Gemini 4 Carbon: The New #1 Model, Cyber Defenders First

A new #1, rationed by trust

Google announced Gemini 4 Carbon on 28 October 2026, calling it “our strongest model with state-of-the-art cybersecurity and long horizon capabilities” (Google). It follows Gemini 4 Argon by four weeks and improves on it in every row of Google’s launch table.

It is also the new leader on the independent Artificial Analysis Intelligence Index, one point ahead of Claude Opus 5.5.

As with Argon, you cannot use it yet. Carbon is going first to “a subset of cyber defenders”, then in phases to trusted partners through Google’s Fairwind Program. For developers, businesses and consumers, Google says “coming soon” and gives no date. As of 31 October, Carbon is not listed in the Gemini API model docs.

What has changed since our Argon post is that Argon itself is now generally available in the Gemini API, with the model ID gemini-4-argon. That gives you a working stand-in to prepare on.

Short on time? Watch the one-minute summary.

Where Carbon leads, and where it does not

Google published 17 benchmark results against Argon, GPT-6 Astra, Claude Opus 5.5 and Claude Fable 5.1. Carbon leads 15 of them. Google ran the Gemini models at the highest thinking setting, and took most competitor numbers from vendor reports or public leaderboards. The last column shows who produced each row, according to Google’s evaluation methodology.

Source: Google, Gemini 4 Carbon announcement and evaluation methodology. n/a means Google did not report a score.

Four things are worth knowing before you quote this table:

• Some leads are ties. Carbon is 0.2 points ahead of Opus 5.5 on Vals Index and 0.1 points ahead of GPT-6 Astra on SWE-sweep. Treat those as a draw.
• The large gaps are in long context and agent work. GraphWalks at 256k to 1M tokens rises from 84.2% for Argon to 96.2%, more than 24 points clear of any rival. Terminal-Bench 4.0 and Agents’ Last Exam both move by more than 4 points over the next-best model.
• Computer use is still Opus 5.5’s. On OSWorld-2.1, Google reports Carbon’s best of three runs and still trails Opus 5.5 by 5.7 points. If your product drives a desktop, this is the row to test yourself.
• Harnesses matter. The Terminal-Bench 4.0 scores here were run by Artificial Analysis, which puts Opus 5.5 at 59.6%. Moonshot’s run for its Kimi launch had Opus 5.5 at 66.4%. Do not compare numbers across vendors’ tables.

First on the Intelligence Index, mid-pack on cost

The Artificial Analysis leaderboard runs the same evaluations on every model, so it is the fairest single view of where Carbon sits. It recently moved to version 5.0, with nine evaluations, and many scores changed: Argon went from 53 on v4.3.2 to 50, and Kimi K3.1 Pro from 55 to 46. Do not compare these numbers with our earlier posts.

Source: Artificial Analysis Intelligence Index v5.0, default 28-model comparison. Screenshot taken 31 October 2026. Scores are updated as models are re-run, so current values may differ.

Carbon scores 59, ahead of Claude Opus 5.5 (58), GPT-6 Astra (57), GPT-6.1 Sol (55) and Claude Sonnet 5.5 (54). Argon scores 50 and is not in the default view. Artificial Analysis marks Carbon as having no publicly available API, which matches Google’s rollout.

Source: Artificial Analysis, Cost per Intelligence Index Task, weighted average cost in USD per task, segmented by token type. Screenshot taken 31 October 2026.

Cost per task includes the tokens a model spends reasoning, so it shows more than price per token does. Artificial Analysis prices Carbon at the standard $4/$20 rate, not the introductory one (Artificial Analysis).

Data from Artificial Analysis as of 31 October 2026. Points per dollar is our calculation, not an Artificial Analysis metric.

Three readings matter for model selection:

• Carbon is cheaper per task than Opus 5.5 and scores higher. It costs about 23% less per index task at standard prices.
• GPT-6.1 Sol is the model to beat on value. It scores 4 points lower for about a sixth of the cost. Unless your workload needs those last points, Carbon is not the obvious default.
• Carbon talks a lot. It generated 200 million output tokens across the index, against 110 million for Argon and a median of 70 million. Its cost per task is still close to Argon’s ($7.76 against $7.68), but on your own workloads, measure output tokens per task before you forecast.

Pricing: the introductory rate halves everything

Google lists the same introductory price as Argon, with the standard price applying “after the introductory period” (Google). It has not said when that period ends for Carbon. For Argon, the Gemini API pricing page shows $2/$10 until 30 November 2026 and $4/$20 from 1 December. Batch and Flex are half price, and Argon supports implicit caching only.

Since the input, cached and output rates all halve, Carbon’s cost per index task at the introductory price would be about $3.88. That is our own estimate from the Artificial Analysis figure, not a measured number. Plan your budget on the standard price: an introductory rate is not something to build a forecast on.

The headline is cybersecurity

Google leads with security, and the cyber benchmarks were run “without guardrails”. ExploitGym ran with mitigations off.

• Finding vulnerabilities. SEC-bench Pro: 88.2%, against 85.4% for GPT-6 Astra and 83.4% for Argon.
• Exploitation. ExploitGym: 54.8% with a 10-hour limit per task, or 53.5% at the default 6 hours. GPT-6 Astra’s vendor-reported 42.4% has no time limit, and Opus 5.5 scores 34.5% at 6 hours.
• Patching. CWE-bench v1, run by Collinear AI: 71.0%, three points ahead of Argon and GPT-6 Astra.
• Secure code. On Google’s internal benchmarks, Carbon more than doubles Argon’s success rate at generating secure code.
• Partner claims. Google says its Chrome team found Carbon “more than 10X better than another lab’s large frontier model” at generating high-quality patches. It does not name the lab. Google also cites Wiz as finding Carbon ahead on web penetration-testing benchmarks.

This is why access starts with defenders. A model that finds and exploits more vulnerabilities is useful to attackers too, and staged access is Google’s control. For your own threat model, assume that capability at this level will reach attackers eventually, through Carbon or a rival. Keep patch windows short for internet-facing services and keep your AI application threat model current.

Prompt injection resistance is the number to watch

On Gray Swan’s indirect prompt injection benchmark, Google’s chart shows a 0% attack success rate for Carbon after 15 attempts, against 0.7% for Argon, 1.0% for Claude Opus 5.5 and Fable 5.1, 8.5% for GPT-6 Astra and 52.7% for Kimi K3. Google says Carbon resisted “every evaluated attack attempt”.

For anyone building agents that read email, web pages or documents, this matters more than any coding score. Two cautions apply. A benchmark covers known attack patterns, not the next one. And 0% on a model does not make an agent safe if the agent can still take irreversible actions on untrusted input. Keep human approval and least-privilege tools in place whichever model you use.

Safety claims, mostly from internal testing

Google reports these changes from its own evaluations against Argon:

• High-severity misalignment alerts in live coding environments fell by almost 80%.
• Unsupported claims fell by about half.
• Overreach (doing more than asked) fell by 26%, and under-service (doing less) by 29%.
• On Terminal-Bench 4.0, Carbon attempted to cheat on 0.4% of tasks and succeeded on 0.0%.

These are vendor-run and mostly qualitative, so treat them as direction, not proof. The overreach and under-service figures are worth checking in your own evaluation: an agent that quietly does more than you asked is a production risk even when the extra work is correct.

Long-horizon runs need budgets

Google says that internally, Carbon has run “for days to persist through dead ends” on tasks such as root-causing and patching bugs across large codebases. Combined with its token use, this changes how you run it:

• Set hard caps. Limit tokens, wall-clock time and tool calls per task, and fail closed when a limit is reached.
• Checkpoint state. A run that lasts hours must be able to resume after a timeout or deploy without starting again.
• Measure cost per outcome. A model that persists longer may succeed more often and cost more per attempt. Only cost per successful task tells you which wins. The LLM inference cost guide shows how to measure it.

What to do this week

• Build on Argon now. gemini-4-argon is generally available, with the same introductory price and a 1M token context window. Put your evaluation set, routing and cost tracking on it, so that switching to Carbon is a model ID change.
• Test the rows that matter to you. If you build computer-use agents, compare against Opus 5.5. If you build coding agents, compare against GPT-6 Astra on your own repositories. Our evaluation framework covers how.
• Re-forecast at the standard price. Use $4/$20 and the output token counts you measure, not the introductory rate.
• Run your own prompt-injection tests. Use attacks drawn from your own data sources. Do not rely on a benchmark score.
• Ask about Fairwind if you qualify. Governments, critical-infrastructure operators and core technology platforms can apply through their Google Cloud account team.

Carbon is the strongest model on the independent index today, and its security results are a step forward. Most teams cannot use it yet, and when they can, its verbosity will make cost control as important as model choice. If you want help building the evaluation and cost layer that lets you switch quickly, talk to Tensorplay about a model readiness review.