ai cybersecurity

Published 30 October 2026. Access, pricing and benchmark details verified on 30 October. Sections 2, 6 and 8 will be updated as Google expands access.

Gemini 4 Carbon now leads the Artificial Analysis Intelligence Index, and Google reports the strongest cybersecurity scores it has published for any model. Almost nobody can use it. Since its announcement on 28 October, Carbon has been limited to “a subset of cyber defenders”, with more trusted partners to follow through Google DeepMind’s Fairwind Program. Google hasn’t given a date for developers, businesses or consumers.

So the short answer is no: unless your organisation has been invited, you can’t call Gemini 4 Carbon today. Gemini 4 Argon, its predecessor, has been generally available since 13 October and is the model you can build on now. The more useful question is what an Argon team should do while it waits. Carbon’s launch price and Argon’s 1 December price rise make that more pressing than it looks.

Key Takeaways

• Carbon isn’t publicly available. Access is limited to selected cyber defenders, then Fairwind partners. It has no public model ID and no listing on the Gemini API pricing page as of 30 October.
• Argon is the model you can use. It’s a stable Gemini API model at $2 input and $10 output per million tokens until 30 November, then $4 and $20.
• Carbon’s lead is real on Artificial Analysis. It scores 59 at High effort, against 50 for Argon and 52 for Claude Opus 5.5 at the same setting.
• The cyber scores are Google’s own, measured without guardrails. SEC-bench Pro tests reproducing known bugs, not discovering new ones.
• Don’t rebuild around a model you can’t call. Keep Argon in production, put model choice behind a configuration switch, and keep an evaluation set ready for Carbon.

---

Quick Navigation

---

What Gemini 4 Carbon’s announcement changes

Google DeepMind’s Koray Kavukcuoglu introduced Carbon as “our strongest model with state-of-the-art cybersecurity and long horizon capabilities”. The pitch has two parts. One is security work: finding, exploiting and patching vulnerabilities. The other is long-running engineering: Google says Carbon has worked internally for days on multi-step tasks, such as root-causing and fixing bugs across large codebases.

The timing is awkward for anyone who just adopted Argon. Argon was announced on 30 September through the same cyber-defender route and reached the Gemini app and the paid API on 13 October. Carbon arrived 15 days later and is described as Argon’s successor. Teams that spent the past fortnight integrating Argon are now reading about a better model in the same family.

What hasn’t changed is what you can deploy. Every number in Carbon’s announcement describes a model most readers can’t call yet.

Can you use Gemini 4 Carbon right now?

No, not unless Google has invited your organisation. Google says Carbon is available from the week of 28 October to “a subset of cyber defenders”, with access to be “phased to additional trusted partners” through the Fairwind Program. Broader availability for developers, businesses and consumers will come “as soon as possible”. No date has been given.

The two groups aren’t the same. The first wave is a hand-picked subset of defenders. Fairwind is a standing application programme. Its public page says it prioritises governments, national cyber authorities, critical-infrastructure operators, core technology platforms and academic defensive-research labs. It works with more than 650 partners and vets applicants, including background checks. Partners must use phishing-resistant multi-factor authentication, limit access to internal security teams and must not resell or share access. As of 30 October, that page still describes Fairwind access in terms of Argon, so Carbon-specific terms haven’t been published.

For everyone else, three practical facts matter:

• No model ID. Carbon has no published identifier, and it isn’t on the Gemini API pricing page. Any code written today would be guesswork.
• No public API. Artificial Analysis notes that its Carbon price and speed figures are estimates for that reason.
• Argon is the deployable option. Its model page lists gemini-4-argon as a stable model with Batch, Flex and Priority inference and a shared 1M-token context window.

Google also says Carbon went through the US government’s voluntary pre-release testing process. That helps explain the pace. A staged rollout gives Google time to watch how a strong security model is used before opening the API.

Gemini 4 Carbon vs Argon: the comparison that matters

	Gemini 4 Argon	Gemini 4 Carbon
Announced	30 September 2026	28 October 2026
Availability	Generally available since 13 October (Gemini app, paid API)	Selected cyber defenders, then Fairwind partners; no general date
Model ID	gemini-4-argon (stable)	Not published
Intended use	General frontier model, strong on security	Strongest Gemini model; long-horizon engineering and cyber defence
Artificial Analysis Index v5.0 (High)	50	59 (ranked first)
Cost per Index task (AA estimate)	$7.68	$7.76
Cyber benchmarks	Google cites relative gains only, e.g. more than 2× on an internal secure-code test	SEC-bench Pro 88.2%, ExploitGym 54.8%, CWE-bench 71.0% (Google-reported)
Gray Swan indirect prompt injection	0.7% attack success (Google-reported)	0.0% (Google-reported)
Price, per million tokens	$2 / $10 until 30 Nov; $4 / $20 from 1 Dec	$2 / $10 introductory; $4 / $20 afterwards; end date not stated
Developer readiness	Production-ready	Not yet callable

The independent row is the one to read first. Artificial Analysis scores Carbon 59 and Argon 50, both at High effort, on its nine-evaluation v5.0 index. The headline “Carbon beats Opus 5.5” story needs a qualifier: Claude Opus 5.5 scores 58 at maximum effort but 52 at High. At matched settings, Carbon’s lead is wider than the leaderboard’s top two rows suggest.

The cost row is the surprise. Priced at the same $4/$20 standard rates, Carbon cost $7.76 per index task against Argon’s $7.68. It used slightly more output tokens per task, 123,000 against 116,000, and scored nine points higher. If that holds on real workloads, Carbon would deliver more capability for nearly the same spend per task. That’s a reason to test it when you can, not a reason to stop shipping on Argon now.

We haven’t put Argon’s cyber benchmark scores in the table because Google hasn’t published comparable ones. Its Argon post shows results only in chart images, and apart from Gray Swan, Carbon’s post compares against Argon only in relative terms.

What Gemini 4 Carbon’s cybersecurity scores measure

Google arranges its security results along the defender’s workflow: find a flaw, prove it matters, fix it. All three numbers are Google’s own, and its announcement says the external benchmarks were run “without guardrails”. That’s the right way to measure capability and the wrong way to estimate what a guarded production deployment will do.

Find: SEC-bench Pro, 88.2%

The name suggests hunting for unknown bugs, but SEC-bench Pro measures something narrower. Its 344 tasks give a model a disclosed vulnerability in V8, SpiderMonkey or the Linux kernel, with the report, and ask it to produce a proof-of-concept input that triggers the bug. In the paper’s own runs, the best agent, Codex with GPT-5.5, solved 58%. Google reports 88.2% for Carbon. That’s a large jump in turning a bug report into a reproducer, which is real, tedious defender work. It isn’t evidence that Carbon finds zero-days at that rate.

Prove: ExploitGym, 54.8%

ExploitGym, from Berkeley’s RDI and collaborators including Google, OpenAI and Anthropic, asks an agent to turn a known vulnerability into a working exploit that captures a flag. Its 898 tasks span userspace C/C++ programs, V8 and the Linux kernel. In the May paper, the best agent captured 157 flags, about 17%, with protections such as ASLR switched off. Google’s 54.8% for Carbon is far higher. Google hasn’t said which task subset, time limit or mitigation settings it used, and those choices can move the score a lot.

Exploitation sounds like the attacker’s job, and it is also the defender’s. A proven exploit separates the bug that has to be patched tonight from the one that can wait for a release cycle.

Fix: CWE-bench, 71.0%

Collinear’s CWE-bench grades agents on repairing weaknesses across a codebase, not just the instance they were shown. Its launch example gave no credit to agents that patched a known token-revocation path but missed a newly introduced one. At launch in September, no agent repaired a majority of tasks, and the leader scored 47%. Google reports 71.0% for Carbon. This is the most directly useful of the three scores for most security teams.

Prompt injection: Gemini 4 Carbon’s Gray Swan result

On Gray Swan’s indirect prompt-injection benchmark, Google reports a 0.0% attack success rate for Carbon, down from Argon’s 0.7%. That measures how often hidden instructions in content the model reads succeed against a specific attack set. It’s encouraging for agents that browse or read email. A zero on a benchmark still isn’t a guarantee, as our piece on hidden flaws in a passing red-team test explains: attackers adapt, and a fixed test doesn’t.

How much cyber capability should be public?

A model that writes working exploits for kernel bugs is useful to a defender triaging a backlog and to an attacker choosing a target. Google’s answer is to control who gets access first, and its documents describe a programme built for that. Fairwind vets organisations, restricts use to internal security teams and bans “malicious tasks such as creating malware”. None of that requires guessing at Google’s motives.

Moonshot AI took a different route with Kimi K3.1 Pro, whose open weights are due by 4 November. Its release post says it removed cyber-related data from mid-training and reinforcement-learning tasks before releasing the weights. On Moonshot’s own unpublished vulnerability and exploitation test, xdev-bench-hard, the released model scored 81.0% (pass@3) against 90.5% for an unfiltered checkpoint.

The two approaches aren’t equivalent. Moonshot reduced capability and then gave everyone the weights. Google kept capability and is choosing who gets it. Moonshot’s chart also shows DeepSeek V4.1 Flash, already open, at 85.7% on the same test, above the filtered Kimi model. Once one strong open model exists, filtering the next one changes less than it seems. Gating, meanwhile, holds only as long as the API stays closed.

For buyers, the practical consequence is simpler. If your work needs Carbon-level security capability, you’ll be dealing with an access programme, its usage terms and its audit requirements, not only an API key.

Gemini 4 Carbon pricing: is there a reason to wait?

Google says Carbon launches at Argon’s introductory rates: $2 per million input tokens and $10 per million output tokens, with cached input at 95% off. After an introductory period it moves to $4 and $20. Google hasn’t said when that period ends. Don’t assume it follows Argon’s schedule.

Argon’s dates are fixed. The Gemini API pricing page lists $2/$10 through 30 November and $4/$20 from 1 December, with Batch and Flex at half those rates and Priority above them. We covered what that doubling does to real workloads in our analysis of Argon’s 1 December price change.

Tier (per 1M tokens)	Argon to 30 Nov	Argon from 1 Dec	Carbon (announced)
Standard input / output	$2 / $10	$4 / $20	$2 / $10 introductory, then $4 / $20
Cached input	$0.10	$0.20	95% off input
Batch and Flex input / output	$1 / $5	$2 / $10	Not published

There’s no price reason to wait. Argon’s introductory window will probably close before most teams can get Carbon access, and both models end at the same standard rate. The token price also isn’t the cost that matters. Artificial Analysis’s estimates, at standard rates, put the two within 1% of each other per task. On your workload, the gap will depend on how many tokens each model spends and how often its output passes your checks. That can only be measured once Carbon is callable.

What Argon users should do about Gemini 4 Carbon

If you’re running Argon in production, keep it there. A working integration with known costs and failure modes is worth more than a better model you can’t call. Use the time to make switching cheap: keep the model name in configuration, keep prompts and tool definitions model-agnostic, and keep an evaluation set of real tasks with pass criteria. When Carbon opens, swapping the model and rerunning the set is a day’s work.

• Starting a new project: build on Argon now. Don’t design around Carbon-only claims, such as multi-day autonomous runs, until you can test them.
• Security vendors and in-house security teams: apply to Fairwind if you’re eligible. Carbon’s exploit validation and repair scores are aimed at your work. Expect vetting and usage restrictions.
• Enterprise AI teams: check whether your Google Cloud or Gemini Enterprise account team can say anything about access, and plan budgets on Argon’s 1 December rates.
• Teams with strict security requirements: wait for Carbon’s documentation, data-retention terms and independent evaluations before treating it as approved. A strong prompt-injection score doesn’t replace your own testing.

The exception is a workload where Argon is clearly failing and the failure is exactly what Carbon claims to fix, such as long-horizon code repair. Even then, the move is to document the failures now so you can test Carbon against them later. Public benchmarks rarely transfer cleanly to your own workload.

Gemini 4 Carbon: what to watch next

This list will be updated as things change.

Signal	Where to look	Why it matters
A published model ID and docs page	Gemini API models documentation	The first sign you can actually call it
Carbon on the pricing page	Gemini API pricing	Confirms the introductory end date and Batch/Flex rates
Fairwind terms for Carbon	Google DeepMind Fairwind page	Who qualifies and on what conditions
Independent cyber results	Artificial Analysis Cyber Index	Compares defensive capability on a common harness
Google’s safety report	Linked from the announcement	Methodology behind the guardrail and misuse claims
Gemini app or Workspace access	Google product announcements	Consumer and business availability

Conclusion

Gemini 4 Carbon is the stronger model on every published capability measure, and for now it belongs to a small set of security organisations. Argon is available, documented and on a known price path. Build on Argon, prepare to switch with a configuration change, and judge Carbon on your own tasks once Google opens the API.

Frequently asked questions

Can I use Gemini 4 Carbon right now?

Only if Google has given your organisation access. As of 30 October 2026, Carbon is limited to a subset of cyber defenders, with more trusted partners joining through the Fairwind Program. Google hasn’t announced a date for general developer, business or consumer access.

Is Gemini 4 Carbon available through the Gemini API?

Not publicly. Carbon has no published model ID and doesn’t appear on the Gemini API pricing page as of 30 October. Artificial Analysis says its price and speed figures for Carbon are estimates because there’s no public API. Gemini 4 Argon is available through the API now.

What is the difference between Gemini 4 Carbon and Argon?

Carbon is Argon’s successor and Google’s strongest model. It scores 59 to Argon’s 50 on the Artificial Analysis Intelligence Index v5.0 at High effort, with Google-reported gains in security and long-horizon coding. Argon is generally available. Carbon is restricted.

How much does Gemini 4 Carbon cost?

Google announced introductory rates of $2 per million input tokens and $10 per million output tokens, with cached input 95% off, rising to $4 and $20 afterwards. It hasn’t said when the introductory period ends, and Carbon isn’t yet on the pricing page.

When does Gemini 4 Argon pricing increase?

On 1 December 2026. Standard rates rise from $2 to $4 per million input tokens and from $10 to $20 per million output tokens. Batch, Flex, Priority and cached-input rates double on the same date, according to Google’s Gemini API pricing page.

Is Gemini 4 Carbon better for cybersecurity?

On Google’s numbers, yes: 88.2% on SEC-bench Pro, 54.8% on ExploitGym and 71.0% on CWE-bench, measured without guardrails, plus a 0.0% attack rate on Gray Swan’s prompt-injection test. These are vendor results, and independent cyber evaluations of Carbon haven’t been published yet.

Why is Google restricting Carbon’s initial access?

Google calls it a “deliberate approach to rollout”. Carbon can reproduce and exploit vulnerabilities at levels Google calls state of the art, and Google describes Fairwind as giving vetted defenders “a critical head start”. Google also says Carbon went through the US government’s voluntary pre-release testing.

Should developers wait for Carbon before building with Argon?

Generally not. Argon is available now, and Carbon has no public date. Build on Argon with the model name in configuration and an evaluation set ready, then test Carbon when you can. The exception is a project that depends on capabilities only Carbon claims and can afford to wait.

---

Keep reading

Here are the latest posts from the blog.