Google announced Gemini 4 Carbon on October 28, 2026, describing it as its strongest model, with an emphasis on cyber defense and complex, sustained work. The announcement begins a restricted rollout: a small group of cyber defenders gets access first, followed by additional trusted partners. Developers, businesses and consumers will follow, with no firm date announced.
Carbon follows Gemini 4 Argon. Its central promise is to improve progress through engineering workflows, persist when an initial approach fails and complete tasks involving several decisions and fixes. Anyone hoping to use it immediately must distinguish three things: the capabilities Google describes, its announced pricing and actual eligibility for access.
Access starts with defenders
According to Google's announcement, access will expand gradually through the Fairwind Program for trusted cybersecurity partners. This is not a standard release to everyone with an account. Google says it is collecting feedback and refining safeguards before wider availability through its products. Words such as "later" and "soon" do not give an organization a launch schedule.
The program prioritizes organizations protecting essential services, including governments, healthcare and telecommunications, Google explains. The reasoning reflects the technology's dual use: a system that finds a vulnerability and demonstrates exploitation can help fix it, but the same capability can support an attack. Technical capability and permission to use it are therefore separate considerations.
Google is also participating in the US government's voluntary process for testing models before release. Participation is neither government certification that a model is risk-free nor an announcement of commercial availability. For an Israeli development team planning a product, the practical point is that Google has not committed to a date for access through its usual channels.
Sustained work requires more than a good answer
A sustained agent workflow differs from generating a single response. Fixing a bug may require reading several code components, identifying their relationship, proposing a change and testing the outcome. An early mistake can affect later steps, so success at writing one piece of code does not establish that the system can usefully complete the whole process.
Google presents Carbon as a model for steady progress through this kind of work. Its reported examples focus on finding and fixing the source of bugs in large systems. These are descriptions of Google's usage and published results, not guarantees that every task will succeed or that every development environment will behave alike.
Software teams therefore need to assess the final deliverable: whether a fix addresses the problem, preserves existing behavior and requires further work before integration. These questions differ from whether the model can generate an impressive code sample. The announcement places the whole workflow, rather than only its first visible response, at the center of competition.
Google's figures and their qualification
Google reports 88.2% on SEC-bench Pro, 54.8% on ExploitGym and 71.0% on CWE-bench. It presents them as measures of vulnerability discovery, exploitation validation and patching, respectively. It also reports 59 on Artificial Analysis Intelligence Index v5.0. These figures are presented as Google's published results.
The cybersecurity results carry a material condition: they were measured without the model's guardrails. They should not be read as a promise of identical behavior in a product operating under usage restrictions. A capability test under particular conditions is not a service specification, and a benchmark success rate is not the share of vulnerabilities the system will necessarily find in a customer's code.
The differences between the tests matter too. Discovering a flaw is distinct from demonstrating exploitation, while fixing its root cause is another task. Together, the figures describe different stages of defensive work. They cannot simply be combined into an overall security score or establish that the system can replace every security-team check.
A 0.0% injection result is not immunity
For the model's own defenses, Google reports a 0.0% attack success rate on the evaluated attempts in Gray Swan's indirect prompt injection benchmark. Such attacks try to make a system treat external content as instructions and depart from its assigned task. The result concerns the tested attempts, not every possible attack on a real system.
That distinction matters when an agent reads files, uses tools or moves through several stages. A strong result on a defined test does not remove the need for appropriate permissions, supervision and control of available actions. Resisting deceptive inputs and deciding which powers to grant an agent are different layers of the same working environment.
Introductory pricing, standard pricing and access
Google's introductory rates are 2 dollars per million input tokens and 10 dollars per million output tokens. Tokens are text-processing units, not a fixed number of words. Cached input is 95% cheaper than the regular input rate. The discount applies to eligible cached input, not every cost component of a task.
After the introductory period, prices become 4 dollars per million input tokens and 20 dollars per million output tokens. Google's launch announcement gives no end date for the introductory period. Both standard rates are twice the introductory rates, so a budget based only on opening prices does not reflect the announced ongoing cost. For example, 1 million uncached input tokens plus 1 million output tokens costs 12 dollars initially, versus 24 dollars at standard rates. This illustrates pricing, not typical task consumption.
Actual cost depends on input and output volume, caching and the work required throughout a task. A published price does not itself grant access. For most developers, Carbon currently represents announced capabilities and a future rollout path; when it can be integrated into a broadly available product still depends on an expansion for which Google has set no firm date.