What Google announced

Google DeepMind unveiled Gemini 4 Carbon on October 28, 2026, two weeks after Gemini 4 Argon reached developers. In the announcement post, Koray Kavukcuoglu, SVP at Google DeepMind and Google's Chief AI Architect, calls it "our strongest model with state-of-the-art cybersecurity and long horizon capabilities".

The catch is access. Carbon went first to a subset of vetted cyber defenders, and Google will phase it in to more trusted partners through its Fairwind Program before anyone else gets it. There is no public API, no model card and no release date. Developers, businesses and consumers will get it "as soon as possible", which Google ties to partner feedback and more work on guardrails.

That is the same road Argon took. It went to Fairwind partners on September 30 and opened through the API, AI Studio and Android Studio on October 13. Carbon has a price list already. It does not have a calendar.

Where it leads, and where it does not

The one third-party number that matters most comes from Artificial Analysis. On its Intelligence Index v5.0 (high reasoning), Carbon scores 59 and takes first place, ahead of Claude Opus 5.5 at 58, GPT-6 Astra at 57 and Argon at 50. Version 5 combines nine evaluations, about 60% of them on private tests or withheld answers, so these scores cannot be compared with older versions of the index. A one-point lead is also a thin one.

Google's own comparison table, as VentureBeat tallied it, gives Carbon the top result in 15 of 17 rows and an improvement over Argon in all 17. Long context is the standout: on GraphWalks at 256K to 1M tokens it climbs from 84.2% to 96.2%, against 71.8% for GPT-6 Astra and 66.8% for Opus 5.5. Terminal-Bench 4.0 goes from 57.1% to 65.2%. In Vending-Bench 2, a long-running business simulation, Carbon ends with $16,484 against Astra's $15,515.

It is not best at everything. On FrontierSWE 2, Carbon's 61.2% trails GPT-6 Astra (65.5%) and Opus 5.5 (62.3%). On OSWorld-2.1 offline, a computer-use test, it reaches 81.5% while Opus 5.5 sits at 87.2%. And on Artificial Analysis's Coding Agent Index, Carbon running in the Antigravity CLI scores 59, the same as Claude Code with Sonnet 5.5, while Claude Code with Opus 5.5 leads at 62. Google published no uncertainty estimates for its table.

The cyber numbers

Security is the headline claim, and every figure here is reported by Google. On SEC-bench Pro, which measures finding vulnerabilities, Carbon scores 88.2%, up from Argon's 83.4%.

The biggest jump is in exploitation. ExploitGym rises from 42.0% to 54.8%, a gain of almost 13 points, and it is the capability that most explains why Google is not handing the model to everyone at once.

Google says these external cyber evaluations ran "without guardrails", so a customer using the shipped model may see different results. Its other claims come without data: Carbon more than doubled Argon's success rate at generating secure code internally, and the Chrome team found it more than 10x better at writing high-quality patches than another lab's large frontier model, which Google does not name. Wiz says Carbon leads its web penetration-testing benchmarks.

Why defenders get it first

A model that finds and exploits bugs better is useful to both sides. Google's answer is to put it with defenders before attackers can rent it by the token. Patching is where defenders win, and Carbon's root-cause patching score on CWE-bench moves from 68.0% to 71.0%, a smaller step than the exploitation gain.

The Fairwind Program claims "over 650 partners globally" and names none of them. It currently offers Argon on its own or with CodeMender, Google's agent that automates code-security fixes. Priority goes to governments and national cyber authorities, critical-infrastructure operators in healthcare, telecom, energy and finance, core technology platforms, and academic labs that run defensive benchmarks. Applicants are vetted, background checks included. Threat simulation, reverse engineering and malware analysis are allowed when authorised; writing malware is not. The only way in is through a Google Cloud account team, so a small security shop without one has no front door.

Google also says Carbon is built for long-horizon agent work. Internal teams have watched it run for days on multi-step engineering jobs, such as root-causing and patching bugs in large codebases and low-level systems, working through dead ends along the way.

What it will cost

Prices are set even though nobody outside Fairwind can pay them yet. As of October 30, 2026, Google lists Carbon at an introductory $2 per million input tokens and $10 per million output tokens, the same introductory rate as Argon. Cached input is 95% off, about $0.10 per million. After the introductory period the price doubles to $4 input and $20 output.

In practice, a job that sends 10 million uncached input tokens and gets 1 million back costs $30 at the introductory rate and $60 afterwards. Google has not said when Carbon's introductory period ends. Argon's ends on November 30, 2026, with the higher rates from December 1, which is a reasonable guide to how short these windows run.

What the price buys is also unknown. Argon's documentation lists more than 1 million tokens of context, a default 65,536-token output limit, and text, image, video, audio and PDF input. Carbon's announcement gives no context window, modalities, output limit or knowledge cutoff, and there is no technical report or parameter count.

Safety claims and one caveat

Carbon uses the same layered safety stack as Argon: training, real-time misuse defences, prompt-injection resistance and chain-of-thought monitoring. Google reports 0.0% successful cheating on Terminal-Bench 4.0 with 0.4% attempted, almost 80% fewer high-severity misalignment alerts in live coding environments, and about half as many unsupported claims as Argon. Overreach fell 26% and under-service 29%.

Against Gray Swan's indirect prompt-injection attacks, success fell from 0.7% on Argon to 0.0% on Carbon. That holds for the attacks tested, not for every attack someone will write next month.

The caveat sits in Artificial Analysis's AA-Omniscience test. Carbon scores 54, the best result and six points above Opus 5.5, and answers 58% of questions correctly against Argon's 48%. But its hallucination rate rose from 4% to 11%. That ratio counts wrong answers against all wrong, partial and unanswered responses, so it does not mean 11% of answers are invented. It does mean that when Carbon does not know, it guesses more often than Argon did.

What it means for builders

If you build on Gemini today, nothing changes this week. Argon is the model you can actually call, and its price rises on December 1. Carbon's gains in long-context retrieval and multi-day agent runs are the reasons to plan a switch, but there is no date to plan against, and the specs you would test for are unpublished.

If your work is coding agents or computer use, the numbers do not force a move: Opus 5.5 still leads OSWorld and the Coding Agent Index, and GPT-6 Astra leads FrontierSWE 2. If you run security operations for critical infrastructure and already have a Google Cloud account team, ask about Fairwind now. Everyone else waits for the API, which on Argon's timeline came 13 days after the partner release. Google has made no such promise for Carbon.