Google's new frontier model arrived in an unusual order. Gemini 4 Carbon, announced on 28 October 2026 two weeks after Gemini 4 Argon, went first to a small group of cyber defenders rather than to developers or the public. Google calls it its strongest model, built for long agentic work and security, and the staged release says as much about the risks it sees as any benchmark does.
The headline scores are strong. Carbon placed first on the Artificial Analysis Intelligence Index v5.0 with 59. On security tests it scored 88.2% on SEC-bench Pro, which measures finding vulnerabilities, 54.8% on ExploitGym, which measures exploiting them, and 71.0% on Collinear's CWE-bench for patching. It climbed 89 Elo points on WebDev Arena to fourth place. Google says the model has run internally for days at a time, working past dead ends to find the root cause of subtle bugs in large codebases, and that Chrome's team found it far better than an unnamed rival lab's model at writing high-quality patches.
Access was staged. A subset of cyber defenders came first, followed by trusted partners through Google's Fairwind programme, with developers, businesses and consumers promised later without a date. As our review of Gemini 4 Carbon records, that later stage came on 10 November, when it reached the paid Gemini API, Antigravity and the Gemini app for Google AI Ultra subscribers. Pricing starts at Argon's level, $2 per million input tokens and $10 per million output, and doubles to $4 and $20 after the introductory period, which our review dates to 30 November.
The safety numbers are worth reading alongside the capability claims. Google reports that successful cheating on Terminal-Bench 4.0 fell to 0.0%, high-severity misalignment alerts in live coding fell by almost 80%, and attacks on Gray Swan's indirect prompt injection test succeeded 0.0% of the time against 0.7% for Argon. A model that can find and chain flaws this well is useful to attackers as well as defenders, which is why Google took part in the US government's voluntary pre-release testing. Anthropic described similar capabilities in its own unreleased model the day before, so this is becoming a shared problem for frontier labs.
Several caveats apply. The external cyber benchmarks were run without guardrails, so the deployed model may refuse or soften some of that work. The full comparison table was published as an image, and the text names no rival model, so head-to-head claims cannot be checked from the post. Every figure is Google's own or from partners such as Wiz. Teams planning budgets should use the doubled price, not the launch price, in their sums.