Google DeepMind announced Gemini 4 Carbon on October 28, 2026, calling it the company’s strongest frontier model and shipping it only two weeks after Gemini 4 Argon. The release arrives as cybersecurity capability becomes a central competitive frontier, and Google is leading with controlled access for defenders rather than a broad consumer launch. Carbon leads version 5.0 of the Artificial Analysis Intelligence Index with 59 points, ahead of Argon at 50, while independent testing shows meaningful gains alongside higher costs and a larger hallucination rate.
Google says Carbon ranks first in four of the index’s nine individual evaluations, taking the lead through complex reasoning, knowledge retrieval and scientific work. On Vals AI, it reaches 70.36 percent accuracy, narrowly behind Claude Sonnet 5.5 at 70.85 percent, and leads the Finance Index and Legal Research benchmark. The overall picture is strong but not one-sided. Carbon still trails Claude Code with Opus 5.5 by three points in agentic coding on Antigravity and remains behind Kimi K3.1 Pro and Muse in agentic knowledge work.
Gemini 4 Carbon targets the full security lifecycle
Cyber defense is the central message of the launch. Google reports that Carbon scores 88.2 percent on SEC-bench Pro, a test of autonomous vulnerability discovery in real-world software, ahead of every other tested model. It reaches 54.8 percent on ExploitGym, which asks whether a model can turn a discovered weakness into a working exploit, and posts 71.0 percent on CWE-bench for producing patches.
These figures describe raw capability rather than a normal deployment profile. Google ran several of the security evaluations with safety guardrails switched off. That distinction matters because a model able to find and exploit vulnerabilities under testing conditions may behave differently once real-time misuse defenses, prompt-injection resilience and chain-of-thought monitoring are active. The results are still notable, but they should not be interpreted as proof that the same behavior will be available or desirable in ordinary products.
Google also says Carbon generates secure code more than twice as often as Argon on internal benchmarks. The Chrome team measured more than ten times better performance than an unnamed rival frontier model at producing high-quality security patches. These are company-reported internal comparisons that have not been independently verified, and Google did not identify the rival model.
On Gray Swan’s indirect prompt-injection benchmark, Google reports that Carbon reduced the attack success rate from 0.7 percent with Argon to zero across every tested manipulation attempt. A perfect result on that test does not mean prompt injection has been solved. It shows that Carbon passed the particular attempts included in the evaluation.
Long-horizon agents move beyond single-answer models
Carbon was also designed for sustained agentic work rather than one-shot answers. Google’s teams report running it for days at a time while it worked through dead ends, root-caused subtle bugs and generated fixes across large codebases and low-level systems. That ability to maintain context, use tools and continue after failure could make frontier models more useful for software engineering, incident response and other work that unfolds over many steps.
The model’s broader benchmark gains are credible but uneven. Google reports that Carbon gained 89 Elo points to reach 1,768 on WebDev Arena, placing fourth overall. On Arena.ai, it takes the Text Arena lead at 1,528 points and finishes second in the Agent Arena across more than 21,900 real sessions. It also beats GPT-6 Astra and Fable-5.1 in that agent category, with a reported median task cost of 1.80 dollars.
On Artificial Analysis, answer accuracy rises from 48 percent with Argon to 58 percent with Carbon. The tradeoff is reliability: hallucination frequency increases from four percent to 11 percent, although that remains the second-lowest rate in the ranking. The accuracy gain therefore comes with a visible cost, making evaluation, source checking and human review more important rather than less.
Research gains come with time and token costs
Carbon’s stronger research performance also consumes more computation. Finance and Tax Agent tasks take more than twice as long as they did with Argon, while Legal Research averages more than 50 minutes per task. The model generates 2.3 times as many reasoning tokens and 64 percent more output tokens than Argon, according to Vals AI. It also produces roughly 45 percent more cited sources and makes more frequent tool calls in legal work.
More extensive research can produce a better answer, but it can also increase latency and expense for organizations that deploy agents at scale. Carbon’s introductory price is 2 dollars per million input tokens and 10 dollars per million output tokens, with cached input tokens receiving a 95 percent discount. After the introductory period, the rates rise to 4 dollars and 20 dollars respectively. Buyers will need to compare quality with total task duration, tool usage and output volume rather than looking only at the per-token rate.
A staged rollout tests defenses before broad access
Google is not distributing Carbon everywhere immediately. The company says it is participating in the United States government’s voluntary pre-release model testing process. Beginning the week of the announcement, Carbon will become available to a subset of cyber defenders, with access expanding gradually to additional trusted partners through the Fairwind Program. Developers, businesses and consumers are expected to gain access through Google products later, after the company gathers feedback and iterates on its guardrails.
That sequence reflects the unusual nature of the model. The same abilities that make Carbon useful for discovering flaws can also support malicious activity, so deployment must balance capability with controls. Google says Carbon retains the layered safety stack used for Argon, combining model training, real-time misuse defenses, prompt-injection resilience and chain-of-thought monitoring. It also says the company documented the model’s alignment propensities in its safety and security report.
The practical question is whether those protections can remain effective during long-running autonomous sessions. A model that operates for days may encounter unexpected inputs, accumulated context and new attack paths that were absent from a controlled evaluation. Early access for defenders is therefore not merely a marketing choice. It is a field test of whether the system can preserve reliability while operating at the edge of its capabilities. Whether Gemini 4 Carbon reaches developers beyond its cyber defender cohort, and whether its higher hallucination rate holds at scale, will decide how much Gemini 4 Carbon changes the deployment math for long-horizon agents.
Gemini 4 Carbon is a credible new leader in several AI evaluations, with especially strong security results and an emphasis on persistent engineering work. Its higher hallucination rate, lengthy research tasks and staged access show that raw benchmark strength does not erase practical constraints. Whether Gemini 4 Carbon becomes a durable frontier platform will depend on turning that capability into dependable, proportionate and economically useful tools. For now, Gemini 4 Carbon is best understood as a powerful model entering a cautious deployment era, with cyber defenders serving as its first serious test users.