Gemini 4 Carbon: $2/$10 Pricing, Cyber Skills, Benchmarks

Gemini 4 Carbon is the frontier model Google announced on October 28, 2026, positioned as the company's most capable model. It centers on state-of-the-art cybersecurity skills and long-horizon task ability, and it is built on top of Gemini 4 Argon, announced on September 30, 2026. Introductory pricing is $2 per 1M input tokens and $10 per 1M output tokens, rising to $4 / $20 after the introductory period. Access is currently limited to a small group of cyber defenders; developers, enterprises and consumers are listed as "Coming soon."

The announcement cites first place on the Artificial Analysis Intelligence Index v5.0 (score 59), 88.2% on the SEC-bench Pro vulnerability-discovery benchmark, and 4th place on WebDev Arena at 1768 Elo. Still unpublished are the context length, input and output modalities, speed, knowledge cutoff and model ID. This article follows Google's official blog post and covers specs, pricing, how to read the benchmarks, availability, the differences from the previous generation covered in our Gemini 4 Argon deep dive, and what developers can prepare now. All figures are Google's announced values and have not been independently reproduced.

The number of "not published" rows is the defining feature of the launch. The blog post focuses on what Google worked on (cybersecurity and long-horizon tasks) and the evaluation results behind it, but not on the basic specs you need to design against an API. If you plan to build on Carbon, avoid locking in your design until those details arrive.

Carbon sits at the top of the Gemini 4 family, above Argon. Google describes it as a model with state-of-the-art cybersecurity capability, covering both attack and defense knowledge, and the ability to carry many-step tasks through to completion. Long-horizon work here means jobs that a single prompt cannot finish, such as investigating a codebase, finding a vulnerability, reproducing it and writing a fix, with the model driving each step on its own.

The choice of evaluations reflects that direction. The announcement stresses discovery (SEC-bench Pro), exploit demonstration (ExploitGym) and patch generation (CWE-bench), which together cover the path from finding a flaw to fixing it. We cover the trend of handing security audits to coding agents in our Cloudflare security-audit-skill guide, and a model like Carbon could serve as the engine behind such workflows.

As with Argon, pricing has two stages. The introductory price is $2 input and $10 output per 1M tokens; after the introductory period it is $4 input and $20 output. Cached input is 95% cheaper than the input price. The length of the introductory period has not been published.

The $0.10 and $0.20 cached-input figures are our own estimates from the "95% off the input price" statement, so treat them as reference values until an official price sheet appears. The announcement also does not say how thinking tokens are billed or whether long inputs carry a surcharge.

For a sense of scale, a job with 1M input tokens and 100K output tokens costs $2 + $1 = $3 at the introductory price and $4 + $2 = $6 afterward, before caching. In long-horizon tasks that resend the same context over and over, cache hit rate largely decides the total bill, so keeping the front of your prompt stable pays off.

The main results from the official post are below. Because they mix internal and third-party measurements, the table shows where each comes from.

There are three points to keep in mind. First, the three cyber results measure separate stages: discovery, exploit demonstration and fixing. The gap between 88.2% for discovery, 54.8% for exploit demonstration and 71.0% for patches shows that each stage has its own difficulty. In practice the fixing stage matters most, but being good at it does not mean it can run without human review.

Second, 0.0% cheating and 0.4% cheating attempts on Terminal-Bench 4.0 measure behavioral honesty rather than raw capability. When a model runs long tasks autonomously, exploiting loopholes in the evaluation or faking success is a serious risk. Low numbers here are a meaningful reassurance for agent use, but they are announced values and do not guarantee the same behavior in your environment.

Third, prompt injection resistance. Gray Swan IPI shows an attack success rate of 0.7% for Argon and 0.0% for Carbon. For agents that read web pages or email, following a hidden malicious instruction in that content is a major threat. The gap looks small, but moving toward zero cuts down on operational accidents. Still, 0.0% means no attack succeeded in the benchmark's trials, not that the model withstands every attack.

Beyond benchmarks, the blog lists internal improvements compared with Argon. All are Google's own measurements and none have been independently reproduced.

- Unsupported claims: roughly halved compared with Argon, reducing plausible-sounding errors
- Overreach (doing more than asked): down 26%
- Under-service (not finishing what was asked): down 29%
- Misalignment warnings: about 80% fewer high-severity warnings in a live coding environment
- Secure code generation: over 2x Argon's success rate in internal evaluation

Lowering both overreach and under-service is practical for agent builders. A model that widens its scope and rewrites unrelated files adds work, and so does one that stops halfway and reports success. If both really drop, you should see fewer rework loops on long jobs.

The Chrome team also self-reported more than 10 times as many high-quality patches as other labs' large frontier models. That is one team's report on a specific use case, and we could not confirm the conditions or comparison models at the time of writing. Read it as a directional example, not a general ranking.

Rollout is staged. Select cyber defenders have had access since the announcement week, and access widens to trusted partners through the Fairwind Program. Developers, enterprises and consumers are marked "Coming soon," and Google says it will deliver access as soon as possible.

These items remain unpublished, and most of them bear directly on API design and cost estimates, so firm decisions have to wait.

- Context length
- Input and output modalities (how images, audio and video are handled)
- Speed (latency and throughput)
- Knowledge cutoff
- Model ID
- Timing for Google AI Studio, Vertex AI and the Gemini app
- How long the introductory price lasts

Models with strong cyber skills are increasingly released first to trusted parties because of misuse risk. Starting Carbon with defenders reads as a cautious release decision, and the time to general availability may depend on how that vetting goes.

Carbon ranks above Argon at the same pricing structure, so you get a more capable model at the same unit price. Rival prices below are reused from our Argon article.

On price, introductory Carbon matches Claude Sonnet 5.5 and GPT-6.1 Sol. After the introductory period at $4 / $20 it matches Claude Opus 5.5 and costs two fifths of GPT-6 Astra. Performance cannot be compared head to head yet, because each vendor publishes different benchmarks. To place Carbon's Artificial Analysis score of 59 against rivals, you need results from the same index for each model.

Against Argon specifically, the official framing lists more than double the secure-code success rate, prompt injection attack success down from 0.7% to 0.0%, and roughly half the unsupported claims. For security-focused or secure-coding work, that is a reason to move from Argon to Carbon. Until Carbon opens up, though, Argon is not generally available either, so few teams can test either model today.

- Build an evaluation set: pick 10 to 30 representative tasks from your own code, such as flagging vulnerabilities, writing patches and reviewing changes, and fix the pass criteria. On launch day you can compare against your current model under identical conditions.
- Model costs in several scenarios: estimate monthly spend at both the introductory ($2 / $10) and later ($4 / $20) prices, and include cache usage and the unpublished thinking-token billing in the sensitivity analysis.
- Keep the front of your prompt stable: long-horizon tasks resend the same context repeatedly, so putting system instructions and reference material first helps caching.
- Make the model swappable: keep the model ID and provider in configuration so you can drop Carbon into a test environment as soon as the ID is published.
- Keep human approval: even with a strong model, design automated vulnerability fixes and code changes around review and sign-off.
- Inventory paths that read external data: even with strong injection resistance, least privilege and output validation are still needed.

Gemini 4 Carbon is Google's top model, tuned for cybersecurity and long-horizon tasks, and it is planned at the same $2 / $10 introductory price as Argon. Headline numbers include first place on the Artificial Analysis Intelligence Index v5.0, 88.2% on SEC-bench Pro and a 0.0% prompt injection attack success rate. At the same time, context length, modalities, speed, model ID and the length of the introductory period are unpublished, and access is limited to select cyber defenders. The best preparation today is to build an evaluation set and a cost model, then wait for the general-availability announcement. We will update this article as news arrives.