A dark processor with a carbon-fiber pattern catches iridescent light.

Gemini 4 Carbon Explained: Google’s Frontier Model in the Gemini 4 Family

ByAIERA Blog Editorial Team

Key Takeaways

  • Gemini 4 Carbon is Google’s frontier model in the Gemini 4 family, announced on 28 October 2026 and built on Gemini 4 Argon for the hardest, longest-horizon work: complex coding, cybersecurity, scientific reasoning and multi-step agentic workflows.
  • Carbon was first available only to a subset of cyber defenders through Google’s Fairwind programme. Google made it generally available to paying developers and enterprises on 10 November 2026, with the model ID gemini-4-carbon.
  • Pricing is 2 dollars per million input tokens and 10 dollars per million output tokens during the introductory period, which runs through 30 November 2026. From 1 December the price doubles to 4 dollars in and 20 dollars out.
  • Google reports that Carbon ranked first on the Artificial Analysis Intelligence Index at launch with a score of 59, and that it scored 88.2 percent on SEC-bench Pro, 54.8 percent on ExploitGym and 71.0 percent on CWE-bench. Those are Google’s own reported figures, and the security results in particular should be read as vendor claims.
  • Carbon deliberately uses more tokens than Argon, because it spends longer exploring and checking its work. A task can therefore cost more on Carbon than on Argon even though the per-token price is the same.
  • The fast, cheap sibling is Gemini 4 Hydrogen, released on 12 November 2026 and covered in our earlier report. Hydrogen is for speed and cost; Carbon is for depth. Choosing between them is a routing decision, not a loyalty test.

What Gemini 4 Carbon Is

Google announced Gemini 4 Carbon on 28 October 2026, calling it its next frontier model. The announcement was explicit about where Carbon sits in the Gemini 4 family, and that explicitness is unusual enough to be worth noting. Google has made its model strategy unusually clear: Gemini 4 Argon is the standard model for demanding work, Gemini 4 Hydrogen is the fast and cheap model for agentic workflows, and Gemini 4 Carbon is the frontier model for the jobs where extra reasoning time and verification are worth the cost.

Carbon is built on Argon. That sentence, from Google’s own announcement, tells you most of what you need to know about the relationship. Carbon is not a different architecture or a different model line; it is Argon with more reasoning, more verification, and more time spent on each task. The extra capability comes from the model thinking longer and checking its work more thoroughly, not from a different set of weights. That is why Carbon uses more tokens than Argon for the same task, and why its per-task cost is higher even at the same per-token price.

The workloads Google names for Carbon are specific. Long-horizon agentic workflows, where an agent works through many steps over a long period. Complex multi-step coding and debugging, where the model needs to hold a large codebase in mind and reason about it carefully. Cybersecurity, where finding a real vulnerability and verifying it matters more than producing a plausible-looking answer quickly. Scientific reasoning, where a wrong step early in a chain of reasoning invalidates everything that follows. And knowledge work that benefits from extended verification loops, where the model checks its own output before presenting it.

What Carbon is not is equally specific. It is not a default replacement for Argon, and Google does not present it as one. It is not a chatbot model, and it is not built for speed. Teams that use Carbon for short, simple tasks will pay more and wait longer for results that Argon could have produced just as well. The model is designed for the hardest work, and using it for anything else is a waste of money and time.

The Slow Rollout: From Cyber Defenders To Everyone

Carbon’s availability story is a case study in how frontier models are released now. Google announced the model on 28 October, but it did not make it available to everyone. Access started with a subset of cyber defenders, widening through a programme Google calls Fairwind, which is for verified cybersecurity defenders. As of 4 November, Carbon did not appear on Google’s Gemini API pricing page, which listed Gemini 4 Argon as the only Gemini 4 model, and if you needed an API that day, Carbon was not an option.

The reason for the staged rollout is the model’s capability. Carbon’s strongest results are in cybersecurity, including finding vulnerabilities, validating them through exploitation, and patching them at the root cause. Those are dual-use capabilities: they are valuable for defence, and they are dangerous in the wrong hands. Releasing the model first to vetted defenders is a safety choice, and it is consistent with the way Anthropic released its Mythos models to vetted organisations at around the same time. The frontier-model industry has converged on the same pattern: the most capable models go first to the people who can be trusted with them.

That changed on 10 November 2026, when Google made Gemini 4 Carbon generally available to paying developers and enterprises through the Gemini API and Gemini for business, and to top-tier consumer subscribers. The model is distributed across the Gemini app, the Gemini API, AI Studio, Gemini for business, Antigravity, AI Mode, and the Fairwind programme. The model ID is gemini-4-carbon, and the developer guide lists a unified one-million-token input and output context window, adjustable thinking levels, and support for Gemini API tools.

The wider release matters for two reasons. First, it means Carbon is now a real purchasing option rather than a press-release model, and teams can actually test it on their own workloads. Second, it means the safety question has shifted: the model is no longer restricted to vetted defenders, so its capabilities are now available to any paying customer. Google’s judgement is evidently that the model is safe enough for general release, and that judgement will be tested in the coming months.

Pricing: Cheap Per Token, Expensive Per Task

Carbon’s pricing is simple to state and easy to misunderstand. During the introductory period, which runs through 30 November 2026, Carbon costs 2 dollars per million input tokens and 10 dollars per million output tokens. From 1 December, the price doubles to 4 dollars per million input tokens and 20 dollars per million output tokens. Cached input is priced 95 percent below the input rate during the introductory period. That is the same introductory price as Gemini 4 Argon, and the same doubling pattern.

The introductory price ends on 30 November, and that date should be in every budget that uses Carbon. A team that builds a cost model on 2 dollars in and 10 dollars out will find its costs doubling on 1 December, with no change in the model’s behaviour. The responsible way to budget for Carbon is to plan at the standard rates, 4 dollars in and 20 dollars out, and to treat the introductory period as a discount rather than as the real price. One briefing on the model puts it bluntly: plan any Gemini 4 budget at 4 and 20 dollars per million tokens, not at the introductory rates.

The more important pricing point is that Carbon costs more per task than Argon, even though the per-token price is the same. Carbon is intentionally designed to use more tokens than Argon, because it spends longer exploring and checking its work. A task that takes Argon 10,000 output tokens might take Carbon 30,000, and the bill triples even though the rate is identical. Google itself says that a task can cost more on Carbon even when the per-token price is the same, and that is not a flaw in the model; it is the point of the model. You are paying for more thinking, and more thinking costs more tokens.

The scale of that difference is visible in the independent testing. Artificial Analysis measured Carbon as unusually verbose, and reported that it generated 200 million output tokens to complete its index. The cost to run each index task was 7.76 dollars, calculated at the 4 and 20 dollar standard rates. That is a useful anchor: on a demanding benchmark, Carbon costs roughly 7.76 dollars per task at standard pricing. Whether that is cheap or expensive depends on the value of the task, but it is not a trivial amount, and it is a figure that should be in any cost comparison.

For a sense of scale at the introductory rate, a request with 20,000 input tokens and 2,000 output tokens would cost 6 cents at the introductory rate and 12 cents at the standard rate. That is a small request. Long agent runs generate far more output than that, and the output token count is where the bill accumulates. Plan budgets on output, not input, because output is where Carbon’s extra reasoning shows up as cost.

The Benchmarks Google Published

Google’s announcement leads with security results, and those results are the strongest part of the benchmark package. On SEC-bench Pro, which tests finding real vulnerabilities, Carbon scored 88.2 percent. On ExploitGym, which tests validating vulnerabilities through exploitation, it scored 54.8 percent. On CWE-bench, which tests patching at the root cause, it scored 71.0 percent. Google describes these as its strongest results, and it adds that on internal benchmarks Carbon more than doubles Argon’s success rate at generating secure code, that it reduced successful cheating on Terminal-Bench 4.0 to 0.0 percent, and that it had a 0.0 percent attack success rate on Gray Swan’s indirect prompt-injection benchmark, down from Argon’s 0.7 percent.

Those are impressive numbers, and they should be read with the care they deserve. The security benchmark results are Google’s own reporting rather than independent evaluation, and they should be read as vendor claims. Google’s methodology document says it ran SEC-bench Pro and ExploitGym itself in its Antigravity harness and took rival models’ numbers from their system cards and technical reports. CWE-bench is the one security result run by a third party: Collinear AI ran it across all models, each in its own harness, and Carbon scored 71.0 against 67 to 68 for four rivals. The third-party result is the most credible of the three, and it shows a lead of three to four points, which is real but not dramatic.

The broader benchmark picture is more mixed, and Google’s own table shows it. Carbon ranked first on the Artificial Analysis Intelligence Index version 5.0 at launch, with a score of 59, against 58 for Claude Opus 5.5 and 57 for GPT-6 Astra. On Terminal-Bench 4.0, Carbon scored 65.2 percent. On Agents’ Last Exam version 1.1, it scored 77.4 percent. On WebDev Arena, a human-rated web development benchmark, it placed fourth with 1768 Elo, up 89 points. Google also says Carbon ranked first on CursorBench 4.0, Perplexity’s WANDR, and Zapier’s AutomationBench, while costing less than half as much per task as the next-best external model in those comparisons.

But Carbon does not lead everywhere. It trails GPT-6 Astra on FrontierSWE 2, scoring 61.2 percent against 65.5 percent. It trails Claude Opus 5.5 on the OSWorld 2.1 offline subset, scoring 81.5 percent against 87.2 percent. And on AutomationBench, the comparison with Anthropic’s newer model is instructive: Google’s table lists Carbon at 53.9 percent, ahead of Claude Fable 5.2 at 51.4 percent, but Anthropic’s own table lists the same benchmark with Carbon ahead by the same margin. The two labs agree on that one, which is a rare and useful point of consensus.

The Artificial Analysis index deserves a closer look, because it has moved since launch. At launch, Google reported Carbon at number one with a score of 59. On 4 November, Artificial Analysis listed Gemini 4 Carbon in its High configuration first of 62 models with a score of 60. Since then, Anthropic’s Claude Fable 5.2, released on 9 November, has been reported at 62 on the same index against 60 for Carbon, when both run at comparable settings. The index is a moving target, and the ranking depends on the settings and effort levels used. Carbon’s number-one position at launch was real, and it is no longer the current position. That is not a criticism of the model; it is a reminder that leaderboard positions are snapshots, not permanent facts.

The output speed and verbosity figures from Artificial Analysis add a practical dimension. Carbon’s output speed was measured at 88.7 tokens per second, and the model generated 200 million output tokens to complete the index. That verbosity is the price of the extra reasoning: the model thinks more, writes more, and costs more. For a team evaluating Carbon, the relevant question is not whether the model is verbose in the abstract, but whether the extra output is useful output or wasted output. On a hard task, the extra reasoning may be exactly what solves it. On an easy task, it is waste.

Carbon Against Its Siblings

The Gemini 4 family now has three named members, and understanding the family is the key to choosing between them. Argon is the standard model, the one for most demanding work. Hydrogen is the fast and cheap model, released on 12 November 2026, for agentic workflows where speed and cost matter more than depth. Carbon is the frontier model, for the hardest work where depth matters most. Our earlier report on Gemini 4 Hydrogen pricing and benchmarks covers the fast sibling in detail, including its price of 1.50 dollars per million input tokens, its roughly two and a half times speed advantage, and its score of 54 on the Artificial Analysis index.

The comparison between Carbon and Hydrogen is the most useful one for most teams, because it is a choice they will actually make. Hydrogen is for workflows where the model needs to act quickly and cheaply, and where the tasks are well-defined enough that deep reasoning is not required. Carbon is for workflows where the task is hard, the reasoning is long, and the cost of a wrong answer is high. A team that routes everything to Carbon will waste money. A team that routes everything to Hydrogen will get fast, cheap, wrong answers on the hard tasks. The right approach is to route by task difficulty, and to measure the results.

The comparison with Argon is subtler. Carbon builds on Argon, and the two models share the same per-token price. The difference is that Carbon thinks longer and costs more per task. For a team already using Argon, the question is whether the tasks that Argon struggles with are worth the extra cost of Carbon. The security results suggest that for cybersecurity work, the answer is yes: Carbon more than doubles Argon’s success rate at generating secure code on Google’s internal benchmarks. For general work, the answer will depend on the specific tasks, and the only way to know is to test both models on the same workload and compare the results and the bills.

There is also a comparison with the previous generation. Google’s Gemini 3 was released earlier in 2026, and our earlier coverage of the Gemini 3 release gives the context for what the Gemini 4 family replaced. The step from Gemini 3 to Gemini 4 is a generational improvement, and Carbon is the leading edge of that generation. But the generational framing should not obscure the practical question, which is always the same: does this model solve my tasks better than the model I am using now, at a price I can afford.

Project Fortify And The Safety Numbers

One of the most interesting details in Carbon’s launch is Project Fortify, Google’s automated system for scanning, triaging and fixing flaws. In an internal benchmark, Carbon reached 100 percent recall on scanning and 95 percent precision on triage. Those are striking numbers, and they are internal numbers, which means they come from Google’s own testing of its own system with its own model. They should be read as a claim about what the system can do, not as an independent verification.

The safety numbers in the benchmark table are also worth a careful reading. The Gray Swan indirect prompt-injection result, 0.0 percent attack success rate, down from Argon’s 0.7 percent, is a genuine improvement on the benchmark. But a 0.0 percent result on a benchmark means the published attacks stopped working, not that prompt injection is solved. It means the specific attacks in the benchmark failed against Carbon, which is good news, but it does not mean that no attack will ever succeed. Teams building agents with tool access should treat the 0.0 percent as encouraging, not as a guarantee, and should still follow the standard practices for agent safety: least privilege, human review for consequential actions, and monitoring.

The same caution applies to the Terminal-Bench 4.0 cheating result, where Carbon reduced successful cheating to 0.0 percent. That is a measure of the model’s behaviour on a specific benchmark, not a general guarantee of honesty. The model is less likely to cheat on that benchmark than its predecessor was. That is a real improvement, and it is also a narrow one.

Who Should Use Carbon, And Who Should Not

Carbon is for teams doing the hardest work with the highest stakes. Cybersecurity teams doing vulnerability research, penetration testing and patching should test it first, because that is where the benchmark lead is largest and the third-party evidence is strongest. Engineering teams working on complex, multi-step coding and debugging, where the model needs to sustain reasoning over a long period, should test it next. Research teams doing scientific reasoning, where a single error early in a chain invalidates the result, should test it too. In all three cases, the test should compare Carbon against Argon and against the team’s current model, on the team’s own tasks, measuring both the success rate and the cost per task.

Carbon is not for everyone. Teams doing high-volume, low-complexity work should not use it, because they will pay more and wait longer for no benefit. Teams doing interactive chat should not use it, because it is not built for speed. Teams on a tight budget should be especially careful, because the price doubles on 1 December and the per-task cost is higher than the per-token price suggests. And teams that cannot yet use it, because they are not paying developers or enterprises, or because they are waiting for wider availability, should not rewrite their systems for a model they cannot call.

The routing question is the practical heart of this article. Google has built a family of models with different price, speed and capability profiles, and the right approach is to use each one for the work it is best at. Argon for most demanding work. Hydrogen for fast, cheap agentic workflows. Carbon for the hardest tasks where depth is worth the cost. A team that routes well will get better results at lower cost than a team that uses a single model for everything. A team that routes badly will get the worst of both worlds.

For the wider context on the model race, our report on Anthropic’s IPO being oversubscribed covers the financing behind the rival lab, and our analysis of Gemini 4 Argon pricing and availability explains the standard model that Carbon builds on. Together, those three reports give a picture of a market in which the frontier is moving fast, the prices are changing monthly, and the right choice depends on the specific work rather than on the leaderboard.

What We Could Not Verify

  • All benchmark figures in this article are Google’s own reported numbers, except for CWE-bench, which was run by Collinear AI, and the Artificial Analysis figures, which come from Artificial Analysis. Google’s own results have not been independently reproduced, and the security results in particular should be read as vendor claims.
  • The general-availability date of 10 November 2026 comes from reporting on Google’s announcement. We have not verified it against Google’s own announcement, and the exact scope of the wider release, including which consumer tier qualifies, is not confirmed in the sources we reviewed.
  • The introductory pricing end date of 30 November 2026, with the price doubling on 1 December, comes from reporting on Google’s pricing. We have not verified it against Google’s pricing page, and the length of the introductory period was originally stated by Google as unstated. If the dates differ, the pricing in this article will need correction.
  • The Artificial Analysis index figures have moved since launch: 59 at launch, 60 on 4 November, and a reported 62 for Claude Fable 5.2 against 60 for Carbon after 9 November. We have not verified the index directly, and the ranking depends on the settings and effort levels used.
  • The claim that Carbon ranked first on CursorBench 4.0, Perplexity’s WANDR and Zapier’s AutomationBench comes from Google’s announcement as reported. We have not verified those rankings independently.
  • Project Fortify’s 100 percent recall and 95 percent precision figures are from Google’s internal benchmark. We have not verified them, and they should not be treated as independent results.
  • The 0.0 percent attack success rate on Gray Swan’s indirect prompt-injection benchmark is a benchmark result, not a guarantee that prompt injection is solved. We state it as a benchmark result.
  • We have not verified whether Carbon is available in the Gemini app for free-tier users, or which enterprise tiers include it. Access details beyond the developer and enterprise availability are unconfirmed.

Sources

  • ReAPI, “Gemini 4 Carbon: Release Date, Price, Benchmarks and Access”: https://reapi.ai/resources/gemini-4-carbon
  • IDG Briefing, “Gemini 4 Carbon leads a code-patching chart by 3 points, but few customers can use it”: https://insights.idg.consulting/articles/google-gemini-4-carbon-limited-release
  • SimpMusic Blog, “Google releases Gemini 4 Carbon for the hardest AI workloads”: https://www.simpmusic.org/blogs/google-gemini-4-carbon-for-hardest-ai-workloads
  • Swarmz, “Gemini 4 Carbon: Google’s Security-First Model”: https://swarmz.net/blog/gemini-4-carbon
  • Nakoda AI, “Google Opens Gemini 4 Carbon to Developers and Businesses After Cyber-Only Preview”: https://news.nakoda.ai/article/google-gemini-4-carbon-generally-available-developers-enterprises-ultra

Similar Posts