Google’s price sheet for Gemini 4 Carbon lists $2 for a million input tokens and $10 for a million output tokens. There is no way for a business to buy it this week.
The model, announced Oct. 28 in a blog post by Koray Kavukcuoglu, a senior vice president at Google DeepMind and the company’s chief AI architect, is the lab’s strongest release and its most narrowly aimed. Google says it leads three outside tests of security work: finding flaws, establishing whether they can be exploited, and writing the patch. Carbon scored 88.2% on SEC-bench Pro, 54.8% on ExploitGym and 71.0% on CWE-bench, with guardrails switched off during the runs.
Access moves on a slower track. Carbon goes to a subset of cyber defenders this week, with more added through Google’s Fairwind program. That is the route Gemini 4 Argon took: defenders on Sept. 30, paying customers on Oct. 13. Google said Carbon will reach developers, businesses and consumers “as soon as possible” and declined to give a date. The company is also submitting the model to the U.S. government’s voluntary pre-release testing process.
The ranking is the part Google wants quoted. Carbon placed first on the Artificial Analysis Intelligence Index v5.0 with 59 points. Anthropic’s Claude Opus 5.5 took second at 58, OpenAI’s GPT-6 Astra third at 57. One point separates first from third, and Google’s own comparison table shows rivals ahead elsewhere: Astra at 65.5% on FrontierSWE 2 against Carbon’s 61.2%, Opus 5.5 at 87.2% on OSWorld against 81.5%.
The security scores carry more weight than the index because they describe work rather than answers. SEC-bench Pro asks a model to locate a real vulnerability in real code. CWE-bench asks it to produce the fix. ExploitGym asks whether the flaw can be weaponized at all. A system that does all three compresses a sequence that currently eats weeks of a security team’s calendar and, at most companies, never gets finished.
Google’s internal evidence, which no outside party has checked, points the same way. The Chrome team found Carbon more than 10 times better than another lab’s large frontier model at writing high-quality patches; Google did not name the lab. Carbon made roughly half as many unsupported claims as Argon, and high-severity misalignment alerts in internal coding environments fell by almost 80%. No evaluated attack on Gray Swan’s prompt-injection benchmark succeeded against it.
The same abilities run in the other direction, which is the reason for the gate. ExploitGym exists to measure whether a flaw can be turned into an attack, and a model that scores 54.8% there is a model that can write the thing a defender fears. Google says Carbon includes refusal mechanisms and usage monitoring, a description of intent rather than a guarantee.
There is a measurement problem underneath the sales pitch. On Artificial Analysis’s knowledge test, Carbon answered 58% correctly, up from Argon’s 48%, while its rate of wrong answers among those it did not get fully right rose from 4% to 11%. Google has not published a technical report. The benchmarks it cites were run by Google or by firms it engaged, and a security chief weighing whether to trust a patch generator has less independent reading than the announcement implies.
The timing is awkward in one respect. Carbon shipped on the day Alphabet reported third-quarter results, a set of numbers that missed on revenue and profit and cost the shares 13%. Analysts expect Google Cloud revenue to grow about 90% from a year earlier, with TPU capacity and Gemini consumption as the two engines. A model that cannot be purchased does not appear in that figure, and a model restricted to a short list of defenders will not appear in it for some time.
Pricing offers the clearest read on intent. Google will launch Carbon at Argon’s introductory rates, then raise them to $4 and $20 per million tokens; it has not said when. Introductory pricing on a model almost nobody can use is a way to hold a line in enterprise budgets before general availability, and it leaves room to argue later that the increase was always on the schedule.
For buyers, the practical question is not which model tops an index separated by a point. It is whether a tool that finds a flaw, judges its severity and writes the patch can be trusted to run on a codebase nobody outside the company has seen. That question gets answered in production, by defenders who now have access and cannot resell it, and by chief information security officers still waiting for a date.
Google’s argument, implicit in the way it is sequencing the release, is that a security model should prove itself against real attacks before it is sold to everyone. The counterargument is that gated access is how a vendor chooses its own referees. Argon’s two-week gap between defenders and paying customers suggests the current arrangement is a formality rather than a policy.
If Carbon follows the same schedule, the caution will read as diligence and the index will do the selling. If the date slips into next year, Google will have shipped the strongest security model in the industry to an audience small enough that no competitor has to answer for it, and the market will price the gap accordingly.
