Gemini 4 Carbon holds Argon's price but restricts access to security-vetted partners — general availability still pending

Google's newest frontier model, Gemini 4 Carbon, launched on October 28, 2026, carrying the same sticker price as its two-week-old predecessor, Gemini 4 Argon: $2 per million input tokens and $10 per million output tokens, with cached input priced at 95% off the input rate. For teams already pricing Gemini into production budgets, the cost per token story is unchanged. What has changed is the capability envelope and — critically — who can actually reach the model right now.

Carbon is not a general-availability release. Google is routing initial access through its Fairwind Program, a controlled-partner pathway the company describes as serving "a subset of cyber defenders." Broader rollout to developers, businesses, and consumers on standard Vertex AI and Gemini API surfaces is described as coming "as soon as possible" but has no committed date. For engineering teams already shipping on Argon, Carbon is not yet a drop-in upgrade they can request today.

What Google says Carbon is for

The positioning in Google's launch post is explicit: Carbon is built for sustained agentic workflows and cybersecurity defense, not general-purpose speed or cost reduction. Koray Kavukcuoglu, SVP at Google DeepMind and Chief AI Architect, described the model as designed for "much harder, long-horizon engineering problems," with internal teams reporting Carbon running "for days to persist through dead ends" on tasks like root-causing bugs across large codebases.

This is meaningfully different from how Google has positioned Flash-tier models (speed and cost) or even earlier Argon (broadly capable frontier). Carbon is a capability-tier expansion targeting the security engineering and agentic-automation market, not an efficiency play that changes the serving economics.

Benchmark claims: what's disclosed and what's missing

Google attributes Carbon's cybersecurity performance to three external benchmarks, all evaluated without guardrails:

On the WebDev Arena leaderboard, Carbon lands at #4 with 1,768 Elo, a jump Google quantifies as +89 Elo points from Argon. On the Artificial Analysis Intelligence Index v5.0, Carbon ranks first at a score of 59.

Google also cites several internal, non-reproducible metrics: more than 2x improvement in secure code generation over Argon on internal benchmarks; more than 10x improvement over an unnamed competitor on high-quality patch generation reported by the Chrome team; and leading results on web penetration testing benchmarks cited by Wiz for its Scan for Good initiative.

The missing numbers for infrastructure planners are the ones that determine whether Carbon is operationally attractive at scale: throughput (tokens per second), time to first token, context window size, and memory footprint. None of these appear in the launch post. Google's Safety and Security report and Argon developer materials may contain additional technical specifications, but no latency or throughput figures for Carbon were available at time of publication. Until Carbon reaches general API availability and third-party benchmarks like Artificial Analysis or MLCommons capture serving performance, teams cannot compare it against Argon or GPT-class competitors on cost-per-useful-output metrics.

The alignment and safety changes that affect agentic serving

For teams building agentic pipelines, Carbon's safety changes have direct operational consequences, not just policy implications. Google reports:

• Prompt injection resistance: Carbon achieves 0.0% attack success rate on Gray Swan's Indirect Prompt Injection benchmark, down from Argon's already-low 0.7%. For any pipeline where Carbon receives untrusted content — documents, web pages, tool outputs — this is a meaningful hardening against a live attack class.
• Overreach and under-service: Google reports a simultaneous 26% reduction in overreach and 29% reduction in under-service versus Argon, meaning Carbon is better calibrated to complete exactly what a multi-step plan requires without either stopping short or taking unauthorized actions. For agentic workflows with real-world side effects, this calibration matters more than raw benchmark scores.
• Fabrication rate: Carbon cuts unsupported claims by approximately 2x over Argon in internal testing, with the model now placing methodological caveats directly into outputs rather than hedging around missing evidence.
• Terminal-Bench 4.0 cheating rate: Carbon reduces successful benchmark gaming to 0.0%, with attempt rate at 0.4%. Google frames this as evidence that stronger alignment can coexist with improved coding accuracy, though independent replication of this claim is not yet available.

High-severity misalignment alerts in live coding environments with Google's internal teams dropped by almost 80% compared to Argon, per the launch post. Google does not define "high-severity misalignment" precisely, so the denominator and classification methodology behind that figure are not transparent.

Is Carbon a materially different serving option today?

For most engineering teams, the honest answer is not yet. The pricing is identical to Argon. Availability is gated behind a selective partner program with no public enrollment path described in launch materials. Serving infrastructure specifications — the data points needed to decide whether to route traffic to Carbon versus Argon versus a Flash-tier model — are absent.

Where Carbon represents a genuine new tier is in its cybersecurity capability profile. If the SEC-bench Pro, ExploitGym, and CWE-bench numbers survive independent audit, a model that can autonomously find real vulnerabilities (88.2%), validate exploitability (54.8%), and generate root-cause patches (71.0%) in a single serving endpoint is qualitatively different from anything in the Gemini 4 lineup to date. The Chrome team's reported 10x patch quality improvement over an unnamed competitor, if it generalizes, would make Carbon relevant for any organization running automated security review pipelines.

The Fairwind rollout strategy — starting with a vetted cohort of cyber defenders — also signals that Google is treating Carbon's dual-use risk as non-trivial. A model capable of autonomous exploitation at ExploitGym-level performance is exactly the kind of capability that attracts misuse pressure, and the staged deployment is a risk management choice as much as a capacity one. The Safety and Security report details the multi-layer approach combining model training, prompt-injection resilience, and chain-of-thought monitoring.

What to watch

Three events will determine Carbon's practical importance for serving decisions. First, general API availability and the appearance of Carbon model IDs in Vertex AI and the Gemini API — that is when teams can actually migrate traffic and run their own cost-per-task comparisons. Second, third-party latency and throughput benchmarks from organizations like Artificial Analysis, which will establish whether Carbon's capability gains come at a serving-speed penalty versus Argon. Third, whether the cybersecurity benchmark scores hold under independent evaluation without the guardrail-off condition Google used — those scores describe a model without safety filters applied, which is not the configuration most enterprise teams will deploy.

Until those data points exist, Carbon is best understood as a capability expansion at a fixed price point, deployed initially in a narrow security context, with the infrastructure economics still to be determined.

All benchmark scores and internal performance figures are sourced from Google's October 28, 2026 launch post. Independent verification of internal metrics was not available at time of publication.