Google didn’t announce another model. It announced the model it had been keeping for a small group of cybersecurity defenders for two weeks, and now it’s opening it to anyone willing to pay. Gemini 4 Carbon arrived on November 10 as the company’s strongest model, at a launch price exactly one quarter of its direct rival’s — with an expiration date: on November 30, the price doubles.
The play is transparent. Carbon isn’t competing to be the everyday model. It’s competing to be the model for the hardest work — long coding jobs, security, and science — and to do it cheaper per task than anyone else. The question is whether the numbers Google shows hold up outside its own showcase. Partly yes, partly no, and the part that doesn’t is exactly the part that made the most headlines.
Everything below comes from Google’s official announcement on November 10 and the original announcement from October 28, with a clear mark on what is Google’s claim and what is independently verified data from November 11.
What Carbon is, and why Google kept it locked up for two weeks
Carbon was announced on October 28 in a post signed by Koray Kavukcuoglu, SVP of Google DeepMind, and from the first paragraph Google called it its strongest model, with “state-of-the-art cybersecurity and long horizon capabilities.” But it didn’t open it to anyone: for two weeks, only a group of cybersecurity defenders inside its Fairwind Program used it, while Google ran it through the U.S. government’s voluntary pre-release testing process and refined its safeguards. On November 10, general availability arrived.
Carbon builds on Gemini 4 Argon, launched two weeks earlier, and Google is clear about the division of labor: Argon remains the ideal choice for most software engineering and knowledge work. Carbon is for the tasks that test the limits of a model — complex, multi-step coding and debugging, open-ended scientific research — using more tokens than Argon to explore thoroughly, reason deeply, and run extended verification loops. It has a context window of up to one million tokens and goes by gemini-4-carbon in the API.
One confusion worth clearing up: Carbon has nothing to do with Gemini Omni 1.2 Flash, the video model Google launched on November 5. Omni generates clips up to 15 seconds long; Carbon reasons, writes code, and hunts for vulnerabilities. They’re two different families that happen to share a last name, and this article doesn’t repeat anything from that one.
The price: cheap per token until November 30
The number developers will notice first is the price. In the API, Carbon costs $2 per million input tokens and $10 per million output tokens through November 30, the same launch price as Argon. Starting December 1, the rate doubles: $4 and $20. Cached input runs $0.10 per million through November 30 and $0.20 after that. There is no free tier: Google’s own pricing page says Carbon is not available on the free tier.
The comparison Google wants you to make is with Anthropic. Claude Fable 5.2, launched the day before, costs $8 and $40 per million tokens: Carbon comes in at a quarter of that on both lines. From December 1, Carbon will cost exactly what Claude Opus 5.5 costs, $4 and $20. The cheap window lasts three weeks, and Google puts a date on it rather than selling it as an open-ended discount.
The fine print is that the price per token isn’t the bill per task. Carbon spends more thinking tokens per turn than Argon — Google’s own documentation says so — and those tokens are billed as output. A model that thinks longer can cost more per task even while charging less per token. In the Gemini app, Carbon only reaches Google AI Ultra subscribers, the most expensive plan; Plus and Pro subscribers don’t get it, and The Verge notes Google hasn’t said when, or if, it will reach the lower tiers.
The benchmarks: where it wins according to Google, and where it loses according to everyone else
Google presents Carbon as number one on three third-party agent benchmarks: CursorBench 4.0, from Cursor; WANDR, from Perplexity; and AutomationBench, from Zapier, at “more than 2X lower cost per task” than the next best outside model. Those are Google’s claims about third-party tests, not an independent ranking, and they should be read that way.
The official table Google published on October 28 has a bit of everything. On the Artificial Analysis Index v5.0, Carbon scores 59, ahead of Argon at 50, GPT-6 Astra at 57, and Opus 5.5 at 58. On AutomationBench it reaches 53.9%, against 51.3% for Argon and 31.4% for Fable 5.1. On Terminal-Bench 4.0 it scores 65.2%, and on GraphWalks, a long-context test, 96.2%. But the same table has losses: on FrontierSWE 2, Carbon sits at 61.2% while GPT-6 Astra reaches 65.5%, and on OSWorld-2.1, Opus 5.5 beats it with 87.2% against 81.5%.
Google also launched a new benchmark with Artificial Analysis, the Multimodal Knowledge Agent test, where Carbon ranks second at more than six times lower average cost per task than the model ahead of it. And in finance, it matched the best model tested on Hebbia’s E2E Financial Agentic evaluation and ranked first among 23 configurations on Balyasny’s General Financial Intelligence benchmark.
The counterpoint arrived on November 11, from the independent ranking. On the Artificial Analysis Intelligence Index, Carbon scores 60 and ranks fourth, behind all three settings of Fable 5.2: 65 at maximum effort, 62 at extra-high, and 62 at high. The good news for Google is the cost per task: $7.76 for Carbon, against $9.08 for Fable at high effort and $26.54 at maximum. The bad news is the clock: Carbon averages 26.1 minutes per task, against 16.9 for Fable. And in Anthropic’s own table, Fable wins FrontierCode 2.0 with 49.1% against 41.1% for Carbon, though Carbon answers back on AutomationBench with 53.9% against 51.4%.
The honest read is that there is no clear winner, just two models with different profiles: Fable leads the general index and runs faster; Carbon costs less per task and wins the agent workflow tests. Anyone picking by the “number one” headline gets it wrong in both directions.
Cybersecurity: the ground where Carbon rules
If there is one area where Carbon is beyond argument, it’s cybersecurity. Google pitches it as its strongest model for defense, and the numbers it publishes are the highest in its table: 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on ExploitGym for checking whether they’re exploitable, and 71.0% on CWE-bench for patching them. There is a footnote in Google’s own small print: those outside evaluations were run with the safeguards turned off.
The real-world examples are the most impressive part. In Project Fortify, Google’s autonomous system for scanning, triage, and remediation, Carbon hit 100% recall on scanning and 95% precision on triage in an internal benchmark, and improved on Argon’s recall on open-source code by more than 25% in relative terms. Google Cloud’s vulnerability research team used Carbon to prove that two bugs in a widely used open-source program were exploitable vulnerabilities, comparable in severity to the PHP2Shell exploit, and the maintainers reclassified them as critical. And in Wiz’s Scan for Good program, Carbon found zero-day vulnerabilities in under two hours in two major software providers, compressing weeks of research into a single afternoon.
The warning not to miss: the strongest cybersecurity capabilities aren’t in the public Carbon. The version called Carbon for cyber only goes to verified defenders inside the Fairwind Program. What reaches the API is the general model with its safeguards on. It’s a deliberate distinction, and it explains why Google kept the model gated for two weeks.
/swarm and the science: from an agent swarm to verifying Signal’s code
Alongside Carbon, Google previewed /swarm in Antigravity: a command that turns a single prompt into a coordinated team of agents you can track in real time. The idea is to give Carbon the roles that demand the deepest reasoning — architectural design, coordination, and auditing — while faster, lighter models work in parallel in isolated workspaces, with adversarial verifiers testing every change.
The example Google chose to show off isn’t a benchmark, it’s a formal verification. Using a new framework called AlphaProof Code, researchers used Carbon alongside other models to mathematically prove the security properties of libsignal, the reference implementation of Signal’s cryptographic protocol. The agents generated millions of lines of Lean code, the language of mathematical proofs, and finished in weeks a job that takes expert teams years.
In science, Carbon is already the leading model for drug toxicity company Axiom Bio, which says it found new toxicity mechanisms it hadn’t seen before. On enzyme assay development, the model diagnosed subtle wet-lab artifacts from lab notebooks and raw data, and on protein structure prediction it discovered remote homologs across petabase-scale sequence archives, increasing the homologs retrieved by 40 times on average across seven families from the CASP17 blind test set. Google also extended its program giving 10,000 scientists free access for six months to Carbon.
Safety: 99% of attacks blocked, zero prompt injection
A model with these cybersecurity capabilities needs brakes to match, and Google spent a good part of the announcement on them. In simulated cyberattack environments, Carbon blocked 99% of attack trajectories from an adaptive red-teaming agent, and the per-attempt breach rate fell to 0.8%, down from 3.1% on Argon. In Gray Swan’s testing, the automated cyberattack query success rate dropped to 2.17%, against 9.86% for Argon, and outside lab Trajectory Labs found zero new universal jailbreaks across 132 hours and more than 13,000 requests.
The number Google pushes hardest is prompt injection: Carbon scored a 0% attack success rate on Gray Swan’s indirect prompt injection benchmark, the first time any model has hit that mark. On a 375-task honesty benchmark it passed 92%, against 70% for Argon, declining to fill in missing experimental data 98% of the time. It also cut successful cheating on Terminal-Bench 4.0 to 0.0% and high-severity misalignment alerts in live coding by almost 80%.
Those are Google’s own numbers, not an independent lab’s, but they point the right way for a model that, by design, knows how to find and exploit vulnerabilities. Safety here isn’t a section of the announcement: it’s the condition for the model to exist outside Google at all.
Who can use it, and what it really costs
Carbon is already available in the paid tier of the Gemini API, in AI Studio and Android Studio, and for enterprises in Gemini for business. For consumers, it reaches Google AI Ultra subscribers in the Gemini app, in AI Mode in Search, and in Antigravity. And on November 10, the same day as the opening, GitHub made it generally available in Copilot for Pro+, Max, Business, and Enterprise plans, with a gradual rollout and billing at the provider’s list price.
Google itself recommends not starting with Carbon. For most engineering and knowledge work, its advice is Argon, moving up to Carbon only when the task demands it: multi-package migrations, cross-subsystem root-cause investigations, or architectural redesigns. Carbon offers configurable thinking levels — low, medium, and high — to trade quality against latency and cost, and Google warns that at higher levels it may be slow, time out, or burn more tokens to squeeze out maximum performance.
The real cost depends on how much you ask it to think. At high effort, Carbon runs $7.76 per task on the Artificial Analysis Index, less than Fable 5.2 at high effort, but more than twice what it costs at medium effort on other tests. And the cheap window has a date: anyone building a budget on $2 and $10 is in for a surprise on December 1, when the rate becomes $4 and $20. The lesson is the same as with Fable 5.2: the number in the announcement is the floor, not the bill.
The launch lands in the middle of a hot week: in the same week, Anthropic opened Fable 5.2 and Mythos 5.2, and Google answered within 24 hours with its strongest model at a quarter of the price per token. With Carbon, Google isn’t competing on video or voice: it’s competing on doing the hardest technical work cheaper per task than anyone. On the agent benchmarks, at least on paper, it has. The real test starts now, outside Google’s labs.
Frequently asked questions
Is Gemini 4 Carbon free?
No. In the API it’s only on the paid tier, with no free tier, and in the Gemini app it’s only for Google AI Ultra subscribers. Plus and Pro plans don’t include it.
Does Carbon replace Gemini 4 Argon?
No. Google recommends Argon for most engineering and knowledge work, and Carbon for the hardest tasks: long coding jobs, complex debugging, cybersecurity, and scientific research.
Is Carbon better than Claude Fable 5.2?
It depends on the test. Fable leads the Artificial Analysis Intelligence Index at 62 on high effort and 65 at maximum, against 60 for Carbon, and wins FrontierCode 2.0. Carbon wins AutomationBench and Terminal-Bench 4.0, and costs less per task at high effort: $7.76 against $9.08.
What is Carbon for cyber?
The version of Carbon with its full cybersecurity capabilities, available only to verified defenders inside Google’s Fairwind Program. The public Carbon ships with its safeguards turned on.
