Products & Services · 2026-10-29 · Team LATENT

Gemini 4 Carbon goes to cyber defenders first. Its gap over Argon in finding, exploiting, and patching vulnerabilities, and an introductory price that doubles when it ends

Google is giving Gemini 4 Carbon to a subset of cyber defenders first and has not said when developers get it. We read the gap over Argon in three stages, finding, exploiting, and patching vulnerabilities, from DeepMind's performance table and evaluation methodology. We also sort out the introductory price, which matches Argon's, the price after it ends, the Fairwind Program's conditions, and how many days Argon took to reach developers.

Find a vulnerability still lurking in a browser's JavaScript engine. Check whether it can actually be exploited. Fix the code at the root. In its Gemini 4 Carbon announcement, Google measured these three stages with separate benchmarks and said Carbon posted the top score on all three. The first people who can use Carbon are a subset of cyber defenders whose job is exactly those three stages.

Google announced Gemini 4 Carbon on October 28, 2026. It is the top model built on Gemini 4 Argon, which became available to developers on October 13, and Google positions it as its strongest model for cybersecurity and long-horizon work. Access starts this week with a subset of cyber defenders and expands in phases to trusted partners in the Fairwind Program. For developers, businesses, and consumers, the announcement says only "as soon as possible," with no date. The API price is the same introductory price as Argon's, $2 per million input tokens and $10 per million output tokens. After the introductory period ends, it becomes $4 and $20.

This article reads how much Carbon improved over Argon in three stages, finding, exploiting, and patching vulnerabilities, from DeepMind's performance table and its evaluation methodology document. It then sorts out the conditions for early access, the number of days Argon took to reach developers, and the cost after the introductory price ends. Specifications and prices were checked on October 29. Performance figures are published values from Google and Artificial Analysis, and LATENT has not used the model. The cost comparisons and the day count are LATENT's calculations from published values.

Google's announcement / DeepMind's performance table / Evaluation methodology

Key takeaways

The three cybersecurity scores rose over Argon: SEC-bench Pro from 83.4% to 88.2%, ExploitGym from 42.0% to 54.8%, and CWE-bench from 68.0% to 71.0%. Google measured SEC-bench Pro and ExploitGym with its own harness, and the other labs' figures come from their system cards. The table has no SEC-bench Pro figure for Claude Opus 5.5.
This week, only a subset of cyber defenders can use it, followed by Fairwind Program partners. Fairwind prioritizes governments, critical infrastructure, and core technology platforms, and requires phishing-resistant multi-factor authentication and usage logging. Argon took 13 days from announcement to developer availability, but Google has given no date for Carbon.
The introductory price matches Argon's at $2 input and $10 output, and both double after it ends. By Artificial Analysis's calculation at standard pricing, one Intelligence Index task costs $7.76 on Carbon, $7.68 on Argon, and $10.04 on Claude Opus 5.5. At the introductory price, Carbon is $3.88, or 39% of Opus 5.5.

Carbon is the top model released two weeks after Argon, and leads the composite index by one point

Google describes Carbon as its strongest model, with state-of-the-art cybersecurity and long-horizon capabilities. Argon was announced on September 30 and became available to developers on the paid tier of the Gemini API on October 13. Google positions Carbon as the model released two weeks after that.

As a composite measure, Google cites the Artificial Analysis Intelligence Index v5.0. Carbon leads with 59, followed by Claude Opus 5.5 at 58, GPT-6 Astra at 57, and Argon at 50. Carbon gained 9 points over Argon and finished 1 point ahead of Opus 5.5. The index was updated to its fifth version only on October 27. It is made up of nine evaluations, and 60% of its weight comes from evaluations with private test sets or held-out answers. According to Artificial Analysis, Carbon ranks first in four of the nine evaluations, HLE-Diamond, Terminal-Bench-Science, AA-Omniscience, and AutomationBench-AA, but does not lead in coding or knowledge work. On the Coding Agent Index, Carbon scores 59, second to Claude Opus 5.5 at 62.

DeepMind's performance table lists 17 benchmarks. Pulling out the rows for the composite index, coding, computer use, and long context gives the table below. The Carbon and Argon figures are pass@1 results Google measured through the Gemini API at the highest thinking setting, and the figures for the other two models are each provider's published values. Each row is a different test, so scores cannot be compared across rows.

Benchmark	Carbon	Argon	GPT-6 Astra	Claude Opus 5.5
AA Index v5.0	59	50	57	58
Vals Index v2.2	70.4%	69.2%	65.0%	70.2%
FrontierSWE 2	61.2%	55.0%	65.5%	62.3%
Terminal-Bench 4.0 (AA)	65.2%	57.1%	59.1%	59.6%
Agents' Last Exam v1.1	77.4%	69.0%	73.1%	71.6%
OSWorld-2.1 (offline)	81.5%	74.7%	80.9%	87.2%
GraphWalks (256K to 1M)	96.2%	84.2%	71.8%	66.8%

Carbon leads in 5 of the 7 rows. GPT-6 Astra is ahead on FrontierSWE 2, and Claude Opus 5.5 is ahead on OSWorld-2.1, the computer-use test. The largest gain over Argon is on GraphWalks, where accuracy in traversing graphs across long contexts of 256K to 1M tokens rose from 84.2% to 96.2%.

On long-horizon work, Google says its internal teams have run Carbon for days on tasks such as root-causing and patching subtle bugs across large codebases. On WebDev Arena, which compares generated web apps, Carbon gained 89 Elo points to reach 1768 and 4th place. According to Artificial Analysis, the context window is 1M tokens, with text, image, video, and speech input and text output. Google's announcement does not state the context window or an API model ID.

On AA-Omniscience v1.1, which measures factual knowledge, Carbon's score rose from Argon's 46 to 54, and accuracy rose from 48% to 58%. At the same time, the hallucination rate rose from 4% to 11%. Artificial Analysis writes that this is still the second lowest after Argon, well below the 50% of Claude Opus 5.5 and GPT-6 Astra.

Google's announcement / DeepMind's performance table / Evaluation methodology / Artificial Analysis article / Intelligence Index v5 announcement

Finding, exploiting, and patching vulnerabilities were measured with separate benchmarks

Google splits cyber defense into three stages, finding vulnerabilities, validating them through exploitation, and patching them, and measured each with an external benchmark. All three figures were evaluated without guardrails. The table combines the values from DeepMind's performance table with the measurement conditions in the evaluation methodology document.

Stage	Benchmark	Carbon	Argon	GPT-6 Astra	Claude Opus 5.5
Finding	SEC-bench Pro	88.2%	83.4%	85.4%	Not listed
Exploiting	ExploitGym	54.8%	42.0%	42.4%	34.5%
Patching	CWE-bench	71.0%	68.0%	68.0%	67.0%

SEC-bench Pro measures whether an agent can find and reproduce vulnerabilities in real software. Each task packages the vulnerable source revision, an instrumented binary, an example input that triggers the vulnerability, and the patched version. Google used the 183 tasks of the May 2026 JavaScript engine split, covering V8 and SpiderMonkey, and reported pass@1 averaged over 3 attempts with the Antigravity harness. A task counts as solved if the proof-of-concept input crashes only the vulnerable build. If it crashes both builds, an LLM judge checks that the crash comes from the intended vulnerability. Carbon rose 4.8 points over Argon. Its lead over GPT-6 Astra is 2.8 points, and the table has no figure for Claude Opus 5.5.

ExploitGym measures whether an agent can start from an input that triggers a vulnerability and extend it into an attack with real impact, such as unauthorized file access or code execution. It has 898 tasks built from real vulnerabilities in userspace programs, V8, and the Linux kernel. Google measured with a single attempt, no internet access, and the default setting with mitigations off, using the Antigravity harness. A task counts as solved only when the exploit captures the target flag and an LLM judge confirms it used the intended vulnerability. The methodology document says Google measured under both the default 6-hour timeout per task and an extended 10-hour timeout, but does not say which one the table's figure uses. Carbon's 54.8% is more than 12 points above Argon's 42.0% and GPT-6 Astra's 42.4%.

CWE-bench measures whether a found vulnerability can be turned into a working code fix. This figure alone comes from Collinear AI's public leaderboard, where Collinear evaluates every model. Ranking uses pass@1, with ties broken by pass@4. Carbon's 71.0% is 3 points above the 68.0% of Argon and GPT-6 Astra. At Argon's announcement, 68% was a tie for first. With Carbon, the lead is now Google's alone.

Two points deserve care when reading these figures. The first is who measured them. Google measured SEC-bench Pro and ExploitGym with its own harness, and the other labs' figures come from their system cards and technical reports. The methodology document states that figures for non-Gemini models are, as a rule, the providers' self-reported numbers. The second is the absence of guardrails. The three figures show capability without guardrails, and the model shipped as a product carries the same safety measures as Argon.

Google also cites internal results. Its success rate at generating secure code more than doubled over Argon, and the Chrome team reported that Carbon performed more than 10 times better than another lab's large frontier model at generating high-quality patches. Wiz, Google's cloud security platform, also sees Carbon leading on web penetration testing benchmarks. These are ratios and rankings only, and the underlying figures have not been published.

Google's announcement / Evaluation methodology / SEC-bench Pro paper / ExploitGym paper

Only a subset of defenders can use it this week, and there is no date for developers

Google says it is taking a deliberate approach to the rollout and is taking part in the U.S. government's voluntary pre-release model testing. Starting this week, a subset of cyber defenders can use Carbon, and access then expands in phases to trusted partners through the Fairwind Program. For developers, businesses, and consumers, Google says it will keep iterating on guardrails and then make Carbon available "as soon as possible."

The Fairwind Program is Google DeepMind's program for giving defenders early access to advanced models, and more than 650 partners worldwide take part. Three kinds of partners get priority: governments and national cyber authorities, operators of critical infrastructure in healthcare, telecommunications, energy, and finance, and core technology platforms. Participating organizations agree to user-level authentication, phishing-resistant multi-factor authentication, and access controls. Only internal cybersecurity, incident response, or penetration testing teams may use the model, and the organization must track employee access and use. Sharing, redistributing, or selling access is prohibited, and applicants undergo background checks on their security history and record of ethical operations. The permitted dual-use tasks are authorized threat simulation, reverse engineering, and malware analysis for defensive and academic research purposes. Academic labs that focus on defensive benchmarking may also apply.

As of October 29, the only model the Fairwind Program page names is Gemini 4 Argon, with no mention of Carbon. Beyond the phrase "a subset of cyber defenders" in Google's announcement, there is no way to tell who receives Carbon.

The clue to when developers in general can use it lies in Argon's timeline.

Date	What happened with Argon
September 30	Announced. A model with the cybersecurity guardrails removed went to Fairwind Program defenders and Google's internal teams
October 13	Available to developers on the paid tier of the Gemini API in Google AI Studio and Android Studio. Google AI Ultra subscribers could use it in AI Studio and Antigravity
October 14	Available on Google Cloud as model ID gemini-4-argon. Introductory pricing through November 30

Argon took 13 days from announcement to developer availability. Counting the same 13 days from Carbon's announcement on October 28 lands on November 10. But Google writes that this time it will adjust guardrails first, and it has given no date. Nothing in the announcement supports the assumption that Carbon will move at the same pace as Argon.

Google's announcement / Fairwind Program / Argon announcement (September 30) / Argon developer availability (October 13) / Google Cloud post (October 14)

The introductory price matches Argon's, and both input and output double after it ends

Carbon's pricing starts at the same introductory price as Argon's. A footnote in the announcement also gives the price after the introductory period ends.

Pricing tier	Input (per 1M tokens)	Output (per 1M tokens)
Introductory price	$2	$10
After the introductory period	$4	$20

Cached input is 95% off the input price. The announcement does not say when Carbon's introductory period ends. For Argon, Google Cloud's October 14 post stated that the introductory price runs through November 30, 2026. The Gemini API pricing page lists Argon as unavailable on the free tier and bills every token the model processes, including thinking tokens. As of October 29, the pricing page has no entry for Carbon.

At the same price, what does one piece of work cost? Artificial Analysis calculates the cost of running one Intelligence Index task at standard pricing of $4 input and $20 output. Carbon costs $7.76, almost the same as Argon's $7.68 at the same standard pricing. Claude Opus 5.5 costs $10.04 and GPT-6 Astra $6.25. Carbon's output is 123,000 tokens per task, 29% fewer than Opus 5.5's 173,000.

Because the introductory price halves both input and output relative to standard pricing, the cost of the same task also halves exactly. By LATENT's calculation, one task at the introductory price costs $3.88 on Carbon and $3.84 on Argon. Against Opus 5.5's $10.04, Carbon at the introductory price is 39%, and at standard pricing 77%. Against GPT-6 Astra's $6.25, Carbon is 62% at the introductory price and 1.24 times at standard pricing.

This calculation rests on the tokens Artificial Analysis consumed when running the Intelligence Index tasks. The cost of your own work depends on how many output tokens it generates. Carbon and Argon cost about the same per task because the price is the same and the two models consumed a similar number of tokens.

Google's announcement (footnote) / Google Cloud post / Gemini API pricing page / Artificial Analysis article

The shortcut checks and prompt-injection resistance rest mostly on Google's internal measurements

Carbon inherits the same multi-layered safety and security stack as Argon: model training, real-time misuse defenses, prompt-injection resilience, and chain-of-thought monitoring. According to Google's post on Argon's safety, the real-time defenses have three layers. Smaller models screen inputs, activation probes read the model's internal signals to detect cyberattack or biological-threat knowledge, and continuous monitoring combines signals across reasoning steps and can cut the agent off mid-stream when needed.

Google lists five improvements. The first is reducing shortcuts and loophole exploitation. On Terminal-Bench 4.0, Carbon brought successful cheating down to 0.0% and attempts to cheat down to 0.4%. The Terminal-Bench maintainers call it reward hacking when an agent resolves a task through a loophole without demonstrating the capability the task was meant to measure, and they score such trials as 0. Google's post on Argon's safety said that attempts to take shortcuts or cheat on coding benchmarks fell to 2%, but it did not name the benchmark. Whether 2% and 0.4% were measured the same way cannot be confirmed from the documents. In Google's internal live coding environments, high-severity misalignment alerts dropped by almost 80%.

The second is transparency and honesty. In internal testing, unsupported claims fell to about half of Argon's. Google says Carbon puts methodological caveats directly into the deliverable and, when an action is blocked, withholds it with a clear list of what remains required. The third is handling ambiguity. Rather than guessing, Carbon retrieves the relevant sources and surfaces discrepancies to the user before acting. The fourth is curbing both overreach and under-service, which fell 26% and 29%. The fifth is resisting prompt injection. On Gray Swan's Indirect Prompt Injection benchmark, the attack success rate went from Argon's 0.7% to 0.0%. Argon's figure was measured across 15 adaptive attempts.

Of the five, only Terminal-Bench 4.0 and the Gray Swan benchmark are external. The rest are internal measurements, and only ratios have been published for them. The three cybersecurity figures in the previous section were measured without guardrails, while the figures in this section describe the product with its safety measures in place. The two sets were measured under different conditions.

Google's announcement / Google's post on Argon's safety / Terminal-Bench maintainers' update

What developers can do now is build cost and evaluation baselines with Argon

Developers outside the Fairwind Program cannot call Carbon yet. Even so, there are three things to do now. The first is to measure the output token volume of your own work on Argon. Carbon's introductory and standard prices are the same as Argon's, and Artificial Analysis's cost per task was almost the same for the two. Measurements on Argon carry straight over to a cost estimate for Carbon. Build the estimate at the standard price of $4 and $20. Argon's introductory price ends on November 30, and no end date has been given for Carbon's.

The second is to pick evaluations close to your own work. Carbon leads the composite index, but GPT-6 Astra is ahead on FrontierSWE 2 and Claude Opus 5.5 on OSWorld-2.1. Once access opens, judge by the gap on tests close to your own work.

The third is to decide what to check when access opens. The API model ID, context window, rate limits, billing of thinking tokens, and the end date of the introductory period are all absent from this announcement. If Carbon follows Argon, every token including thinking tokens is billed, and the model is not available on the free tier.

For Japanese organizations that are government agencies, critical infrastructure operators, or core technology platforms, and that have dedicated security, incident response, or penetration testing teams, applying to the Fairwind Program is the route to early access. Academic labs working on defensive benchmarking can also apply. No review period has been given.

Fairwind Program / Gemini API pricing page / Related article: Gemini 4 Argon takes on long-running work with up to 1 million output tokens

Sources and scope

Specifications, prices, and access conditions were checked against primary sources on October 29, 2026. The announcement date follows the date on Google's blog. Performance figures are the published values in DeepMind's performance table and from Artificial Analysis, and LATENT has not used the model. For Google's internal measurements, only ratios and rankings have been published. The per-task cost at the introductory price, the cost ratios against Claude Opus 5.5 and GPT-6 Astra, and the day count from Argon's timeline are LATENT's calculations from published values. The three things developers can do now are LATENT's suggestions.