Google Opens Gemini 4 Carbon to Developers After Security-Only Pilot

Google has released Gemini 4 Carbon through the Gemini API and AI Studio for paid API customers and Google AI Ultra subscribers. Google introduced Carbon two weeks after Gemini 4 Argon in an October 2026 update. The expansion gives developers access to the highest-scoring Gemini 4 model on the Artificial Analysis Intelligence Index v5.0.

Carbon leaves the pilot

Google initially restricted Carbon because its security capabilities are dual use: the same model can find and patch vulnerabilities or help exploit them. After tightening guardrails and expanding partner testing, Google has moved the model into its standard paid developer tooling.

Where Carbon pulls ahead

Google positions Carbon above Argon for long-running engineering, scientific reasoning, and security work. The company says internal teams have kept it working on a single multi-step job for several days. Carbon scored 59 on the Artificial Analysis Intelligence Index v5.0, compared with 50 for Argon.

Google ran these cybersecurity benchmarks without model guardrails. Production behavior may differ when API safety controls, tool permissions, and organization policies are active.

Carbon’s largest reported gain over Argon came in exploit validation, rising from 42.0% to 54.8% on ExploitGym. Stronger validation can help security teams separate exploitable findings from scanner noise and prioritize remediation.

Google also self-scored Carbon on 200 GraphWalks problems with context lengths from 256,000 to 1 million tokens. Carbon reached 96.2% BFS F1, a measure of accuracy when following breadth-first graph traversals. That result was 12 points above Argon and more than 24 points above GPT-6 Astra. Independent replication would provide a stronger comparison.

Fewer failures in long agent runs

Compared with Argon, Google reports that Carbon produces about half as many unsupported claims, reduces actions outside the assigned scope by 26%, and cuts incomplete or prematurely abandoned work by 29%. High-severity misalignment alerts in live coding environments also fell by almost 80%.

On Gray Swan’s Indirect Prompt Injection benchmark, the reported attack success rate fell from 0.7% for Argon to 0.0% for Carbon. The result applies to that test set and does not establish immunity to prompt injection. Browser agents and tool-using systems still require restricted permissions, content isolation, and application-specific testing.

Scores and spend

Carbon costs $2 per million input tokens and $10 per million output tokens during the introductory period. Standard rates double to $4 and $20, while cached input tokens receive a 95% discount. The release details do not specify when introductory pricing ends.

At standard rates, Artificial Analysis estimates Carbon at $7.76 per Intelligence Index task. That is about 23% below Claude Opus 5.5 and about 20% above GPT-6 Astra. The figure is a benchmark-derived estimate; actual spending depends on prompt size, generated tokens, retries, and tool calls.

The two benchmark columns measure different capabilities and should be read separately. The Artificial Analysis index covers general intelligence tasks, while ExploitGym tests whether a model can validate and carry out software exploits.

Long jobs, higher stakes

Carbon’s pricing and evaluation profile suit workloads where sustained reasoning, security performance, or tool-use reliability outweigh raw throughput:

• Vulnerability discovery, exploit validation, and automated patching pipelines
• Multi-day refactors and migrations that span many files and tool calls
• Scientific workflows combining planning, retrieval, computation, and verification
• Browser and computer-use agents that process untrusted content

Gemini 4 Argon and Flash-tier models remain better suited to high-volume, latency-sensitive, or lower-risk tasks. Argon is available through the Gemini API as gemini-4-argon, and its lower operating cost can matter at scale.

Checks before deployment

• Confirm Carbon’s current model identifier in AI Studio or the API model list.
• Evaluate the model with the same guardrails and tool permissions planned for production.
• Set token, time, and tool-call limits for long-running agents.
• Test prompt injection resistance against representative external content.
• Log model versions, tool actions, approvals, and generated patches for auditability.

A slower route to release

Google says Carbon also participated in the U.S. government’s voluntary pre-release testing process. Its path from government and security-partner evaluation to paid API access shows how Google is handling models with stronger offensive-security capabilities.

For teams tracking future releases, Carbon provides a useful planning pattern: restricted evaluations may precede broad API availability by several weeks, and production access may arrive only after additional guardrail and partner testing.