Gemini 4 Carbon goes to cyber defenders first, at $2 per million input tokens

Google has announced Gemini 4 Carbon, which it calls its strongest model, with what it describes as state-of-the-art cybersecurity and long-horizon capabilities [1]. The first people to use it will not be developers or paying Gemini subscribers. Starting this week, Google says, Carbon goes to a subset of cyber defenders, and access then widens to more trusted partners through its Fairwind Program [1]. Developers, businesses and consumers get it “as soon as possible”, with no date attached [1]. The API price is already public: $2 per million input tokens and $10 per million output tokens at launch, rising to $4 and $20 after an introductory period of unstated length [1].

What was announced

Carbon follows Gemini 4 Argon, which Google says launched two weeks ago [1]. Google presents it as a step up in coding, agentic work and cyber defence, and says its internal teams have seen Carbon run for days on multi-step engineering problems such as root-causing and patching subtle bugs across large codebases and low-level systems [1]. The announcement is signed by Koray Kavukcuoglu, Google’s chief AI architect [1].

The rollout is the unusual part. Google says it is taking a deliberate approach and is engaged in the US government’s voluntary process for pre-release model testing [1]. The first users are cyber defenders, admitted through Fairwind [1]. Google’s Fairwind page describes the programme as early access for high-priority defenders such as governments, healthcare providers and telecommunications services, so they can build defences before new threats arrive [3]. Applicants are vetted, including background checks on the organisation’s security history and record of ethical operations [3]. Participants must use user-level authentication and phishing-resistant MFA, may give access only to internal cybersecurity, incident response or penetration testing teams, must track employee use, and may not share, redistribute or sell access [3]. The page currently describes partners getting exclusive access to Argon and using it inside CodeMender, a code security agent [3]. Google says it will keep gathering feedback and refining guardrails before Carbon reaches its product surfaces [1].

Pricing is set in advance. Google says Carbon will launch at the same introductory price as Argon: $2 per million input tokens and $10 per million output tokens, with cached input tokens priced at 95% off the input price [1]. A footnote on the announcement says that after the introductory period expires, $4 per million input tokens and $20 per million output tokens will apply [1]. How long the introductory period lasts is not public.

The benchmark figures in the announcement are Google’s, and Google says the external cyber benchmarks were run without guardrails [1]. It reports 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on ExploitGym for exploitation, and 71.0% on CWE-bench for patching [1]. It says Carbon gained 89 Elo points to reach fourth place on WebDev Arena at 1768 [1]. On its own internal benchmarks it claims more than double Argon’s success rate at generating secure code, and it says the Chrome team found Carbon more than 10 times better than another lab’s large frontier model at generating high-quality patches [1]. Those are internal comparisons, and the other lab and model are not named.

One ranking does come from outside. Artificial Analysis lists Gemini 4 Carbon (High) first on its Intelligence Index with a score of 59, ahead of Claude Opus 5.5 at 58 and 57 for its two listed settings [2]. That index was revised recently. Nathan Lambert, writing at Interconnects, calls it the most prominent independent intelligence metric for frontier models and argues that the new version leans toward measuring where frontier models are heading, which widens the gap to open models [5]. A one-point lead on a freshly reweighted index is a narrow margin to choose a vendor on.

Google also makes safety claims. It says Carbon cut successful cheating on Terminal-Bench 4.0 to 0.0%, with attempts at 0.4%, and that high-severity misalignment alerts in live coding with its own teams fell by almost 80% [1]. It says Carbon cuts unsupported claims roughly in half compared with Argon, reduced overreach by 26% and under-service by 29%, and had a 0.0% attack success rate on Gray Swan’s indirect prompt-injection benchmark, where Argon was at 0.7% [1]. Investing.com’s report repeats the Terminal-Bench and Gray Swan figures from the announcement [4]; none has been independently reproduced in a source we fetched.

What changed, and for whom

For most people who pay for Gemini, nothing changes this week. Carbon is not in the Gemini app or the public API yet [1]. What has changed is the ceiling. Google now has a model it says beats Argon on coding and cyber work, and it has said what it will charge [1]. If you plan budgets around Gemini, the useful number is the second one: at $4 and $20 per million tokens, Carbon would cost twice the introductory rate once that period ends [1].

For security teams at governments, critical infrastructure operators and large technology platforms, there is a route in now. Fairwind takes applications and Google says it prioritises governments and the partners most critical to societal resilience [3]. The conditions are strict, and the access is for defensive and research work only, including authorised threat simulation, reverse engineering and malware analysis [3].

For developers comparing frontier models, Carbon’s arrival makes the leaderboard more crowded rather than settled. On the Artificial Analysis index, the top three entries are within two points of each other [2]. Gemini, Claude and ChatGPT buyers should compare on their own tasks, cost per finished job and availability, not on a single index score.

Who it is for — and not

Carbon, as announced, is for cyber defenders first. Google’s description of where it shines, finding vulnerabilities, checking which ones are exploitable and writing patches, is the work of security teams [1]. The long-horizon claims, a model that keeps working for days through dead ends, are aimed at large engineering organisations with big codebases [1].

It is not, for now, for a small business or a solo developer. You cannot use it, and you do not know when you will be able to [1]. If your work is writing, support, research or routine coding, the gap between Carbon and the models you can already buy has not been shown on your tasks. The figures that would tell you are mostly Google’s own, and the outside index that ranks Carbon first was revised recently [2][5].

There is a broader signal in how this was released. Google is putting its most capable cyber model in front of vetted defenders before the public, and tying that to a government testing process [1][3]. Expect more launches where the announcement and the general release are separated by weeks, and plan procurement on what is available, not on what has been announced.

This page will be updated when Google names a release date for developers and consumers, when the introductory price period is defined, or when an independent evaluation of Carbon’s cyber or safety claims is published.

∴ Carbon has a price but no public release date; most Gemini buyers should keep planning around Argon for now.