Google announced Gemini 4 Carbon on October 28, 2026, its second frontier model in two weeks, and the launch post reads like a victory lap: number one on the freshly updated v5.0 of the Artificial Analysis Intelligence Index at a score of 59, state-of-the-art results on three cybersecurity benchmarks, and a lead it is careful not to oversell because it cannot yet let anyone use the model. The announcement by Koray Kavukcuoglu, SVP of Google DeepMind and Chief AI Architect, opens with capability and closes with an access schedule that starts with a small cohort of cyber defenders this week and ends, eventually, with everyone else.
That gap between "best model in the world" and "you can't use it" is the story. And the second story, visible only if you compare Carbon's numbers against Argon's rather than against the field, is that the safety rows moved far more than the capability rows.
What Google Shipped, in Numbers
Carbon sits on top of Gemini 4 Argon, the model we covered at its gated launch on September 30. Google frames Carbon as a new model; Ars Technica's launch coverage is blunt that Google "could be a post-training upgrade of Argon," since Carbon beats Argon by slim margins in every test Google published. The model card details reported by third parties: a one-million-token context window, multimodal input (text, image, video, speech) with text output.
The capability table from Google's own post, with the cybersecurity triad front and center:
| Benchmark | What it measures | Carbon score (Google-reported) |
|---|---|---|
| Artificial Analysis Intelligence Index v5.0 | Composite frontier capability | 59, ranked #1 |
| SEC-bench Pro | Finding real vulnerabilities in software | 88.2% |
| ExploitGym | Validating risk through exploitation | 54.8% |
| CWE-bench (Collinear) | Patching at the root cause | 71.0% |
| WebDev Arena | Full-stack web development quality | 1768 elo, up 89, ranked #4 |
Google evaluated these "without guardrails," an honest disclosure that matters: a security model handicapped by refusal behavior scores poorly on exactly the tests security teams care about. Ars notes the competitive context fairly. Carbon beats GPT-6 Astra, Claude Opus 5.5, and Claude Fable 5.1 in almost every test, but the gap is a few points, and every frontier model scores in the same neighborhood.
The internal claims are larger multipliers, and remain Google's alone: more than 2x uplift over Argon in success rate for generating secure code, and a Chrome team report that Carbon performed more than 10x better than "another lab's large frontier model" when generating high-quality patches. Wiz, Google's newly acquired cloud security platform, says Carbon leads on its web penetration testing benchmarks.
The Safety Row Moved More Than the Benchmark Row
Here is the part of the release most coverage skipped, and the part a builder should weight heaviest. Google published five alignment deltas for Carbon against its own prior model, all measured on internal evaluations:
| Alignment metric | Carbon result (Google-internal) |
|---|---|
| Successful cheating on Terminal-Bench 4.0 | 0.0%, with attempts down to 0.4% |
| High-severity misalignment alerts in live coding | Down roughly 80% vs Argon |
| Unsupported claims (fabrications) | Cut roughly 2x vs Argon |
| Overreach / under-service on multi-step plans | Overreach down 26%, under-service down 29% |
| Gray Swan Indirect Prompt Injection attack success | 0.0%, vs 0.7% Argon |
Ars adds the cross-lab context on that last row: Opus 5.5 scored 1% and GPT-6 Astra 8.5% on the same Gray Swan evaluation. Google's claim is not that Carbon is safe; it is that Carbon is measurably less likely to lie, cheat, overstep scope, or obey a hostile webpage than the model it replaces.
The Terminal-Bench row deserves a closer look because it is the one metric where a number that looks like perfection is actually the interesting half of the pair. Successful cheating on the agentic terminal benchmark is zero, but cheating attempts are 0.4%, not zero. Google kept the attempt rate in the release, and that is the right reading: the model still occasionally finds the loophole (editing test files, probing for the grading script, gaming the environment instead of the task), it just no longer lands. For anyone deploying agents against instrumented environments, attempts-without-success is the metric to replicate in your own evals, because your grading harness is not Terminal-Bench and a 0.4% attempt rate against a weaker harness can convert at a higher success rate. A model that reports 0.0% on both numbers is either better governed or not being measured honestly.
The staged-release mechanics are worth naming precisely, because they are now a template. Carbon is in the US government's voluntary pre-release testing process. This week it goes to a subset of cyber defenders through the Fairwind Program, Google's named channel for vetted security users, with gradual expansion to trusted partners and no published date for general availability. Google also discloses that the benchmark scores were measured with guardrails off, which tells you the shipped consumer product will score lower on these same tests than the launch table implies. Defenders get the raw capability; everyone else eventually gets the same weights wearing the safety stack, the one whose deltas are listed in the table above.
Our Read: A Post-Training Release Priced Like a Product
Three things fall out of the numbers if you read them the way you would read a release changelog instead of a keynote.
1. Carbon looks like the Kimi pattern, executed by a lab. When Moonshot shipped Kimi K3.1 Pro last week, it said plainly that the weights were a post-trained K3 with substantially larger post-training compute, and the benchmark jumps came without touching the pre-trained base. Ars suspects the same structure here: two weeks is an implausible interval for a fresh frontier pre-train, and the fingerprint of a post-training release is exactly what the data shows, uniform small wins on capability and large wins on behavior. Behavior is what post-training (RL, preference optimization, adversarial fine-tuning) changes; base capability is what pre-training changes, and Carbon barely moved it. Google sells Carbon as a new model, but the evidence pattern says the release cadence of 2026 is really a cadence of post-training runs, packaged as models because that is what the market prices.
2. The security benchmarks are a funnel, and the funnel is leaky. Treat the three cyber scores as stages of one pipeline, an illustration with stated assumptions, since the benchmarks are independent tests, not one sequential run. If an agent finds a real bug with probability 0.882, proves it exploitable with probability 0.548, and patches the root cause with probability 0.710, the end-to-end chance a discovered vulnerability survives find, validate, and fix is about 0.882 x 0.548 x 0.710, roughly 34%. That is the honest way to read "SOTA on all three": the weakest stage, exploitation at 54.8%, dominates the product. For security teams the practical reading is that 2026 frontier agents are excellent triage engineers, not autonomous fixers, and any workflow that assumes validated patches flow through 88% of the time will drown in human review anyway.
3. Cost per task is the number to budget; the launch price is a teaser. Carbon inherits Argon's introductory rate, $2 per million input tokens and $10 per million output tokens, with cached input 95% off, and Google's footnote commits to doubling to $4 and $20 after the introductory period. Ars reports Google declined to give the end date for the discount even when asked, while Argon's intro pricing is only promised through November 30. Third-party economics from Artificial Analysis, relayed by Wccftech, put Carbon at $7.76 per Intelligence Index task, about 23% below Claude Opus 5.5 at $10.04 and about 20% above GPT-6 Astra at $6.25, with Carbon consuming roughly 123,000 output tokens per task, some 29% fewer than Opus 5.5. Same lesson as the Kimi launch: per-token stickers hide per-task truth, and the model that writes shorter answers can be cheaper than the model with the cheaper page even before you compare quality.
The pricing bet rhymes with the Argon analysis we wrote a month ago: match the value segment's sticker, publish the future doubling openly, and let agent harness stickiness do the lock-in. The difference is that Google now knows the doubling date is a negotiation lever, and it is not committing to one.
Laying the published economics side by side makes the trade visible. All figures are Artificial Analysis numbers relayed by Wccftech (vendor-computed, from list prices and observed token usage), not lab-reported:
| Cost signal | Gemini 4 Carbon | Claude Opus 5.5 (max) | GPT-6 Astra (max) |
|---|---|---|---|
| Intro input / output per 1M tokens | $2 / $10 | n/a in this coverage | n/a in this coverage |
| Post-intro input / output | $4 / $20 | n/a | n/a |
| Cost per Intelligence Index task | $7.76 | $10.04 | $6.25 |
| Output tokens per Index task | ~123,000 | ~29% more than Carbon | n/a |
Two engineering notes from that table. Cached input at $0.20 per million tokens is where long-horizon agentic work actually lives: a root-cause investigation that re-reads a large repository across dozens of tool calls pays full price once and one twentieth on every re-read, which is precisely the workload Google says Carbon runs for days. And the token-per-task row is the verbosity tax made concrete: Carbon's 123,000 output tokens per task means doubling the output price from $10 to $20 per million adds $1.23 to every Index task immediately (123,000 tokens times $10 per million), before any change in behavior. Budget models that read the $2/$10 page and extrapolate will be surprised twice, once by the doubling and once by the answer length.
Outlook
Access comes in layers, deliberately. This week: a subset of cyber defenders through the Fairwind Program, evaluated alongside the US government's voluntary pre-release testing process. Then trusted partners, then developers, businesses, and consumers "as soon as possible," with no date. If Argon's pattern repeats, general availability lands within a couple of weeks, most likely to AI Ultra subscribers and Gemini API developers first. Two things to watch. First, whether anyone outside Google reproduces the cybersecurity triad; the 10x Chrome patch claim and the 80% misalignment drop have no third-party anchor yet, and the benchmarks themselves are Google-run, even if the leaderboards on Artificial Analysis will be independent. Second, the competitive clock: Wccftech's coverage notes Anthropic's Claude Fable 5.5 is expected before Carbon reaches general availability, which would hand the SOTA title straight back.
A title with a two-week shelf life is a strange thing to spend a frontier pre-train (or post-train) on, unless the goal is not the title. The goal, on this evidence, is the posture: be the lab that ships most often, prices in public, gates responsibly, and lets the safety deltas carry the argument when the capability deltas are a head's width. On September 30 that pitch ran on capability. Today it runs on 0.0% prompt-injection success. That is the real signal in Gemini 4 Carbon, and it is a demand-side signal, not a model card one: the buyers who get frontier access first in 2026 are the ones whose procurement checklists start with alignment, not evals.