Gemini 4 Carbon pricing, plans and limits

Google announced Gemini 4 Carbon on 28 October 2026, two weeks after Gemini 4 Argon, and says it more than doubles Argon's success rate at writing secure code on internal tests. It suits approved security teams in Google's Fairwind Program today; everyone else should use Argon until Google opens the API.

Gemini 4 Carbon is Google DeepMind's frontier model for cybersecurity defense and long-running engineering work, announced in October 2026. Google reports 88.2% on SEC-bench Pro for finding real vulnerabilities, measured without guardrails. Access is limited to vetted cyber defenders through the Fairwind Program, with no public API date.

Provider: Google DeepMind · Family: Gemini 4

More about Google DeepMind on HokAI

Context window: 1,000,000 tokens

Input modalities: text, image, audio, video · Output: text

About Gemini 4 Carbon

Gemini 4 Carbon is the second Gemini 4 model from Google DeepMind, announced on 28 October 2026 in a post signed by Koray Kavukcuoglu, Google's Chief AI Architect. Google calls it its strongest model and pitches it at two jobs: finding and fixing software vulnerabilities, and staying on one hard engineering problem for a long time. It arrives about two weeks after Gemini 4 Argon. Google's announcement gives no architecture, parameter count or training cutoff for Carbon, and the Gemini API documentation has no page for the model yet.

Google's headline figures are vendor-reported, and the security tests were run without guardrails. Carbon scores 88.2% on SEC-bench Pro, which measures finding vulnerabilities in real software, 54.8% on ExploitGym, which checks whether a flaw can be exploited, and 71.0% on Collinear's CWE-bench, which scores root-cause patches. Google calls that a firm lead on each. The only independent evidence so far is one Artificial Analysis evaluation: it scored the model 59 on version 5.0 of its Intelligence Index while listing it as having no public API. That index version is new, so the figure cannot be set against the score stored for Argon, which sits on an older version.

Google also relays two partner reports. The Chrome team reported Carbon performed more than 10 times better than another lab's large frontier model at generating high-quality patches, and Wiz observed it leading on web penetration-testing benchmarks. Neither is a published study. On long-running work, Google says its own teams have watched Carbon run for days on multi-step bugs in large codebases and low-level systems, and reports a gain of 89 Elo points on WebDev Arena. None of that has been checked outside Google.

On safety, Google says Carbon keeps Argon's layered stack of training, real-time misuse defenses, prompt-injection resilience and chain-of-thought monitoring. It reports 0.0% attack success on Gray Swan's indirect prompt injection benchmark, against 0.7% for Argon, successful cheating on Terminal-Bench 4.0 cut to 0.0% with attempts at 0.4%, and almost 80% fewer high-severity misalignment alerts in internal live coding. These are Google-run results. The safety report Google links covers Argon, not Carbon.

Access is the main practical fact. From the week of the announcement Google is giving Carbon to a subset of cyber defenders, and it will widen access to trusted partners through the Fairwind Program, then to developers, businesses and consumers on an unstated date. Google puts consumers last, so the Gemini app does not offer it yet. The programme page, which still names only Argon, says it works with over 650 partners and that applicants contact their Google Cloud account team and pass background checks. Until a public release, Gemini 4 Argon is the version anyone can buy, and the Can I use it? board tracks which surfaces Carbon reaches as they open.

The Artificial Analysis page lists text, image, speech and video input, text output and a 1M-token context window, none of which Google has confirmed. It measured 82.5 output tokens per second and about 200M output tokens to run its Index, which it calls very verbose, at $7.76 per task. Price a real workload before committing, not a token.

Teams to plan around it are security groups that already work with Google and engineering groups with a long patch backlog. Anyone who needs a frontier model now can start with GPT-6 Astra or Claude Opus 5.5, and teams in restricted cyber programmes can compare it with Gemini 3.8 Flash Cyber and GPT-5.6 Cyber. Our walkthrough on how to choose the right LLM covers the decision by job, and models with contexts above 400K tokens lists long-context options you can use today. The rest of Google's lineup sits on the Google DeepMind models page, our analysis of Google's Gemini line covers the consumer side, and the last round of frontier launches compares the frontier models that preceded Gemini 4.

Pricing

Not yet purchasable: Carbon is absent from the Gemini API pricing page, and Artificial Analysis records no public API. Google says it will launch at the same introductory price as [Gemini 4 Argon](/hub/models/gemini-4-argon), that is $2.00 on input and $10.00 on output for every million tokens, with cached input priced 95% below the input rate. Google says $4.00 and $20.00 apply after the introductory period. Google gave no end date for Carbon; Argon's runs to 30 November 2026. Artificial Analysis already lists the $4.00 and $20.00 rates. Batch, priority and free-tier terms are unpublished. Budget from the higher rate and compare cost per task with [GPT-6 Astra](/hub/models/gpt-6-astra), since Artificial Analysis measured heavy output volume.

What a real job costs

Budgets: 20-page PDF = 30k in / 1k out · Support reply = 2k in / 300 out · Coding agent run = 200k in / 20k out. Computed from the vendor's per-token prices at render time; cached-input discounts are not applied.

Key Features

• Vulnerability discovery: Google reports a lead on SEC-bench Pro, a test of finding real flaws in real-world software, measured without guardrails.
• Exploit validation and patching: Scores 54.8% on ExploitGym for checking whether a flaw is exploitable and 71.0% on Collinear's CWE-bench for writing root-cause fixes, per Google.
• Long-horizon persistence: Google cites internal runs lasting days on bug hunts that span big codebases and low-level code; nobody outside Google has verified it.
• Prompt-injection resistance: Resisted every evaluated attack in Gray Swan's indirect prompt injection test, a 0.0% success rate by Google's count.
• Multimodal input: Artificial Analysis lists text, image, speech and video input with text output and a 1M-token context window; Google has published no spec.

Pros

• Three named external cyber benchmarks, one per defense stage, give security teams something concrete to reproduce on their own code.
• Alignment is described with measurable targets such as cheating attempts, overreach and unsupported claims, not adjectives.
• Launch price is set equal to Argon's, so an existing Argon bill is a fair first estimate of cost.

Cons

• No public API, pricing-page entry or model documentation yet, so a typical team cannot test it.
• Almost every score is vendor-run; the one independent figure is a single Artificial Analysis evaluation of a model that has no public API.
• The cyber benchmarks ran without guardrails, so they may overstate what a released, guarded build does.

Benchmarks

• AA Intelligence Index: 59 cited: Artificial Analysis · 30 Oct 2026 — Composite of 10 evaluations run by Artificial Analysis, 0 to 100.
• Output speed: 83 tok/s cited: Artificial Analysis · 30 Oct 2026 — Median tokens written per second as measured by Artificial Analysis.

A benchmark is an exam, not the job. Scores transfer unevenly between tasks, so weigh the one closest to your workload and read every figure with its source.

Visit Gemini 4 Carbon Official Page