Gemini 4 Carbon

What it is

Gemini 4 Carbon is a frontier model from Google DeepMind, announced on 28 October 2026 by Koray Kavukcuoglu. Google described it as its strongest model, pointing to state-of-the-art cybersecurity and long-horizon capabilities.^[1] "Frontier model" is an informal label labs use for the most capable system they have built at a given moment; "long-horizon" means work that unfolds over many steps — running a command, reading the result, correcting course — rather than a single answer to a single question.

Where it came from

Carbon was announced two weeks after Gemini 4 Argon, the previous model under the same family name.^[1] The two also share a price list: Carbon's introductory rate matched Argon's at $2 per 1 million input tokens and $10 per 1 million output tokens, rising to $4 and $20 afterwards.^[1] Google's announcement put cybersecurity near the front, alongside the usual capability claims, and the rollout was arranged accordingly.

Benchmark scores

On the Artificial Analysis Intelligence Index v5.0, Carbon ranked first with a score of 59.^[1] It placed fourth on WebDev Arena with 1768 Elo, an arena that ranks models against one another on web-development tasks.^[1] On Google DeepMind's own comparison table it recorded 70.4% on Vals Index v2.2, 65.2% on Terminal-Bench 4.0, and 96.2% on GraphWalks at context lengths from 256k to 1M tokens.^[2]

Cybersecurity

Google reported 88.2% on SEC-bench Pro, 54.8% on ExploitGym and 71.0% on CWE-bench.^[1] It said the cybersecurity results were evaluated without guardrails, meaning the safety layers that normally sit between a model and its user — refusals, filters, monitoring — were left out of the measurement, so the figures describe what the underlying model can do rather than what a shipped product would permit.^[1]

Two further numbers concern behaviour rather than raw capability. Google reported that cheating on Terminal-Bench 4.0 fell to 0.0%, and that the success rate of indirect prompt-injection attacks on the Gray Swan benchmark fell to 0.0%, against 0.7% for Argon.^[1] Indirect prompt injection is an attack in which instructions are hidden inside material a model has been asked to read — a document, a web page — rather than typed by the user, so that the model picks up an attacker's text as if it were part of its own task.

Price and access

Pricing starts at $2 per 1 million input tokens and $10 per 1 million output tokens on introductory terms, then moves to $4 and $20.^[1] At launch, access was limited to a subset of cyber defenders through the Fairwind Program, with broader availability described as "coming soon".^[1] Google said access would be extended gradually to more trusted partners through the same program.^[1]

Where it sits

Carbon arrives two weeks after Argon, with higher scores on the published benchmarks, a matching introductory price, and a cybersecurity-first framing.^[1] The release is staged rather than open: the strongest claims in the announcement concern security work, and the model could initially be reached only through a program aimed at defenders.^[1] That combination — a first-place score on the Artificial Analysis index, a set of security benchmarks, and an invitation-only rollout — is what the launch consists of.