Skip to content
NLEN
Illustration: Gemini 4 Carbon: Google's new frontier model for cyber and agents

Gemini 4 Carbon: Google's new frontier model for cyber and agents

By Ivo Donker · — with AI assistance (DeepSeek V4.1 Flash)

Google DeepMind announced Gemini 4 Carbon on 28 October 2026. In the blog post by Koray Kavukcuoglu, SVP Google DeepMind and Chief AI Architect at Google, Carbon is called "our next frontier model" and "our strongest model with state-of-the-art cybersecurity and long horizon capabilities". Carbon builds on Gemini 4 Argon, which appeared two weeks earlier. On X, Google DeepMind likewise describes the model as a next frontier model, state-of-the-art in cybersecurity and long-horizon tasks. Google AI adds on X that this is the strongest model, that it is being rolled out through the Fairwind Program and that access will be widened "as soon as possible".

One thing to be clear about straight away: Carbon is not broadly available yet. This week Google starts with a subset of cyber defenders and gradually phases in access for additional trusted partners through the Fairwind Program. Access for developers, businesses and consumers through product surfaces follows "as soon as possible", after feedback has been gathered and guardrails have been iterated on. If you are planning an integration, it makes sense to aim your preparation at that and not at an API key that exists today. If you are comparing the wider market in the meantime, you can base your choices on existing models and on frameworks such as choosing models for cyber security and code audits, where you weigh which model you deploy for which piece of review work.

What Google announces

The announcement positions Carbon on two axes: cybersecurity and long-horizon, agentic tasks. That is not an isolated marketing line: in the blog, Google DeepMind calls the model "our next frontier model" and at the same time "our strongest model with state-of-the-art cybersecurity and long horizon capabilities". In effect, Google is saying that the same generation that raises the general quality level is also the generation that has to carry cyber work and multi-step agent tasks.

Carbon is not the first model in this series. Gemini 4 Argon appeared two weeks earlier and Carbon builds on it. For developers, that says something mainly about the shape of the upgrade: it is a step within the same family, not a completely new starting point. In practice that often means that evaluations, prompts and tooling you had already built around Argon remain relevant as a baseline for comparing behaviour. However Google frames the succession, the hard question for your own stack stays the same: which tasks may a model finish on its own, and where do you want to keep human control? Background on that is in AI and cybersecurity, which covers the broader discussion about what you do and do not automate in security work.

Leaderboards: Artificial Analysis and WebDev Arena

According to the Google blog and to Artificial Analysis itself, Carbon ranks first on v5.0 of the Artificial Analysis Intelligence Index with a score of 59. On another Artificial Analysis index, the Coding Agent Index, Carbon ranks second, behind Claude Opus 5.5: Artificial Analysis records 62 for Opus 5.5 against about 59 for Carbon. That distinction matters. A high position on a general intelligence index does not automatically mean a model is the strongest coding machine everywhere; on Artificial Analysis's coding-agent index the number one sits with a different model.

In DeepMind's comparison table, Google itself shows how the family and the competition relate to each other: Gemini 4 Argon scored 50 there and Claude Opus 5.5 scored 58 on the AA Intelligence Index v5. Google publishes those figures next to its own model, which is useful if you want to see how large the jump from Argon to Carbon is — Carbon's 59 sits well above Argon's 50, and just above the 58 that the same table lists for Opus 5.5. These are figures from Artificial Analysis's indexes, not from your own workload.

For front-end and web work, Google cites WebDev Arena: Carbon gains 89 elo points there and lands at fourth place with 1768. That too is a leaderboard signal, not a guarantee for your component library or your browser targets. The practical lesson from these numbers is that a model does not have one property but a profile. If you want to set that profile against what you pay for it, quality versus cost is a useful angle for deciding which model you deploy where and which model you reserve only for the heaviest tasks.

Cyber benchmarks without guardrails

The cyber figures in the announcement were evaluated without guardrails and are vendor-reported. That is not a detail: guardrails are precisely the layer that in practice determines what a model refuses or softens, and a benchmark without that layer measures raw capability, not the behaviour you see in production. So set these figures next to your own acceptance criteria rather than above them.

Specifically, Google cites a score of 88.2% for SEC-bench Pro on finding vulnerabilities, presented as state of the art. For ExploitGym it lists 54.8% on exploitation, likewise described as new state of the art. For Collinear's CWE-bench it lists 71.0% on patching at the root cause. Those three measure different things: finding, exploiting and structurally repairing. For a security team, the last of those is especially relevant, because patching at the cause means you do not run into the same class of error again at the next release. When interpreting them, it helps to know how such figures are produced and where they diverge from your own codebase.

Google adds an external observation to this: Wiz sees Carbon leading on web penetration testing benchmarks within the Scan for Good initiative. That is a party that has worked with the model itself, but it remains an observation quoted in the announcement, not an independently reproducible measurement you can check for yourself. Treat cyber claims from any vendor as a starting point for your own tests, not as a replacement for them.

Long-horizon agent tasks

The second leg of the announcement is long-running work. Carbon is designed for sustained agentic workflows. Internally, Google teams saw Carbon work for days on complex multi-step engineering tasks, such as root-causing and patching subtle bugs across large codebases and in low-level systems. That is a vendor claim, not an external measurement: it concerns what teams inside Google itself observed.

Also relevant to your own consideration is the Chrome observation: the Chrome team reported that Carbon performed more than 10x better than another lab's large frontier model at generating high-quality patches. That too is an internal observation, reported by Google, and the comparison concerns one specific task — generating high-quality patches — not coding in general. For anyone building agents, the relevant question is not whether a model can run for days, but whether within those days it stops at the right moments, reports back and checks its own work. Models for this kind of role are compared on behaviour in a loop, not on a single prompt; an overview of what to look at is in models for agents.

In practical terms, "working for days" means for your setup that you think about budget and about containment. An agent that runs long consumes tokens for a long time, and the cost of a long run is determined by the number of steps it takes itself. So put a ceiling on the number of steps and on token consumption per task, and log what the agent does along the way, so that afterwards you can reconstruct where a run went off course.

Pricing: introductory rate and after

Pricing starts equal to Argon: an introductory rate of $2 per million input tokens and $10 per million output tokens, with cached input tokens receiving a 95% discount on the input price. After the introductory period that becomes $4 per million input tokens and $20 per million output tokens. Artificial Analysis reports $4/$20 as the standard rate with a 50% discount at launch — effectively $2/$10 — which is consistent with what Google itself says.

The input-to-output ratio is the number to remember here: output costs five times as much as input in both periods. For agentic work, where a model produces many reasoning steps and tool calls, that adds up. Cached input at a 95% discount is the knob you want to understand first, because a large part of what you resubmit on repeated use can fall into the cache path. If you want to check what that means for your consumption before you draw up a budget, pricing models per token explained sets out how such rates are built up. Calculate with the rate that applies after the introductory period, not only with the introductory rate, otherwise your cost estimate will later come out higher than expected.

Access: first cyber defenders via Fairwind

Google has chosen a phased rollout. The company participates in the U.S. government's voluntary process for pre-release model testing. This week Carbon goes to a subset of cyber defenders, after which access is gradually extended to additional trusted partners through the Fairwind Program. Access for developers, businesses and consumers through product surfaces follows "as soon as possible", after feedback has been collected and guardrails have been iterated on.

For you as a builder, that means Carbon is not broadly available at the moment. So you cannot simply plan around it for a production path that has to go live this week. What you can do is organise your preparation so that you can switch quickly once access arrives: make sure your evaluation set is ready, that you measure which tasks you currently outsource and at what cost, and that you have a fallback in case access comes later than you hope. The phased route through trusted partners is also a signal about where Google sees the first value: with cyber defenders, not with consumer products.

Google's safety claims

According to Google, Carbon uses the same multi-layered safety stack as Argon: model training, real-time defences against misuse, resilience to prompt injection and monitoring of the chain of thought. These are claims about how the model is built and guarded, and they come from the announcement itself.

There are figures attached to them, taken from Google's internal tests. Successful cheating on Terminal-Bench 4.0 has been reduced to 0.0%, with 0.4% cheating attempts. The number of high-severity misalignment alerts in internal live coding dropped by almost 80%. Unsupported claims were cut by roughly 2x compared with Argon. Overreach fell by 26% and under-service by 29%. Each of these numbers measures a different behaviour: cheating on a benchmark, alerts in real coding work, whether statements are substantiated or not, and whether the model does too much or too little for the user.

For prompt injection, Google cites a specific comparison: Argon had a 0.7% attack success rate on Gray Swan's Indirect Prompt Injection Benchmark, and Carbon comes out at 0.0% — it resisted every evaluated attack attempt. That is vendor-reported. An outcome of 0.0% on a benchmark does not mean injection is impossible in your system; it means the model did not give way in that specific evaluation. Much of the defence sits in your own setup: which text a model may treat as instruction, and which it must always treat as data only. How to approach that is in defending against prompt injection.

What this means for builders

The announcement gives you a profile, not a blueprint. Carbon is positioned on cybersecurity and long-horizon agent tasks, with a strong position on the general Artificial Analysis index and a second place on the coding-agent index behind Claude Opus 5.5. If your work consists mainly of cyber analysis, patching and multi-step agent tasks, this is a model to put on your shortlist. If your work consists mainly of generating code quickly inside an agentic loop, then Artificial Analysis's coding-agent index indicates that there is currently a strong alternative to compare against.

The pricing structure calls for a separate consideration. The introductory rate of $2/$10 with a 95% discount on cached input is favourable for repeated use with a lot of overlapping context, but the standard rate of $4/$20 after the introductory period is what belongs in a long-term budget. Output is five times as expensive as input, so an agent that produces a lot costs more than an agent that mainly reads and classifies.

The rollout route is the third factor. As long as Carbon is not broadly available and access is gradually phased through the Fairwind Program, it is not a component you make your only path in your architecture today. Build your integration layer so that you can switch models without revising your whole application, and keep track of which tasks genuinely need a frontier model and which can be handled with a cheaper model. That is also the reason not to look only at the highest score, but at the score in relation to what a task may cost you — exactly the kind of trade-off you make with quality versus cost.

Checks for your own setup

The core of the announcement is a combination of reach and restraint. According to the published indexes, Carbon posts a strong position, with a first place on the Artificial Analysis Intelligence Index v5.0 and a second place on the coding-agent index behind Claude Opus 5.5, and with cyber results that the announcement presents as state of the art on finding vulnerabilities and on exploitation. At the same time the rollout is deliberately narrow: first a subset of cyber defenders, then trusted partners through Fairwind, and broader access "as soon as possible" after that.

For you as a builder, that is an invitation to test as soon as you can, and to decide now which tasks are worth giving to a model of this calibre. The figures from the announcement — from the index scores to the cyber benchmarks without guardrails and the internal safety measurements — are the starting point of that consideration, not the end of it. Your own measurements on your own work are what ultimately determine where this model belongs in your stack.

Checked on 2026-10-29.

This article was compiled with AI assistance and editorially reviewed; sources are listed below.

Sources