Gemini 4 Carbon: #1 on AA Index, but Locked to Cyber Defenders

Google Shipped Its Strongest Model Yet and Locked the Door

On October 28, 2026, Google announced Gemini 4 Carbon, two weeks after Gemini 4 Argon became generally available. Google calls it "our strongest model with state-of-the-art cybersecurity and long horizon capabilities." It tops version 5.0 of the Artificial Analysis Intelligence Index at 59, one point above Claude Opus 5.5 (58) and two above GPT-6 Astra (57). Argon, released October 13 after a limited Fairwind rollout on September 30, sits at 50.

None of that matters to you yet. Carbon is available this week only to "a subset of cyber defenders." Access then widens through Google's Fairwind Program. Developers, businesses and consumers get it "as soon as possible," which in practice means no date. Google's API documentation had no Carbon model page on announcement day, and OpenRouter listed only Argon.

This is a release you read, not one you deploy. What follows is what the numbers actually say, and the one deadline that does hit your budget.

The price tag, and the deadline attached to Argon

Carbon launches at the same introductory rate as Argon:

Input: $2 per million tokens
Output: $10 per million tokens (thinking tokens included)
Cached input: 95% off, i.e. $0.10 per million
After the introductory period: $4 input, $20 output, $0.20 cached

Google does not say when Carbon's introductory window closes. Argon's is documented and hard: promotional pricing runs through November 30, 2026, and on December 1, 2026 the price doubles to $4/$20 with caching at $0.20. Only implicit caching is supported on Argon, and it is not available on the free tier.

If you are already running agents on Argon, that is a 100% cost increase in 32 days. A workflow that costs $500 a month in input today becomes $1,000. Google Search grounding stays separate: 5,000 free requests per month shared across all Gemini 3 and newer models, then $14 per 1,000 requests, capped at 1,500 requests per day.

Reading the benchmark table honestly

Google published 17 rows. Carbon leads 15 of them, according to Google's own runs. The two it loses matter:

FrontierSWE 2: GPT-6 Astra 65.5%, Carbon 61.2%
OSWorld-2.1 (offline subset): Claude Opus 5.5 87.2%, Carbon 81.5%

Several wins are thin. On the Vals Index v2.2 it is 70.4% against 70.2% for Opus 5.5. On SWE-sweep, 9.6% against 9.5% for Astra. A tenth of a point on an agentic benchmark is noise, not a mandate to migrate.

The wide margins are elsewhere:

GraphWalks at 256k to 1M tokens: 96.2%, against 71.8% for Astra and 66.8% for Opus 5.5. If your work involves long-context retrieval over large repositories or document sets, this is the row to care about.
Agents' Last Exam v1.1: 77.4% against 69.0% for Argon
Terminal-Bench 4.0 (Artificial Analysis): 65.2% against 57.1% for Argon
AutomationBench (Zapier): 53.9% against 41.4% for Astra and 42.5% for Opus 5.5
Vending-Bench 2 bank balance: $16,484 against $15,515 for Astra and $9,235 for Opus 5.5
WebDev Arena: +89 Elo points over Argon to fourth place at 1,769

One omission is worth flagging. On Terminal-Bench 4.0, Artificial Analysis's October 27 results put Kimi K3.1 Pro at 67%, above Carbon's 65.2%. Google's table does not carry that row. A leaderboard is a selection of tasks someone chose to run.

The cybersecurity numbers are Google-only so far

Google built the pitch on three external benchmarks, all evaluated without guardrails:

Find: SEC-bench Pro at 88.2% (Argon 83.4%, GPT-6 Astra 85.4%)

Prove: ExploitGym at 54.8% (Argon 42.0%, Astra 42.4%, Opus 5.5 34.5%)

Fix: Collinear's CWE-bench at 71.0% (Argon and Astra both 68.0%, Opus 5.5 67.0%)

The ExploitGym gap is the substantive one: a 12.8-point jump over Argon on determining whether a vulnerability is actually exploitable. That is the judgement that decides what a security team patches first.

But as of October 29, 2026, the public SEC-bench Pro leaderboard has no Carbon row. The only 59 on the Intelligence Index comes from the index itself; everything else is a Google run. Treat the security scores as a direction of travel, not a settled fact. Google also makes claims without public benchmarks behind them: more than 2x the success rate of Argon at generating secure code, and the Chrome team reporting Carbon delivered more than 10x better patches than "another lab's large frontier model," unnamed.

Behavior changes matter more than a one-point index lead

Google spends as much of the post on alignment as on scores, and for anyone running agents unattended these are the numbers that decide whether the model is safe to leave alone:

Successful cheating on Terminal-Bench 4.0 fell to 0.0%, with attempts at 0.4%, while accuracy went up
High-severity misalignment alerts in Google's internal live coding dropped by almost 80%
Unsupported claims cut by roughly 2x over Argon
Overreach down 26%, under-service down 29% on multi-step plans
Gray Swan indirect prompt injection attack success: 0.0%, against 0.7% for Argon

That last row is the one to hold onto. A 0.0% on one benchmark version is not immunity; it is one lab's evaluation of attacks known at training time. Anyone running agents over email, web pages or third-party documents should keep the injection problem squarely in their own threat model.

What to do this week

Carbon is not on your roadmap yet. Argon's price change is.

Audit Argon usage now. Pull your token counts for the last 30 days and double the input and output lines. If the new number is unacceptable, decide between cached-prompt restructuring (Argon's implicit caching at the promotional $0.10 becomes $0.20) and moving bulk work to a Flash-tier model. Gemini 3.8 Flash is $0.75/$3.75 through December 31, 2026, rising to $1.50/$7.50 on January 1, 2027.
Fix your routing assumption. Both Argon and 3.8 Flash raise prices on a published date. Build the price into configuration, not into a comment, so the switch is a one-line change.
Watch three signals before migrating to Carbon: a model ID on the Gemini API docs and AI Studio, a Carbon section in the Gemini 4 safety report (the current report covers Argon only), and a public SEC-bench Pro row.
Keep a fallback. Carbon may arrive to developers while its introductory pricing window is already running, the way Argon's did. Plan to test on day one rather than on week three.

The bottom line

Gemini 4 Carbon is the strongest single-task model Google has shipped, and Google deliberately kept it out of most people's hands. The 59 is real on the index and thin on several rows. The security claims are unverified by anyone outside Google. The release that touches your invoice is not Carbon at all; it is Argon doubling on December 1. Budget for that this week, and treat Carbon as a waitlist item.