Gemini 4 Carbon: Benchmarks, Pricing and Who Gets Access
Google announced Gemini 4 Carbon on October 28, 2026, two weeks after Gemini 4 Argon. Google calls it "our strongest model with state-of-the-art cybersecurity and long horizon capabilities," and it tops Artificial Analysis's Intelligence Index v5.0 with a score of 59 (Google). Most people cannot use it yet. This week only a subset of cyber defenders get access, followed by trusted partners in Google DeepMind's Fairwind Program, and Google has given no date for developers or consumers.
The pricing is already set: $2 per million input tokens and $10 per million output tokens during an introductory period, then $4 and $20.
Key takeaways
- Gemini 4 Carbon leads 15 of the 17 rows in Google's benchmark table against Gemini 4 Argon, GPT-6 Astra, Claude Opus 5.5 and Claude Fable 5.1. It loses FrontierSWE 2 to GPT-6 Astra and OSWorld-2.1 to Claude Opus 5.5.
- The biggest gains over Argon are in security and agent work: ExploitGym rises from 42.0% to 54.8%, SEC-bench Pro from 83.4% to 88.2%, Terminal-Bench 4.0 from 57.1% to 65.2% and long-context GraphWalks from 84.2% to 96.2%.
- Google reports a 0.0% attack success rate on the Gray Swan prompt-injection benchmark, against 0.7% for Argon and 1.0% for Claude Opus 5.5.
- Access starts with cyber defenders and Fairwind Program partners. There is no public API, Gemini app or AI Studio date.
- Introductory API pricing matches Argon at $2/$10 per million tokens, with cached input 95% cheaper. The list price afterward is $4/$20.
- All scores are Google's own and run at the highest thinking setting. Competitor numbers are mostly the vendors' self-reported figures.
What is Gemini 4 Carbon?
Gemini 4 Carbon is Google DeepMind's newest frontier model in the Gemini 4 family. Koray Kavukcuoglu, a senior vice president at Google DeepMind and Google's Chief AI Architect, wrote in the announcement that it is built for long, multi-step agent work, and that internal teams "have seen Carbon run for days to persist through dead ends." Google's examples are hard engineering jobs such as root-causing and patching subtle bugs in large codebases and low-level systems.
Carbon sits above Gemini 4 Argon, which reached paid API users and Google AI Pro and Ultra subscribers on October 13. Google says Carbon uses the same multi-layered safety and security stack as Argon and launches at the same introductory price.
A long-horizon task is one an agent has to carry through many steps, often over hours, while keeping track of its goal, recovering from failed attempts and checking its own work. Most of the benchmarks Google chose for Carbon measure this kind of work rather than single-turn answers.
Gemini 4 Carbon benchmarks
Google published one table comparing Carbon with Argon, OpenAI's GPT-6 Astra and Anthropic's Claude Opus 5.5 and Claude Fable 5.1. All figures are vendor-reported. Bold marks the top score in each row.
| Category | Benchmark | Gemini 4 Carbon | Gemini 4 Argon | GPT-6 Astra | Claude Opus 5.5 | Claude Fable 5.1 |
|---|---|---|---|---|---|---|
| General | AA Intelligence Index v5.0 | 59 | 50 | 57 | 58 | 49 |
| General | Vals Index v2.2 | 70.4% | 69.2% | 65.0% | 70.2% | n/a |
| Agentic coding | SWE-sweep | 9.6% | 4.3% | 9.5% | 3.6% | 2.9% |
| Agentic coding | FrontierSWE 2 | 61.2% | 55.0% | 65.5% | 62.3% | 56.3% |
| Agentic coding | Terminal-Bench 4.0 (AA) | 65.2% | 57.1% | 59.1% | 59.6% | 52.0% |
| Computer use | Agents' Last Exam v1.1 (score) | 77.4% | 69.0% | 73.1% | 71.6% | n/a |
| Computer use | OSWorld-2.1 (offline subset) | 81.5% | 74.7% | 80.9% | 87.2% | 76.8% |
| Knowledge work | AutomationBench (Zapier) | 53.9% | 51.3% | 41.4% | 42.5% | 31.4% |
| Knowledge work | Vending-Bench 2 (bank balance) | $16,484 | $13,718 | $15,515 | $9,235 | $5,422 |
| Multimodal | Chartography | 72.5% | 71.6% | 71.0% | 66.3% | 46.2% |
| Multimodal | Blueprint-Bench 2 (similarity) | 58.6% | 54.4% | 49.7% | 51.2% | 41.9% |
| Long context | GraphWalks 256K to 1M (BFS F1) | 96.2% | 84.2% | 71.8% | 66.8% | 65.0% |
| Science and math | RiemannBench | 80.0% | 76.0% | 72.0% | 69.6% | 65.6% |
| Science and math | Terminal-Bench Science 0.1 (AA) | 64.8% | 52.9% | 63.3% | 59.0% | 43.3% |
| Cybersecurity | CWE-bench | 71.0% | 68.0% | 68.0% | 67.0% | 58.0% |
| Cybersecurity | ExploitGym | 54.8% | 42.0% | 42.4% | 34.5% | n/a |
| Cybersecurity | SEC-bench Pro | 88.2% | 83.4% | 85.4% | n/a | n/a |
Source: Google, Introducing Gemini 4 Carbon and the Gemini 4 Carbon model evaluation. "n/a" means Google showed no score.
Where Carbon leads
The clearest jump is in long context. On GraphWalks between 256K and 1M tokens, Carbon scores 96.2%, 12 points above Argon and more than 24 points above GPT-6 Astra. Argon already led this row, so Google's lead on very long inputs has grown.
Terminal-Bench 4.0 was Argon's weak spot: it scored 57.4% in Argon's own launch table and trailed Claude Opus 5.5. Carbon's 65.2% on the Artificial Analysis run of the benchmark puts it first among the five models in Google's table, about 5.6 points ahead of Opus 5.5. It is not first overall: on Artificial Analysis's Terminal-Bench 4.0 leaderboard, Kimi K3.1 Pro scores 67.2%. Agents' Last Exam, a computer-use test, moves from 69.0% to 77.4%.
Vending-Bench 2 from Andon Labs has an agent run a simulated vending business and scores the bank balance at the end. Carbon finishes with $16,484, ahead of GPT-6 Astra's $15,515 and well ahead of Claude Opus 5.5's $9,235.
Where it does not
GPT-6 Astra still leads FrontierSWE 2, Proximal's agentic coding benchmark, with 65.5% to Carbon's 61.2%. On the offline subset of OSWorld-2.1, Claude Opus 5.5 scores 87.2% against Carbon's 81.5%. On WebDev Arena, Google reports an 89-point Elo gain over Argon, but Carbon ranks fourth at 1768. Some leads are also narrow. Carbon's Vals Index score of 70.4% is 0.2 points above Opus 5.5, and its SWE-sweep score of 9.6% is 0.1 points above GPT-6 Astra.
How Google ran the tests
The evaluation notes say all Gemini results use the Gemini API "with the highest thinking settings" and are pass@1 unless noted. Numbers for other models are "sourced from providers' self-reported numbers" unless a public leaderboard is named. Several rows come from third parties: the AA Index and both Terminal-Bench rows from Artificial Analysis, Vals Index from Vals AI, FrontierSWE from Proximal's leaderboard, AutomationBench from Zapier, and Vending-Bench 2 and Blueprint-Bench 2 from Andon Labs. Google computed SWE-sweep, Agents' Last Exam, OSWorld-2.1, GraphWalks, ExploitGym and SEC-bench Pro for its own models.
Google has not published a model card or technical report for Carbon, and its announcement gives no context window, parameter count or knowledge cutoff. Artificial Analysis lists a 1 million token context window with text, image, audio and video input. VentureBeat pointed out that the missing technical report, the narrow margins on several rows and the unsupported 10x patching claim make the table hard to check independently.
Gemini 4 Carbon cybersecurity results
Security is the headline use case, and it is why access starts with defenders. Google reports three cyber benchmarks and says it ran them without guardrails, so customer-facing results with safeguards on may differ:
- SEC-bench Pro tests whether a model can find a vulnerability and prove it. Carbon scores 88.2% on the 183-task May 2026 JavaScript engine split. A task counts as solved when the model's proof-of-concept crashes the vulnerable build but not the patched one, or when an LLM judge confirms the crash comes from the intended bug.
- ExploitGym tests exploit writing. Carbon scores 54.8%, and a task counts only when the exploit captures the target flag and a judge verifies it used the intended vulnerability. Google ran it offline, one attempt per task, with mitigations off.
- CWE-bench tests patching. Carbon scores 71.0% on the public leaderboard, where Collinear AI evaluates every model.
Google also cites internal results it has not published in detail: a more than 2x uplift in success rate over Argon on its secure-code benchmarks, and a report from the Chrome team that Carbon is more than 10x better than "another lab's large frontier model" at producing high-quality patches. Google does not name the other model. AI-found vulnerabilities are already producing real patch waves, as with the PHP2Shell flaws last week, which is the setting a model like this is aimed at.
The same skills that find and patch bugs can be used to attack. A model that writes working exploits for half of ExploitGym's tasks is useful to defenders and dangerous in the wrong hands, which explains the staged rollout. Reuters reported that Google is limiting access while it continues to test the model's safeguards.
Safety and prompt-injection results
Prompt injection is an attack where text hidden in a web page, file or tool output tells an AI agent to do something its user did not ask for. On the Gray Swan indirect prompt injection (IPI) benchmark, Google reports a 0.0% attack success rate for Carbon after 15 attempts per attack, compared with 0.7% for Argon, 1.0% for Claude Opus 5.5 and Claude Fable 5.1, and 8.5% for GPT-6 Astra.
Google lists other internal safety numbers:
- On Terminal-Bench 4.0, successful cheating fell to 0.0%, and the model attempted to cheat in 0.4% of runs.
- Unsupported claims fell by about half compared with Argon.
- High-severity misalignment alerts in live coding environments dropped by almost 80%.
- "Overreach" fell 26% and "under-service" 29%.
The safety stack carried over from Argon covers model training, real-time misuse defenses, prompt-injection resilience and chain-of-thought monitoring. Google says it is taking part in the U.S. government's voluntary pre-release model testing process and has published a separate safety and security report. These are internal measurements; outside red-team results were not part of the announcement.
Gemini 4 Carbon pricing
| Model | Input, per 1M tokens | Output, per 1M tokens |
|---|---|---|
| Gemini 4 Carbon (introductory) | $2 | $10 |
| Gemini 4 Carbon (after intro) | $4 | $20 |
| Gemini 4 Argon (introductory, to Nov 30, 2026) | $2 | $10 |
| GPT-6.1 Terra | $1 | $5 |
| GPT-6.1 Sol | $2 | $10 |
| GPT-6 Astra | $10 | $50 |
| Claude Opus 5.5 | $4 | $20 |
Sources: Google, Google on Argon pricing, OpenAI pricing, Anthropic pricing. Carbon's cached input is 95% off the input price.
Carbon costs the same as Argon for now, so once it reaches the API there is no price reason to stay on Argon for heavy agent work. Google has not said when Carbon's introductory period ends. At the later $4/$20 list price it would match Claude Opus 5.5 and still cost far less than GPT-6 Astra. GPT-6.1 Terra is half the price, but it is OpenAI's mid-tier model and scores lower on SEC-bench Pro (83.3%).
Who can use Gemini 4 Carbon now
Access rolls out in stages:
- This week: a subset of cyber defenders.
- Next: more trusted partners through the Fairwind Program.
- Later: developers, businesses and consumers. Google says this will happen "as soon as possible" once it has gathered feedback and tuned the guardrails, with no date.
Fairwind is Google DeepMind's early-access program for high-priority defenders, with more than 650 partners. It prioritizes government and national cyber agencies, critical infrastructure such as healthcare, telecoms, energy and finance, core technology platforms, and academics working on defensive benchmarks. Participants go through background checks, must use per-user authentication with phishing-resistant MFA, and may only give access to internal security, incident response and penetration testing teams. At the time of writing, the program page still describes Argon access rather than Carbon.
The announcement does not mention the Gemini app, Google AI Studio or Vertex AI. Argon took this path too: it launched to Fairwind defenders on September 30 and reached the API, AI Studio, Antigravity, the Gemini app and AI Mode on October 13, about two weeks later. Google has not promised the same timeline for Carbon.
What changes for developers and security teams
If you build agents on Gemini, Carbon is the model to plan for, but not one to build on this month. The Argon API is the available option today, at the same introductory price.
For security teams, the numbers suggest Carbon is strongest at the full loop of finding, reproducing and patching bugs in large codebases, and Google is offering it to defenders first. Teams that qualify can apply through the Fairwind Program.
For everyone else, the useful signals are the independent ones. Artificial Analysis's Index score of 59 and the Vals Index score of 70.4% come from outside Google. The rest of the table will be easier to judge once the model is public and others can rerun the tests.
FAQ
What is Gemini 4 Carbon?
Gemini 4 Carbon is Google DeepMind's frontier AI model, announced on October 28, 2026. Google describes it as its strongest model, with state-of-the-art cybersecurity and long-horizon agent capabilities. It ranks first on the Artificial Analysis Intelligence Index v5.0 with a score of 59.
How is Gemini 4 Carbon different from Gemini 4 Argon?
Carbon scores higher than Argon on every row of Google's benchmark table, with the largest gains on ExploitGym (54.8% vs 42.0%), GraphWalks long context (96.2% vs 84.2%) and Terminal-Bench 4.0 (65.2% vs 57.1%). It uses the same safety stack and the same introductory price as Argon. Argon is publicly available; Carbon is not yet.
How much does Gemini 4 Carbon cost?
Google lists an introductory price of $2 per million input tokens and $10 per million output tokens, with cached input 95% off. After the introductory period the price rises to $4 and $20 per million tokens. Google has not said when the introductory period ends.
Can I use Gemini 4 Carbon today?
Only if you are one of the cyber defenders Google selected, or a trusted partner in the Fairwind Program. Google has not given a date for the API, the Gemini app or AI Studio.
Is Gemini 4 Carbon better than GPT-6 Astra and Claude Opus 5.5?
On Google's own table, Carbon leads 15 of 17 rows. GPT-6 Astra leads FrontierSWE 2 (65.5% vs 61.2%) and Claude Opus 5.5 leads OSWorld-2.1 (87.2% vs 81.5%). Most competitor scores are self-reported by OpenAI and Anthropic, and independent testing of Carbon is limited until it is released. On Artificial Analysis's own Terminal-Bench 4.0 leaderboard, Kimi K3.1 Pro (67.2%) scores above Carbon (65.2%).
Sources
- Google: Introducing Gemini 4 Carbon
- Google DeepMind: Gemini 4 Carbon model evaluation (PDF)
- Google DeepMind: Fairwind Program
- OpenAI: GPT-6.1 Terra model docs
- Google: Gemini 4 Argon general availability
- Artificial Analysis: Gemini 4 Carbon
- Artificial Analysis: Terminal-Bench 4.0
- OpenAI: API pricing
- Anthropic: Claude pricing
- Reuters via Yahoo: Google launches Gemini 4 Carbon
- VentureBeat: Google unveils Gemini 4 Carbon