Gemini 4 Carbon: cyberdefense under restricted access

Google announced Gemini 4 Carbon on 28 October 2026, a model aimed at long-running tasks and cybersecurity. Initial access is restricted to a group of cyber defenders. The published price is not the same thing as a contract on offer, and the company has not given a date for general access.

Per Google, Carbon reached first place on the Artificial Analysis Intelligence Index v5.0, with a score of 59. The announced introductory price is US$ 2 per million input tokens and US$ 10 per million output tokens. After the introductory period, the rates move to US$ 4 and US$ 20 respectively, with no transition date disclosed. The rates do not make the model contractable by anyone without access. The company also published results for identifying, exploiting and fixing vulnerabilities in tests run without guardrails, the protections that can limit a model's responses or actions.

What Google announced about Gemini 4 Carbon

Google presented Gemini 4 Carbon on 28 October for long-running software engineering and cyber defense. The announcement brings together a position on a general index, security tests and internal claims about code generation. Each measure has a different scope and has to be read inside that scope.

On SEC-bench Pro, which covers vulnerability identification, the declared score was 88.2%. On ExploitGym, which evaluates exploitation, it was 54.8%. On CWE-bench, Google reported 71.0% for fixing vulnerabilities of known CWE classes in real code. The tests use their own tasks and conditions: none of those percentages describes the model's universal performance in production.

In an internal secure-code benchmark, Google states that Carbon succeeded more than twice as often as Gemini 4 Argon. The Chrome team, according to the company, reported performance more than 10 times better at generating high-quality patches compared with a rival frontier model. That result does not report a gain for any codebase.

On model behavior, Google reports about half the unsupported claims relative to Argon and a reduction of roughly 80% in severe misalignment alerts observed by its teams in internal coding environments. On Terminal-Bench 4.0, the rate of cheating attempts fell to 0.4%, according to the company. Attempts and successes are distinct measures.

Artificial Analysis publishes the Intelligence Index, reports a score of 59 for Carbon and describes its evaluations as independent. The index does not prove patch safety. The relation between the result Google published and the independent evaluation on the CWE-bench scoreboard remains unclear.

Why Carbon's price is a comparison trap

The announced introductory price for Gemini 4 Carbon is US$ 2 per million input tokens and US$ 10 per million output tokens. Per SecurityWeek, on 29 October, the rates move to US$ 4 and US$ 20 after the introductory period. The change has no disclosed date.

The later rate is double the initial one. In both phases, output costs five times input. Projecting the introductory rate as permanent underestimates the later one; without a transition date, there is no basis for spreading them across months.

When comparing vendors, the team has to consult the current rate tables, separate input from output and check the conditions that apply to the organization.

The comparison of price and coding models situates the economics per token. Before the arithmetic, access to Carbon has to be confirmed. Latency data, local billing and cost per task in production are missing.

What the access restriction changes for buyers

Initial access to Gemini 4 Carbon starts with a subset of cyber defenders and should expand gradually to partners through Fairwind, Google said in the announcement. Per SecurityWeek, the program brings together more than 650 organizations. Membership was not presented as a guarantee of immediate access to Carbon.

Price does not confirm eligibility. A company inside the initial group can evaluate the model under the conditions it receives; outside it, the rate table is not an offer that can already be contracted. Google intends to broaden access, but announced no date and no general-availability commitment. Planning a workflow that depends on Carbon before confirmation creates project risk, without proving interruption or delay.

The more than 650 organizations are Fairwind participants, not a count of Carbon customers.

Once access and terms of use are confirmed, the team can evaluate Carbon; until then, the plan has to work with the models it can reach.

What the security benchmarks say and what they do not

The benchmarks Google published cover distinct stages of security work: finding a vulnerability, testing its exploitation and proposing a fix. The scores orient test hypotheses, but they do not demonstrate performance in each organization's repositories and controls. The results are not interchangeable and have to be assessed one at a time.

SEC-bench Pro and ExploitGym measure tasks under specific conditions, not general detection or exploitation rates in any environment.

The CWE-bench v1 scoreboard describes audit and fix tasks in real repositories and presents Carbon's result as pass@1, under the conditions published for the test. Google released the result in its announcement; the scoreboard states that Artificial Analysis evaluated and published the results of the reserved set independently. The sources consulted do not clarify whether the scoreboard run is a separate reproduction of the run Google published, nor do they establish the relation between the two. No first-party test of Carbon underpins this analysis.

Per Google, the three cybersecurity results were evaluated without guardrails. They do not report performance in a deployment with filters and restrictions, nor the access conditions of each partner.

On the Gray Swan indirect prompt injection benchmark, Google reports that no attack tested succeeded against Carbon, against 0.7% success against Argon. Indirect injection is the attempt to change a model's behavior through instructions inserted into material it reads. Zero success on that set does not prove protection against every possible attack.

The Chrome patches call for caution. The result Google reported does not replace review, regression tests and validation in the application environment. Third-party ownership of a benchmark does not make the run Google published independent.

How teams in Brazil should handle this launch now

The most prudent decision is to preserve the budget and the workflows that depend on models already accessible, while access to Gemini 4 Carbon remains restricted. To compare alternatives, the team has to separate the announced price, the possibility of contracting and the result obtained in its own tests. Authorized access comes first.

1. Do not replan the budget around the introductory rate. Record US$ 2 and US$ 10 for input and output as promotional values, alongside US$ 4 and US$ 20 after the period. Without a transition date, the spreadsheet must not invent how many months each rate will hold.

2. Test a substitute already released to the organization. For agents that execute code or probe for flaws, define targets and windows that are expressly authorized, and use a disposable sandbox segregated from production, with no production credentials. Block access to unauthorized networks and assets and control network egress according to scope. A policy external to the model should limit tools and permissions to what is needed.

Authorized data has to be classified and minimized, with conditions approved for sending, retention and deletion by the vendor. Set time, resource and cost limits, monitor the run and keep a stop mechanism. Execution traces should protect sensitive data. High-impact actions require prior human approval, as does merging code after patch review and security and regression tests. A text-only test can require a smaller scope; results obtained without guardrails do not waive controls proportional to tool use.

1. Record the access dependency as a risk. Identify the affected workflow, who confirms eligibility, the available alternative and the review point. In the announcement consulted, there is no public date for general release on the timeline. Without confirmation, the alternative stays as the operating plan.

A Google lab result orients the test, but it provides no cost per task and guarantees no superiority on the set the organization chooses. No exploitation should reach assets without authorization, even with a defensive objective.

The article on calibrated decisions in model routing covers the choice between models on verifiable criteria. A score can justify interest, but the test requires authorized access. Nexforce Router users should confirm the models available in their environment, without assuming Carbon is in the catalog.

Frequently asked questions

Gemini 4 Carbon was announced for long-running tasks and cybersecurity, with initial access restricted to a group of cyber defenders. With no general-availability date, the interested company has to confirm its own eligibility and the terms of use before planning around the model. The announcement guarantees no contract.

What is Gemini 4 Carbon?

It is an AI model announced by Google on 28 October 2026 for long-running tasks and cybersecurity, and the company published results for finding, exploiting and fixing vulnerabilities. Those scores describe evaluations presented by the vendor, not guaranteed performance in production.

Is Gemini 4 Carbon available to the public?

The announcement disclosed no availability to the general public. Google reported initial access for a subset of cyber defenders and gradual expansion to partners through Fairwind. The company announced no general-availability date, and each organization has to confirm its own eligibility and access conditions.

How much does Gemini 4 Carbon cost?

Per SecurityWeek, the introductory price is US$ 2 per million input tokens and US$ 10 per million output tokens. After the introductory period, it moves to US$ 4 and US$ 20 respectively. The date of the change is unknown.

What is Fairwind?

Fairwind is the program through which Google expects to expand Gemini 4 Carbon access to partners gradually. SecurityWeek reported that it brings together more than 650 organizations. That total refers to the program, not to the number of organizations using Carbon.

Does Gemini 4 Carbon replace Argon?

Google reported results for Carbon that were superior to Argon in specific tests, including secure code generation. That does not mean replacement for every user: access is restricted, and fitness depends on the task and the conditions available.

References and Further Reading

Google's announcement describes the launch and the tests without guardrails; SecurityWeek reports the later rates and the number of organizations in Fairwind. The Artificial Analysis index and the CWE-bench scoreboard let a reader check the results and separate what is independent measurement from what is a vendor statement.

Check the limits.

What to check before switching models

Nexforce Router is routing infrastructure, but without confirmed access to Carbon there is no first-party test that supports including it in a routing rule. Before switching a model in production, compare cost per completed task, p95 latency, refusal rate and performance on your own evaluation set.

A public benchmark measures the slice defined by whoever published it, and that slice may not cover the organization's real workflow. Measure first. The accessible alternative stays in the evaluation.