Gemini 4 Carbon: What's Confirmed About Google's New AI

Google DeepMind announced Gemini 4 Carbon on October 28, 2026, calling it "our strongest model with state-of-the-art cybersecurity and long horizon capabilities." Carbon is not broadly available: Google is rolling it out first to a limited set of vetted cyber defenders and to the U.S. government's voluntary pre-release testing program, with wider access to developers, businesses and consumers planned later. It builds on Gemini 4 Argon, the sibling model that reached general availability on October 13. Benchmark claims, including a reported #1 spot on the Artificial Analysis Intelligence Index, are Google's own figures or third-party aggregator scores, not independently verified results, and a head-to-head with Claude Opus 5.5 is still largely guesswork since outside testers cannot get hands-on access yet.

What is Gemini 4 Carbon?

Gemini 4 Carbon is Google DeepMind's newest flagship model, pitched specifically at cybersecurity work and tasks that run for a long time without a human checking in. In its launch post, Google describes Carbon as built for the "cybersecurity defense lifecycle" — finding vulnerabilities, validating that they're real, and writing fixes for them — plus multi-step engineering work that unfolds over many hours or, according to Google, "days" of continuous agentic effort. Carbon is part of the wider Gemini family Google has been shipping since late 2023; Wikipedia's rundown of the Gemini model line has useful background on how the naming and generations got here.

That framing matters because Carbon isn't a replacement for Google's general-purpose flagship. It's a second Gemini 4 release, arriving a month after Gemini 4 Argon went generally available on October 13. Argon is the model most people and developers can actually use right now, through the Gemini API, Google AI Studio, the Gemini app, and Google Antigravity. Carbon sits above it as a specialized, access-gated model — closer in spirit to how a lab might ship a research-grade model to a small group before a public release.

How Carbon differs from Argon

Google's own announcement lists a set of internal evaluation results comparing Carbon against Argon, all of which are company-reported rather than independently audited:

• More than 2x the success rate for generating secure code in internal tests.
• Roughly half as many unsupported claims (a measure related to hallucination).
• Overreach down 26% and under-service down 29% — Google's internal terms for a model doing too much or too little on a task.
• Prompt-injection attack success on the Gray Swan IPI benchmark fell from 0.7% to 0.0%.
• Cheating on Terminal-Bench 4.0 dropped to 0.0%, with cheating attempts at 0.4%.
• High-severity misalignment alerts in internal live-coding tests down almost 80%.

Put plainly: Google is positioning Carbon as a safer, more reliable version of the same Gemini 4 generation, tuned specifically against the failure modes that matter most for security tooling — a model that's less likely to lie about what it did, less likely to be tricked by an injected instruction, and less likely to go off-task during a long autonomous run. None of these numbers come with a published methodology paper or third-party replication as of this writing, so they should be read as Google's internal claims about its own product.

Release and access: who can actually use it

This is the part search traffic keeps circling back to, and the honest answer is: almost nobody, yet. Google's launch post says it will "make Carbon available to a subset of cyber defenders" starting the week of the announcement, with additional trusted partners added gradually through Google's Fairwind Program — the same vetted-access structure Google used for Argon's earliest rollout before its October 13 general availability. Google also says it is participating in the U.S. government's voluntary pre-release model testing process, which gives government evaluators an early look at Carbon ahead of any wider release.

As The Verge reported on the launch, Google released Carbon with a "significant leap" framing for cybersecurity rather than as a broad consumer upgrade. Beyond that, Google says only that broader availability to developers, businesses and consumers is planned "as soon as possible," pending feedback from the current limited rollout and further guardrail work. As of early November 2026, no public API date, Google AI Studio listing, or consumer Gemini app rollout had been announced for Carbon. If you're trying to use it today through the normal Gemini API or AI Studio, you can't — Argon remains the model available to the public.

Pricing: what Google has published

Because Carbon isn't broadly available, there's no live, self-serve pricing page to check. Google's announcement does publish an introductory rate that will apply once wider access opens: $2 per million input tokens and $10 per million output tokens, with cached input priced at a 95% discount off the standard input rate. After the introductory period ends, the rate rises to $4 per million input tokens and $20 per million output tokens. That's the same structure Google used to launch Argon, and reporting from outlets including Android Authority and Khaleej Times lines up with those introductory numbers — though a few secondary blogs list only the post-introductory $4/$20 figures without the discount window, so double check the current rate before budgeting around it.

Benchmark claims, and what's actually verified

Google's launch post leans heavily on benchmark charts, all evaluated "without guardrails" unless Google notes otherwise. Here's what it claims, compared with where independent aggregators land once a model is listed publicly:

Two things are worth flagging clearly. First, nearly every number above comes from Google itself — there's no independently published technical report, model card with parameter counts, or outside replication of these specific results as of this article's publication. Second, third-party sites like Artificial Analysis already list Carbon on their public leaderboards, which tells you Carbon has reached at least some non-Google evaluators — likely through the limited cyber-defender and government testing access — but that's a different thing from a broad, reproducible public benchmark run. Treat every figure here as "Google says" or "a leaderboard shows," not as settled fact.

Gemini 4 Carbon vs. Claude Opus 5.5: what the early numbers show

Given how little hands-on access exists, "Gemini 4 Carbon vs Claude Opus 5.5" is less a tested comparison right now than a question people are typing into search bars while waiting for real access. The one public data point comes from Artificial Analysis's own comparison page, which lists Gemini 4 Carbon (High) scoring 60 on its Intelligence Index against Claude Opus 5.5 (Max) at 59 — a gap small enough to be noise — while pricing listed for both, after any introductory discounts lapse, lands at the same $4 per million input and $20 per million output tokens, with both models offering roughly a 1-million-token context window on that leaderboard.

Secondary coverage is split on what that means in practice. Some outlets repeat Google's framing that Carbon leads on security-specific work, while others note that Claude Opus 5.5 reportedly still scores ahead on agentic coding and office-style knowledge work in third-party comparisons. None of this is a controlled, apples-to-apples test run by a neutral outside party with full access to both models — it's leaderboard snapshots and secondhand claims. For a sense of how Anthropic's Claude models have fared in other published price-and-benchmark comparisons, see Pandromeda's look at how Claude Haiku 5.5 stacks up against Gemini 3.8 Flash on price and speed, and our coverage of Anthropic's own S-1 filing on frontier-model risk, which gives useful context for how seriously both labs are treating long-horizon, low-supervision model behavior — exactly the territory Carbon is being pitched into.

Why cybersecurity and "long-horizon" tasks, specifically

Google frames Carbon's target use case as the full defensive security workflow: spotting a vulnerability, confirming it's exploitable rather than a false positive, and generating a fix — the same lifecycle security teams already run, just with a model doing more of the heavy lifting. Google cites Wiz, the cloud security company, as reporting that Carbon leads on web penetration-testing benchmarks, and says its own Chrome team found Carbon generated meaningfully better patches than a competing lab's model in internal testing.

The "long-horizon" half of the pitch is about autonomy over time rather than a single prompt-response exchange. Google says internal teams have run Carbon on multi-step engineering tasks that continued for days, including persisting through dead ends rather than giving up or looping. That's the kind of claim that's hard to verify from the outside — it depends heavily on how a task is scoped and monitored — and it's exactly the sort of extended, lightly supervised operation that makes the model's safety numbers (lower prompt-injection success, fewer misalignment alerts) relevant rather than academic. If you want a primer on what "context window" even means for how much a model can track across a long task, Pandromeda has an explainer on context windows that's useful background here.

Safety and alignment: what Google says it changed

Google says Carbon builds on the same safety stack introduced with Argon — model-level training, real-time misuse defenses, resistance to prompt injection, and chain-of-thought monitoring — rather than introducing an entirely new safety architecture. The company points back to a separate Safety and Security report it published for Argon rather than issuing a standalone one for Carbon at launch. Combined with the lack of a published model card or parameter count for Carbon itself, that's a real gap: Google is asking cyber-defense users and government testers to rely on its own internal metrics (the halved unsupported-claims rate, the near-zero prompt-injection success rate, the reduced misalignment alerts) without an independent audit of those numbers being available yet.

That's not unusual for a staged, access-gated model launch — labs across the industry frequently ship narrow technical reports well after a model reaches wider hands — but it does mean "state-of-the-art cybersecurity model" is currently a claim resting entirely on the claimant.

What's next

A few concrete things to watch: whether Google publishes a full technical or safety report specific to Carbon (rather than pointing back to Argon's); whether the Fairwind Program expands access to a wider set of trusted partners in the coming weeks, as Google did with Argon before its October 13 general availability; and whether a public API or Google AI Studio listing appears, which is the real signal that Carbon has moved from limited testing to something developers outside the initial cyber-defender group can actually evaluate. Until then, the "Carbon vs. Opus 5.5" comparisons circulating online are built on leaderboard snapshots and secondhand claims rather than controlled, independently run tests — worth tracking, not worth treating as settled. Pandromeda will update this story as Google widens access or publishes more detailed benchmark methodology.

Written byTheo Park

Theo Park runs the AI desk at Pandromeda. He follows model launches from the frontier labs and the open-weight community, tracks the assistants and developer tools built on them, and explains what each release changes on pricing, capability and safety. His reporting leans on primary sources: model cards, technical reports, API documentation and the companies' own announcements.

More from Theo ParkAll AI coverage