AI Tools Review Editorial TeamTwo weeks after Gemini 4 Argon, Google has already moved the goalposts again. Gemini 4 Carbon, announced by Koray Kavukcuoglu on 28/10/2026, is pitched as Google's strongest model, with state-of-the-art cybersecurity and long-horizon capabilities. It is also a model most people cannot use yet.
Sourcing: every number in this article comes from Google's launch post and its evaluation table, with secondary coverage from OfficeChai and Gulf News. Google also publishes a methodology page. No independent lab has reproduced the results, and Google says several were run 'without guardrails', so treat them as a vendor claim. For the model that came first, read our Gemini 4 Argon review and the earlier Carbon leak analysis.
Matthew Berman walks through Google's Carbon announcement and the launch post.
WorldofAI covers Carbon alongside pricing, access and the rest of the week's AI news.
Executive Summary
- What it is: Gemini 4 Carbon, Google DeepMind's newest frontier model, announced 28/10/2026, two weeks after Gemini 4 Argon.
- Headline claim: #1 on the updated Artificial Analysis Intelligence Index v5.0 with a score of 59.
- Cyber results: 88.2% SEC-bench Pro (finding vulnerabilities), 54.8% ExploitGym (exploitation), 71.0% CWE-bench (patching).
- Long-horizon work: Google says internal teams have seen Carbon run for days on multi-step engineering tasks such as root-causing subtle bugs in low-level systems.
- Safety claims: 0.0% on the Gray Swan indirect prompt injection benchmark, 0.0% successful cheating on Terminal-Bench 4.0, high-severity misalignment alerts down almost 80% in live internal coding.
- Access: a subset of cyber defenders now, phased to more trusted partners via the Fairwind Program. No general release date.
- Price: $2 / $10 per million input / output tokens during an introductory period, then $4 / $20.
What Is Gemini 4 Carbon?
Google frames the release around two strengths: cybersecurity defence and long-horizon agentic work. Carbon builds on Argon, which Google released two weeks earlier, and the announcement stresses the pace: 'our researchers and models are working hand in hand to advance capabilities faster, while strengthening our safeguards in tandem'. That sentence is worth reading twice, because it hints that Google is now using its own models to accelerate model development.
Unusually, the launch is as much about release process as capability. Google says it is engaged in the US government's voluntary process for pre-release model testing, and that it will make Carbon available first to a subset of cyber defenders, then gradually to additional trusted partners through the Fairwind Program. Only after feedback on guardrails will it come to developers, businesses and consumers 'as soon as possible'. We cover the lineage in our Argon global release article.
The Benchmark Table, Row by Row
| Benchmark | Carbon | Argon | GPT-6 Astra | Claude Opus 5.5 | Claude Fable 5.1 |
|---|---|---|---|---|---|
| AA Intelligence Index v5.0 | 59 | 50 | 57 | 58 | 49 |
| Vals Index v2.2 | 70.4% | 69.2% | 65.0% | 70.2% | n/a |
| SWE-sweep | 9.6% | 4.3% | 9.5% | 3.6% | 2.9% |
| FrontierSWE 2 | 61.2% | 55.0% | 65.5% | 62.3% | 56.3% |
| Terminal-Bench 4.0 (AA) | 65.2% | 57.1% | 59.1% | 59.6% | 52.0% |
| Agents' Last Exam v1.1 | 77.4% | 69.0% | 73.1% | 71.6% | n/a |
| OSWorld-2.1 (offline subset) | 81.5% | 74.7% | 80.9% | 87.2% | 76.8% |
| AutomationBench (Zapier) | 53.9% | 51.3% | 41.4% | 42.5% | 31.4% |
| Vending-Bench 2 (bank balance) | $16,484 | $13,718 | $15,515 | $9,235 | $5,422 |
| GraphWalks (256k to 1M, BFS F1) | 96.2% | 84.2% | 71.8% | 66.8% | 65.0% |
| RiemannBench | 80.0% | 76.0% | 72.0% | 69.6% | 65.6% |
| CWE-bench | 71.0% | 68.0% | 68.0% | 67.0% | 58.0% |
| ExploitGym | 54.8% | 42.0% | 42.4% | 34.5% | n/a |
| SEC-bench Pro | 88.2% | 83.4% | 85.4% | n/a | n/a |
Several things stand out. First, the headline lead is narrow: 59 against 58 and 57 on the AA Index is a one or two point margin, well within what a different harness or prompt could move. Second, the gaps are largest in places Google has chosen to emphasise. ExploitGym is 54.8% against 42.0% for Argon, and GraphWalks long-context retrieval is 96.2% against 84.2% for Argon and 66.8% for Opus 5.5. Third, Carbon is not first everywhere: GPT-6 Astra leads FrontierSWE 2 and Claude Opus 5.5 leads the offline OSWorld subset.
A caution on reading it. Vending-Bench 2, which scores a simulated business's bank balance, is the kind of benchmark where variance between runs is high, and a dash in a cell means the vendor did not report or could not run that model, not a zero. The full methodology sits on Google's evaluation page, which you should read before quoting any single row. For how the rivals compare in more detail, see our Claude Opus 5.5 vs GPT-6 Astra breakdown.
Cyber Defence: Find, Validate, Fix
Finding: SEC-bench Pro
Carbon's 88.2% on SEC-bench Pro is described as 'autonomously uncovering complex flaws buried in real-world software'. The chart above puts it 2.8 points above GPT-6 Astra and 4.8 above Argon. Notice what else is on the chart: GPT-6.1 Terra (83.3%) and GPT-6.1 Sol (78.8%), plus open-weight models such as DeepSeek-V4-Pro at 56.4%. The open models trail by a large margin on this task.
Validating: ExploitGym
Defenders increasingly use models to decide which findings are genuinely exploitable and therefore worth fixing first. Carbon sets what Google calls a new state of the art on ExploitGym at 54.8%, up from 42.0% for Argon. This is the dual-use number: the same ability that prioritises a patch can help write an exploit. It is the main reason access is gated.
Fixing: CWE-bench and the Chrome result
On Collinear's CWE-bench, which measures turning validated findings into working fixes, Carbon reaches 71.0%, compared with 68.0% for Argon and GPT-6 Astra. Google adds two customer data points: more than 2x uplift in secure-code generation success over Argon on internal benchmarks, and a report from the Chrome team that Carbon performed more than 10x better than another lab's large frontier model at generating high-quality patches. Wiz, Google's cloud security platform, also reports Carbon leading on web penetration testing benchmarks. Both are Google-affiliated sources and unnamed comparisons, so weigh them accordingly.
For the real-world context of AI-discovered flaws, see our report on PHP2Shell, an AI-found PHP vulnerability and OpenAI's Astra critical-cyber classification.
Long-Horizon Engineering
The announcement describes internal teams watching Carbon run for days on tasks such as root-causing and patching subtle bugs across large codebases and low-level systems. The model also gains +89 Elo points on WebDev Arena, landing at #4 with 1768 (some outlets quote 1769). Google highlights improvements in full-stack web development and multimodal understanding too.
The table supports parts of this story. Terminal-Bench 4.0 at 65.2% against Argon's 57.1% and Astra's 59.1%, and Agents' Last Exam at 77.4%, show a clear step up on agentic tasks. But on FrontierSWE 2, a software engineering evaluation, Carbon's 61.2% is below both Astra and Opus 5.5. Days-long autonomy is an anecdote from Google's own teams, not a benchmark you can reproduce, and the figure that matters for your work is how often it finishes a task correctly on your codebase.
Safety, Alignment and Prompt Injection
- Shortcuts: successful cheating on Terminal-Bench 4.0 fell to 0.0%, with cheating attempts at 0.4%, while accuracy improved.
- Misalignment alerts: high-severity alerts in live internal coding environments dropped by almost 80%.
- Honesty: unsupported claims are cut by roughly 2x versus Argon. Carbon adds methodological caveats to deliverables or withholds blocked actions rather than fabricating evidence.
- Scope: overreach is down 26% and under-service down 29%, so it stays inside the project constraints more reliably.
- Ambiguity: rather than guessing, Carbon retrieves sources and surfaces discrepancies before acting.
The prompt injection result matters most for agents that read untrusted web pages and documents. A 0.0% rate means no evaluated attack succeeded in 15 attempts, but a benchmark is a fixed set of attacks: it does not prove an attacker with a new technique cannot succeed. The same applies to the cheating figures, which are measured on Google's chosen environments. Google also published a Safety and Security report for Argon, and says Carbon builds on it, but we have not seen a standalone system card with frontier-risk thresholds for Carbon.
Pricing and Access
After the introductory period, $4 and $20 per million will apply. In pounds that is roughly £1.50 / £7.50 now and £3 / £15 later, at a rough exchange rate, so check current rates before budgeting. Remember, though, that there is currently no public API: the price describes where Google intends to land, and the people who can actually buy tokens are the cyber defenders in the first cohort. Our API pricing comparison tracks how this sits against rivals.
If you want to prepare, the practical route is to build on Argon, which is available, and keep your prompts and tool definitions portable so that moving to Carbon is a model-name change. Julian Goldie's video below makes the same suggestion, using Argon inside Antigravity.
Julian Goldie SEO summarises the numbers Google published and how to get ready with Argon.
Limitations and Open Questions
- Vendor numbers. Almost everything is from Google. Some outlets note the security and reliability data comes from internal testing that still needs independent verification.
- Narrow overall lead. 59 vs 58 vs 57 on the AA Index will not survive a harness change unscathed.
- Not best at coding or computer use. Astra leads FrontierSWE 2, and Opus 5.5 leads OSWorld-2.1 offline by 5.7 points.
- Dual-use risk. A model that is best at exploitation (ExploitGym) and unguarded in evaluation could be misused, which is why the gated rollout exists.
- No public API or date. You cannot yet test it on your own work.
- Benchmarks run 'without guardrails'. The shipped product, with guardrails, may score differently.
How It Compares With Opus 5.5, GPT-6 Astra and Argon
Against Gemini 4 Argon, Carbon is better on every row Google lists, often by 5 to 12 points. Against GPT-6 Astra, it wins most rows but loses FrontierSWE 2. Against Claude Opus 5.5, it wins most rows, trails on OSWorld and is level on the Vals Index (70.4% vs 70.2%). Against Anthropic's Fable 5.1, it wins everywhere Fable is reported. The honest summary is that Carbon is the best-reported model on Google's chosen set, with a clear lead only in cyber, long-context retrieval and a few agentic tasks.
Read it alongside our Opus 5.5 vs Astra comparison and the GPT-6.1 Terra review for the competitive picture.
Who Should Care?
Security teams and software vendors are the obvious audience. If you run vulnerability management, product security or an open-source project, Carbon could change triage and patching, and the Fairwind Program is the route to early access. Developers and AI buyers should treat it as a signal of where Argon-class pricing and capability are heading, not as something to plan a project around this month. Everyone else should watch for three things: independent evaluations, a public API with a date, and a full system card.
The Bottom Line
Gemini 4 Carbon is a credible step up from Argon, and Google's cyber numbers, 88.2% on SEC-bench Pro, 54.8% on ExploitGym and 71.0% on CWE-bench, are the most striking in the table. The safety claims, particularly 0.0% on Gray Swan prompt injection and almost 80% fewer high-severity misalignment alerts, are encouraging if they hold up.
But it is a gated preview, the headline lead is a point or two, and every figure is Google's. Wait for independent evaluation before switching anything. Until then, Argon remains the model you can actually use.
Sources
Last updated: 29/10/2026. Benchmark figures are Google DeepMind's own, taken from its launch post and evaluation table. We will update this article when independent evaluations, a public API or the system documentation appear.
Get the free guide: Claude vs ChatGPT, Gemini & Grok
A 20-page playbook covering everything you need to choose and use the big four AI models in 2026, full cost and feature comparisons, what each is best (and worst) at, and how-tos for images, vectors, building a website, Claude Code and more.
