, per the post.
• That the 0.0% injection result means injection is solved.

Frequently asked questions

What is Gemini 4 Carbon?

Google's next frontier model, announced October 28, which Google calls its strongest, with state-of-the-art cybersecurity and long-horizon capabilities.

Can I use it now?

Per the post, only a subset of cyber defenders, with access phased to trusted partners through the Fairwind Program. Developers, businesses and consumers come later, with no date.

How much does it cost?

Introductory price of $2 per million input tokens and $10 per million output tokens, with cached input at 95% off. After the introductory period, $4 and $20.

What are the security benchmark numbers?

SEC-bench Pro 88.2%, ExploitGym 54.8% and CWE-bench 71.0%, all stated by Google, evaluated without guardrails.

How does it compare with Gemini 4 Argon?

Google reports more than 2x uplift in secure code generation, a 0.0% versus 0.7% prompt injection attack success rate on one benchmark, and fewer unsupported claims, all from its own tests.

Has anyone else verified the results?

Not in what I read. The post cites Artificial Analysis for the index ranking and mentions the Chrome team and Wiz, but I did not read their own reports.

Why does the rollout matter?

Because the model is strong at finding and exploiting vulnerabilities by Google's account, the company is limiting access first and says it is working with a U.S. government pre-release testing process.

Sources

All read on October 30, 2026.

• Introducing Gemini 4 Carbon (Google, October 28, 2026)

Not read: any model card or Safety and Security report, the benchmark sources and chart images, the Artificial Analysis index, and independent evaluations.