Gemini 4 Carbon explained: which numbers Google measured, which ones outsiders checked, what a task costs, and why most teams cannot use it yet

Google released Gemini 4 Carbon on October 28, 2026, two weeks after Gemini 4 Argon, and Artificial Analysis ranked it #1 on its Intelligence Index v5 the same day. But the launch post mixes Google's own tests with outside rankings, and access starts with a subset of cyber defenders. We sorted the numbers by who measured them and worked out what a task costs.

This explains reporting by

Koray Kavukcuoglu, Google, "Introducing Gemini 4 Carbon" (October 28, 2026). Read the original first:

https://blog.google/innovation-and-ai/models-and-research/gemini-models/introducing-gemini-4-carbon/

In one minute #

• Carbon is Google's strongest model, aimed at cyber defense and long agentic coding work. It shipped October 28, two weeks after Argon.
• Independent: Artificial Analysis puts it #1 on Intelligence Index v5 at 59, leading 4 of 9 evaluations, and #2 on its Coding Agent Index at 59, behind Claude Code with Opus 5.5 at 62.
• Google only: 88.2% on SEC-bench Pro, 54.8% on ExploitGym, 71.0% on CWE-bench, more than 2x Argon on secure code, and 0.0% attack success in Gray Swan's prompt injection test.
• A task on the Intelligence Index costs $7.76 at standard price, about 23% less than Opus 5.5 at max effort and about 1.2x GPT-6 Astra. At the 50% launch price it is $3.88.
• Most teams cannot use it yet. Access starts with a subset of cyber defenders, then trusted partners through Google's Fairwind program, with no date for developers.

What Google released, and who can use it #

Gemini 4 Carbon is the model after Gemini 4 Argon, released about two weeks earlier. Google calls it its strongest model, with state-of-the-art cybersecurity and long-horizon capabilities. The two jobs it names are cyber defense (finding, validating and patching vulnerabilities) and long agentic software work, such as root-causing a bug across a large codebase.

Access is the catch. This week it goes to a subset of cyber defenders. More trusted partners come in gradually through the Fairwind Program. Developers, businesses and consumers get it 'soon', with no date. Google also says Carbon is part of the US government's voluntary pre-release model testing.

The post gives no model ID, no context window and no API or Vertex AI listing. Artificial Analysis lists a 1M token context window and text, image, video and speech input, and says Carbon is 'not yet publicly available'.

The numbers, sorted by who measured them #

This matters because a launch post is marketing, and outside tests are the closest thing to a second opinion. Here is every number, sorted.

Measured by Artificial Analysis, an outside benchmark firm:

• Intelligence Index v5: 59, ranked #1. It leads 4 of the 9 evaluations: HLE-Diamond, Terminal-Bench-Science, AA-Omniscience and AutomationBench-AA.
• Coding Agent Index: 59, second to Claude Code with Opus 5.5 at max effort, which scores 62. On FrontierCode v1.1 Carbon scores 51% to Opus 5.5's 56%.
• AA-Omniscience v1.1 (knowledge and hallucination): 54, ahead of Opus 5.5 at 48 and Argon at 46, with an 11% hallucination rate.
• AA-Briefcase (office work): 1609 Elo, behind Kimi K3.1 Pro, Muse Wonder and Grok 4.7.

Reported by Google from other leaderboards: WebDev Arena rank #4 at 1768, up 89 Elo. The Register adds that Arena's Best Overall Agent board puts Carbon second, behind Opus 5.5.

Measured by Google only, not checked by anyone else yet:

• SEC-bench Pro (finding vulnerabilities) 88.2%, ExploitGym (exploitation) 54.8%, CWE-bench (patching) 71.0%.
• More than 2x Argon's success rate at writing secure code, on an internal test.
• The Chrome team's view that Carbon was more than 10x better at writing patches than another lab's large frontier model, which Google does not name.
• Cheating on Terminal-Bench 4.0 cut to 0.0%, with attempts at 0.4%. High-severity misalignment alerts in live coding down almost 80%. Unsupported claims cut about 2x versus Argon.
• Gray Swan prompt injection attack success 0.0%, versus 0.7% for Argon.

What a task costs #

Google prices Carbon at $2 per million input tokens and $10 per million output tokens for an introductory period, the same as Argon, and $4 and $20 after that. Neither Google nor Artificial Analysis gives an end date. The Register notes the full price matches Claude Opus 5.5's list price.

List price per token does not tell you what a job costs, because models use very different numbers of tokens. Artificial Analysis measures the cost of one Intelligence Index task instead:

Cost per Artificial Analysis Intelligence Index task (Artificial Analysis, October 28)
  Gemini 4 Carbon   $7.76  at standard price ($4 in, $20 out), 123k output tokens
  Claude Opus 5.5   $10.04 (max effort), 173k output tokens
  GPT-6 Astra       $6.25  (max effort)

Carbon at Google's launch price ($2 in, $10 out, 50% off, no end date)
  $7.76 x 0.5 = $3.88 per task

Index score per dollar of one task (score / cost)
  Carbon, launch price     59 / $3.88  = 15.2
  Carbon, standard price   59 / $7.76  =  7.6
  Opus 5.5 and Astra       their v5 scores were not on this page, so we leave them out

So Carbon at full price sits between the two other leaders: cheaper per task than Opus 5.5 at max effort because it writes 29% fewer output tokens, and dearer than GPT-6 Astra. At the launch price it is the cheapest of the three per task. That gap closes the day the discount ends, so do not build a budget on it.

Why the cyber numbers are the real story #

Find, exploit, patch is the loop a security team runs on every bug. Google's three cyber benchmarks map onto it: SEC-bench Pro for finding, ExploitGym for proving a bug is real, CWE-bench for writing the fix. A model that is strong at all three can close the loop with less human time, which is why Google is giving it to defenders first.

It is also why the rollout is slow. A model that is good at proving bugs are exploitable is useful to attackers too, and labs have started holding their strongest cyber models back for vetted users. Carbon's 0.0% Gray Swan result matters for the same reason: a security agent that reads hostile code and web pages all day has to resist instructions hidden in them.

None of the three cyber scores has been reproduced outside Google yet. Until a vetted user or a benchmark firm publishes its own run, treat them as Google's claims.

What to do this quarter #

• If you are a security vendor or run a security team, ask your Google contact about Fairwind. That is the only path named.
• If you build on Gemini, keep shipping on Argon. Carbon's launch price matches Argon's, so the switch should be cheap when it opens, but there is no date.
• If you compare models on one index, read the Artificial Analysis v5 weights first. Carbon leads the overall index but trails Opus 5.5 on the coding agent index, so the right pick depends on your workload.

Who is affected #

What to do #

• Security teams: ask Google about the Fairwind access program.
• Gemini builders: plan a test on Carbon for when access opens, using your own tasks, not the launch post's benchmarks.
• Anyone comparing prices: compare cost per task, not per token.

What is still unknown #

• Every cyber score (SEC-bench Pro, ExploitGym, CWE-bench) and the Chrome team's 10x claim come from Google's own testing. No outside group has published a run yet.
• Google gives no date for developer access, no model ID, and no end date for the launch price.
• The rival model in the Chrome team's comparison is not named.
• Artificial Analysis did not list Opus 5.5's or GPT-6 Astra's overall v5 scores on the Carbon page, so we could not compute score per dollar for them.
• Eligibility rules for the Fairwind program are not public.

Sources #

• Koray Kavukcuoglu, Google, "Introducing Gemini 4 Carbon" (October 28, 2026) — the original report
• Artificial Analysis, "Gemini 4 Carbon is the new #1 on the Artificial Analysis Intelligence Index v5" (October 28, 2026)
• The Register, "Google's Gemini 4 Carbon looks like a diamond in the rough" (October 29, 2026)
• Nathan Lambert, "Artificial Analysis v5 and the benchmarker's dilemma" (October 28, 2026)

AI News Report· every headline, every morning.