Google DeepMind announced Gemini 4 Carbon on October 28, 2026, and the model is not on sale. Access starts this week with a subset of cyber defenders, widens through the company’s Fairwind Program, and reaches developers, businesses and consumers at a date the announcement does not give. The page puts Carbon first on an industry index, states its price, and turns access into the scarce part of the release.
What was actually released
Carbon is the next frontier model from Google DeepMind and the successor to Gemini 4 Argon, which shipped two weeks earlier. Google positions it as its strongest model on cybersecurity and long-horizon work, with coding and agentic tasks as the target. Internally, the page says, teams have seen Carbon run for days, persisting through dead ends on multi-step work such as root-causing subtle bugs in large codebases.
Availability separates this from a normal launch. Google is taking part in the U.S. government’s voluntary pre-release testing process, opens Carbon this week to a subset of cyber defenders, and widens access gradually through the Fairwind Program. Developers, businesses and consumers are promised it “as soon as possible” and “soon”, with no date on either phrase.
The price is published, with one addition Argon’s page lacked. Carbon launches at the same introductory rate, $2 per million input tokens and $10 per million output tokens, with cached input at 95 percent off the input price. A footnote states that $4 per million input tokens and $20 per million output tokens apply after the introductory period, and the page gives no date on which that period ends.
What a buyer can act on today
- A published rate: $2 per million input tokens and $10 per million output tokens, called introductory.
- A named price after the discount: $4 and $20, more budgeting information than the Argon launch carried.
- Cached input at 95 percent off, the number that decides what an agentic workload costs.
- One door, the Fairwind Program, while everyone else waits.
What the claim rests on
The headline is a ranking. Google says Carbon places first on the recently updated v5.0 of the Artificial Analysis Intelligence Index at 59, an index the page links but whose breakdown it does not reproduce. The rest falls into two groups to read apart: external harnesses whose scores Google reports, and internal measurements nobody outside the company can inspect.
| Benchmark | Score | What it measures | Reported by |
|---|---|---|---|
| Artificial Analysis Intelligence Index v5.0 | 59, first | Blended capability index | Google, index run elsewhere |
| SEC-bench Pro | 88.2% | Finding real vulnerabilities | Google, external harness |
| ExploitGym | 54.8% | Checking which findings are exploitable | Google, external harness |
| CWE-bench | 71.0% | Turning a validated finding into a patch | Google, external harness |
| WebDev Arena | 1768, fourth | Full-stack web development quality | Google, arena run elsewhere |
| Secure code generation | More than 2x over Argon | Success rate on internal tests | Google, internal |
| Patch quality | More than 10X | Against an unnamed frontier model | Google, internal |
Two details govern those numbers. The page states the cybersecurity benchmarks are evaluated without guardrails, so the scores describe a model with its safety layer out of the measurement, not what a defender would deploy. And the largest internal claim, Chrome generating patches more than 10X better than “another lab’s large frontier model”, arrives with no competitor named, no sample size and no acceptance rate, while Wiz is described as seeing Carbon lead on web penetration testing without a published score.
The safety figures arrive the same way, as internal drops. Google writes that Carbon cut successful cheating on Terminal-Bench 4.0 to 0.0 percent with attempts at 0.4 percent, that high-severity misalignment alerts fell by almost 80 percent in its live coding environments, that unsupported claims were halved against Argon, that overreach fell 26 percent and under-service 29 percent, and that Gray Swan prompt injection resistance moved from Argon’s 0.7 percent attack success rate to 0.0 percent. No run is published with its method.
Gemini 4 Carbon is our strongest model with state-of-the-art cybersecurity and long horizon capabilities.
What the page does not publish
No date for general availability and no end date for the introductory rate. No Carbon token limit, where Argon shipped with a one million token combined limit. No latency, throughput or serving cost. No eligibility rule for the Fairwind Program, no sample sizes behind the internal comparisons, no name for the lab Chrome measured against, and no evaluation run by anyone who does not work with Google. The safety report it links covers the Gemini 4 family, not Carbon alone.
On this page
What it changes for security teams and buyers
Capability stopped being the constraint. A team that wants Carbon in a pipeline has to be selected into a cohort or wait, so the question is no longer which model scores highest but which model you can call this quarter. A first place on an index is not an entitlement to an endpoint.
Patch quality is the claim a buyer can test: the share of generated fixes a maintainer accepts, which security teams already measure. Google’s 10X cannot be verified, the direction of it can, and the right request is an acceptance rate on your own repository rather than a comparison to an unnamed model.
The guardrails note is the one to carry into a vendor call. An exploitation score of 54.8 percent and a finding score of 88.2 percent are defense planning numbers produced with the safety layer off, so the figure a defender needs, the same task with guardrails on, is not published. A cached input token at 95 percent off lands at $0.10 per million, the plain input rate of a small model such as Claude Haiku 5.5, so the cost side is legible while the capability side is not.
The Neural Minute take
The most useful number in this launch is a footnote. Argon’s page called its rate introductory and stopped there. Carbon’s page carries the same $2 and $10, then states what the rate becomes, $4 and $20 per million tokens, turning an open-ended discount into a discount with a known expiry price and an unknown expiry date. That is the difference between a price a team can model and a price it has to accept.
The rest is capability marketing reported as measurement. Carbon leads an index most readers cannot audit, on benchmarks the page itself calls unguarded, in a rollout where the model is not available to the people reading the post. A model ranked first that almost nobody can call is an asset in a sales deck before it is a product. The ranking is the announcement, access is the news.
What would change it: a general availability date, a technical report with per-benchmark method and sample sizes, an evaluation run outside Google’s partnerships, and the Fairwind criteria written down. Until then, the honest summary is a strong claim about a model handed to a small group of defenders, next to a price schedule a budget can hold.
Sources
- Google DeepMind, “Introducing Gemini 4 Carbon”, published October 28, 2026, by Koray Kavukcuoglu, senior vice president at Google DeepMind, for the price and its footnote, the rollout and every benchmark and safety figure: https://blog.google/innovation-and-ai/models-and-research/gemini-models/introducing-gemini-4-carbon/
- Google DeepMind, “Gemini 4 Argon: Built to solve your hardest problems”, published October 13, 2026, for the Argon rate and the one million token limit Carbon does not restate: https://blog.google/innovation-and-ai/models-and-research/gemini-models/introducing-gemini-4-argon/
- Our own reading, October 29, 2026: the page carries no general availability date, no end date for the introductory rate, no Carbon token limit, and no evaluation run outside Google or its partners.