Ing. Calogero Bono
On October 28, 2026, Google unveiled Gemini 4 Carbon, which it describes as its most powerful model, with state-of-the-art capabilities in cybersecurity and long-running tasks. It arrives just two weeks after Gemini 4 Argon. For now it is available only to a small group of cyber defenders, while Google says developers, businesses and everyday users will get it “as soon as possible.” It matters because it shifts the focus from simply chatting with AI to the ability to find vulnerabilities, fix them and work on a project for days, with direct effects on anyone who manages websites, software and servers.
A few terms first, before we get into the facts. A benchmark is a standardized test used to compare different models on the same tasks. A token is the unit models use to count text, roughly a piece of a word, and prices are calculated per million tokens. An agentic workflow is a task in which the model decides and carries out multiple steps in sequence, without you telling it every move. A prompt injection is an attack that hides malicious instructions in a text or web page to make the model go off track. Guardrails are the limits and controls that stop the model from doing dangerous things.
What is Gemini 4 Carbon?
It is the latest model in the Gemini 4 family, introduced on the Google blog by Koray Kavukcuoglu, Senior Vice President of Google DeepMind and Chief AI Architect. The key line in the post is that Carbon is “our strongest model with state-of-the-art cybersecurity and long horizon capabilities,” meaning the company’s most powerful model, with leading performance in cybersecurity and in tasks that require extended time.
The pace is the first big news. Argon came out two weeks earlier, and Carbon outperforms it in several areas. According to 9to5Google, Google explains the speed by saying researchers and models are working “hand in hand to advance capabilities faster.” The model was also reportedly improved based on feedback from the previous launch, in coding, agents, scientific tasks, full-stack web development and multimodal understanding.
Sundar Pichai also commented on X, as reported by Gulf News, citing the ANI news agency. He wrote “I did say we’d be releasing our models periodically” and presented Carbon as “our next frontier model.” He added that “Carbon shows the pace at which we’re pushing the frontier” and that protections were strengthened. These are the words of someone selling a product, and they should be read as such.
How well does it perform in benchmarks?
All the numbers below are claimed by Google and have not been verified by independent third parties. Google notes that external benchmarks were run without guardrails, meaning without the limits the model will have in real-world use.
General intelligence
On the Artificial Analysis Intelligence Index v5.0, Carbon ranks first with 59 points. It is a composite index designed to give models an overall score, useful as an indication but not a guarantee that the model will work better for your specific case.
Cybersecurity
This is where Google puts the most emphasis. The reported results are as follows.
- SEC-bench Pro, which measures the ability to find vulnerabilities, 88.2%. 9to5Google describes a “firm lead.”
- ExploitGym, which measures exploitation of vulnerabilities, 54.8%.
- CWE-bench, which measures writing patches, 71.0%.
This should be read with balance. A model that finds and exploits flaws is useful to defenders, but the same ability in the wrong hands would be a problem. That is why access management, discussed below, is part of the story and not a side detail.
Web development
On WebDev Arena, Carbon gains 89 Elo points and ranks fourth, with 1768 according to Google. 9to5Google reports 1769, a minimal difference we note for transparency. So it is not first overall. In web development, at least on this leaderboard, three models are still ahead.
What does working on a project for days actually mean?
Google says Carbon is designed for multi-step agentic workflows. Gulf News picks up the phrase “complex, multi-step engineering tasks over longer periods,” meaning complex engineering work, in several phases, over extended periods. According to Google, internal teams have watched it work for days, track down the cause of subtle bugs and fix them in large codebases and low-level systems.
In practical terms, the difference from a chat assistant is autonomy. You no longer ask for a code snippet. Instead you assign a goal, and the model explores, tests, verifies and tries again. Anyone who has already used AI to write and review code, as our guide to Gemini for developers explains, knows the bottleneck is rarely the first draft. It is verifying the result. A model that sustains long sessions promises to reduce exactly that friction, but only if its results can be checked.
How it handles doubts
According to 9to5Google, when faced with ambiguous requests Carbon retrieves sources and flags inconsistencies to the user before acting. If an action is blocked, it adds methodological warnings or does not carry it out, listing what is missing. This is sensible behavior for an agent that works over long periods, because an early error that goes unnoticed carries through every later step.
Secure code and patches
On secure code, Google claims a more than twofold increase in success rate over Argon on internal benchmarks. The Chrome team reports “more than 10X better” results than another major frontier model in generating quality patches. That competitor is named neither by Google nor by Gulf News, so the comparison cannot be reproduced by readers. Wiz, again according to Google, ranks Carbon first on web penetration testing benchmarks.
How much does it cost and who can use it?
For now you cannot use it, unless you fall into a specific category. Starting this week Carbon is available to “a subset of cyber defenders.” It will then gradually reach trusted partners through the Fairwind Program. Google is also taking part in the voluntary pre-release testing process of the US government. Availability for developers, businesses and consumers is promised “as soon as possible,” after more feedback and improved guardrails. 9to5Google reports the line “Coming soon to developers, businesses, and consumers.”
The introductory price is 2 dollars per million input tokens and 10 dollars per million output tokens, the same as Argon. Cached input gets a 95% discount. After the introductory period, pricing moves to 4 dollars for input and 20 for output.
Some quick math to make it concrete, ours and not Google’s. Processing one million input tokens and one million output tokens costs 12 dollars during the introductory period and 24 afterward. One million cached input tokens would cost about 0.10 dollars instead of 2 during the introductory period. The doubling of list prices after the introduction is the figure to keep in mind if you are preparing a budget.
How does Google say it made the model safer?
Google states that Carbon keeps the same levels of protection as Argon, namely targeted training, real-time defenses, resistance to prompt injection and monitoring of reasoning. It then cites a series of internal measures, all claimed by the company.
- Cheating on Terminal-Bench 4.0 at 0.0%, with attempts at 0.4%.
- Serious misalignment alerts in coding tests down by about 80%.
- Unsupported claims halved compared with Argon.
- Overreach, meaning doing more than requested, down 26%.
- Under-service, meaning doing less than requested, down 29%.
- Prompt injection measured with Gray Swan IPI at 0.0% successful attacks, versus 0.7% for Argon.
The prompt injection figure is the most interesting for anyone building agents that read emails, web pages or external documents. It remains a result on a single benchmark, though. Zero successful attacks on one test does not mean zero successful attacks in the real world, where attackers invent new variants.
Limitations to know
Everything we know comes from Google’s announcement and from outlets repeating it. The sources contain no independent evaluations of the benchmarks. It is also worth remembering that external tests were run without guardrails, so the numbers describe raw potential rather than the behavior of the final product.
- The competitor outperformed more than tenfold on patches is not named, so the comparison cannot be checked.
- The WebDev Arena figures differ by one point between Google and 9to5Google.
- There is no date for opening access to developers, businesses and consumers.
- The introductory price is temporary and the length of the period is not stated.
- We do not know what it will realistically cost to have Carbon work for days, because it depends on the tokens consumed.
Almost anything about access could change, since Google itself says guardrails will be improved before opening. Benchmark results could also vary once third-party tests arrive.
What changes for people who work with digital tools
For now, in practice, almost nothing, because you do not have access. But the direction is clear and it is worth preparing.
If you manage a website or a business system, the most concrete part is security. A model that finds vulnerabilities and proposes patches effectively brings code analysis within reach of those without a dedicated team. At the same time, the same technology lowers the bar for attackers. We have already covered how this scenario affects small Italian businesses in our piece on the first AI-created virus. Known flaws need to be closed quickly, and for a WordPress site that means timely updates and, if the worst happens, knowing how to respond, as we explain in our guide to manual malware removal.
If you develop software, agents that work for days change how work is distributed. Time shifts from writing to reviewing. Knowing how to trace the cause of a problem remains a valuable skill even when the model proposes the fix, for example by knowing how to find the commit that introduced a bug and comparing the AI’s diagnosis with the real history of the code.
If you run a server, automatic patches do not replace orderly management. A service like managed server hosting with security updates exists precisely so you do not depend on the timeliness of any single fix. If instead you need to integrate models into your processes, a custom software project lets you decide where AI can act and where it must stop and ask for confirmation.
Our take
Carbon is an important release, but it is worth separating signal from noise. The signal is that Google chose to present its flagship model starting from cybersecurity, not from creativity or chat. It is a coherent choice for a market where business demand increasingly centers on tasks with measurable value, such as finding a flaw or closing a ticket.
The noise is the pile of percentages without context. An 88.2% on SEC-bench Pro or a 0.0% prompt injection rate only makes sense with methodology, data and the possibility of replication. Today we have the numbers but not third-party proof. Even the comparison with an anonymous competitor, ten times behind, is the kind of statement a careful newsroom cannot verify and therefore should not repeat as fact.
A critical note on access. Opening up to defenders first is a reasonable choice for a model capable of exploiting vulnerabilities, but it does not solve the timing question. A small Italian business owner is unlikely to be among the selected “cyber defenders,” so over the coming months the technology will be used first by large organizations. The gap between those with early access and those without is a concrete risk, not a theoretical one.
Finally, pricing. The doubling after the introductory period is the most underrated element. If you build a service on top of a model, the steady-state cost matters more than the launch offer. Our advice is always to calculate the worst case, the one at 4 and 20 dollars, before promising a price to a client.
Frequently asked questions
Is Gemini 4 Carbon already available?
Not to everyone. Starting this week it is open to a subset of cyber defenders, and will then reach trusted partners through the Fairwind Program. For developers, businesses and consumers, Google says it will arrive as soon as possible, with no date given.
How much does Gemini 4 Carbon cost?
During the introductory period it costs 2 dollars per million input tokens and 10 for output. Afterward it moves to 4 and 20 dollars. Cached input has a 95% discount.
Is it the best AI model available?
According to Google it ranks first on the Artificial Analysis Intelligence Index v5.0 with 59 points. It is not first in everything, since it ranks fourth on WebDev Arena. The data is claimed by the company and we do not yet have independent verification.
What is the difference between Carbon and Argon?
Carbon arrives two weeks after Argon and, according to Google, more than doubles the success rate on secure code in internal benchmarks. It keeps the same introductory prices and the same safety levels, with claimed improvements on prompt injection and unsupported claims.
Can it be used to attack systems?
The risk exists, because the model is also evaluated on exploiting vulnerabilities, scoring 54.8% on ExploitGym. Google responds with limited access, real-time defenses and pre-release testing with the US government. How sufficient these measures are will only become clear with real-world use.
What to watch in the coming months, and how to prepare
Three things really matter. The first is the date of general availability and how guardrails will change. The second is the arrival of independent tests on the security results. The third is the price list after the introductory period. In the meantime you can make a few simple moves.
- Get your website, plugin and server updates in order, because automated patching and analysis will make known flaws even faster to exploit.
- Budget using the full price of 4 and 20 dollars, not the introductory one, if you plan to integrate a model into your processes, perhaps starting with the Gemini APIs in Python.
- Before handing long tasks to an agent, define what it may change and what must go through human review, with code review always happening afterward.
Sources
