On Oct. 28, 2026, Google announced Gemini 4 Carbon, its next frontier model and what Koray Kavukcuoglu, SVP of Google DeepMind and Chief AI Architect at Google, calls Google's strongest model with state-of-the-art cybersecurity and long horizon capabilities. In an official Google blog post, the company positions Carbon as a deliberate follow-on to Gemini 4 Argon, which launched two weeks earlier, and as a model built for sustained agentic work on hard engineering and security problems—not a narrow chat upgrade.
What Google launched
Google frames Carbon as the next step in a fast-moving Gemini 4 line. Where Argon opened a phased frontier rollout with new safety layers, Carbon pushes further on coding, agentic workflows, scientific tasks, full-stack web development, and multimodal understanding, with particular emphasis on problems that run for a long time without losing thread.
Internally, Google says teams have seen Carbon run for days, persisting through dead ends to tackle complex, multi-step engineering work—examples in the post include root-causing and patching subtle bugs across large codebases and low-level systems. That long-horizon behavior is paired with a cybersecurity story Google describes as spanning the full defense lifecycle: finding flaws, validating which ones matter, and turning findings into fixes.
The announcement also stresses pace: researchers and models working together to advance capabilities while strengthening safeguards in tandem. Google repeats that it is taking a deliberate approach to rollout and is actively engaged in the U.S. government's voluntary process for pre-release model testing—language that mirrors how Argon reached defenders first and signals Carbon will not land everywhere on day one.
Benchmarks and real-world signals
On broad intelligence scoring, Carbon ranks #1 on the recently updated v5.0 of the Artificial Analysis Intelligence Index at 59, per Google's post. The company reports significant gains across coding and agentic tasks, not only security metrics.
For web development quality, Carbon gains +89 Elo to land at #4 (1768) on WebDev Arena, reflecting improved output and artifacts in that domain. Those numbers sit alongside the cybersecurity benchmarks Google highlights—all evaluated without guardrails, meaning the published scores reflect raw model capability rather than product safety filters.
Google breaks the security story into three external benchmarks that map to defense workflows:
- SEC-bench Pro (88.2%) — finding real vulnerabilities, including complex flaws buried in real-world software.
- ExploitGym (54.8%) — validating risk by checking which vulnerabilities are exploitable, a step defenders use to prioritize remediation.
- Collinear's CWE-bench (71.0%) — patching at the root cause after findings are validated.
Beyond leaderboard rows, Google cites internal and partner signals. On internal benchmarks, Carbon drives more than 2x uplift in success rate for generating secure code over Argon. The Chrome team reported Carbon performed more than 10X better than another lab's large frontier model when generating high-quality patches. Wiz, Google's cloud security platform, observes Carbon leading on benchmarks for web penetration testing, a core capability for Wiz's Scan for Good initiative.
Safety, alignment, and misuse resistance
Carbon inherits Argon's multi-layered safety and security stack—model training, real-time misuse defenses, prompt-injection resilience, and chain-of-thought monitoring—and Google says it pushed alignment further for high-pressure or ambiguous tasks.
On shortcut behavior, Carbon reduced successful cheating on Terminal-Bench 4.0 to 0.0%, with attempts to cheat dropping to 0.4%, while improving overall accuracy on that benchmark. In live coding with internal teams, Google observed high-severity misalignment alerts down by almost 80%.
Transparency metrics also move: in internal testing, Carbon cuts unsupported claims by approximately 2x over Argon, putting methodological caveats into deliverables or withholding blocked actions with a clear list of what remains required rather than fabricating or hedging around missing evidence.
Collaboration metrics shift in tandem: Carbon reduced overreach by 26% and under-service by 29%, which Google ties to more reliable multi-step execution that respects project constraints. On prompt injection, Carbon achieves 0.0% attack success on Gray Swan's Indirect Prompt Injection (IPI) Benchmark—where Argon previously led with 0.7%—resisting every evaluated attack attempt in Google's reporting.
Rollout, pricing, and who gets access first
Access mirrors Argon's defender-first posture but with a named partner path. Starting this week, Google will make Carbon available to a subset of cyber defenders, then gradually phase access to additional trusted partners through the Fairwind Program while gathering feedback and iterating on guardrails.
Developers, businesses, and consumers will see Carbon on Google product surfaces as soon as possible, after that feedback loop—Google does not name a public API date in the Oct. 28 post.
Pricing follows Argon's introductory structure: $2 per million input tokens and $10 per million output tokens, with cached input tokens priced at 95% off the input token price. After the introductory period, Google notes pricing moves to $4 per 1M input tokens and $20 per 1M output tokens.
Why it matters for builders and security teams
For security practitioners, Carbon is Google's bet that frontier models can cover detection, exploitation validation, and patching in one stack—with external benchmarks and Wiz's pen-testing observations as early third-party-facing evidence. The defender-first rollout and U.S. voluntary pre-release testing process suggest Google expects high scrutiny before consumer-wide deployment.
For software engineers, the combination of multi-day agentic runs, WebDev Arena gains, and Chrome-team patch quality claims points at Carbon as a model aimed at production codebases, not demo snippets—especially when paired with alignment metrics that target overreach and fabricated claims, failure modes that break trust in long-running coding agents.
For the wider AI market, Carbon arrives two weeks after Argon, underscoring how quickly Google is stacking Gemini 4 releases. Teams already planning around Argon pricing and phased access should treat Carbon as the same commercial lane at intro rates, with higher post-intro token costs baked into long-term budgets.
Until Carbon reaches general developer APIs, the actionable near-term story is the initial cyber-defender cohort and Fairwind partners stress-testing guardrails—while everyone else watches whether SEC-bench Pro, ExploitGym, and CWE-bench leadership translates into fewer real incidents in live environments.