Gemini 4 Carbon: Google's Strongest Model and Why You Still Can't Use It
Google built the strongest model on the market and still won't sell it to you: Gemini 4 Carbon tops Artificial Analysis at 59, but only vetted cyber defenders get in. No public API, no date.
What Gemini 4 Carbon Actually Is
It is the frontier model Google DeepMind announced on Wednesday, October 28, 2026, two weeks after Argon, and the first in the family that the company describes without hedging as its strongest model.
The Most Capable Model in the Gemini 4 Family
Carbon does not replace Argon, it pushes past it. Same base architecture, same entry price, but training aimed at two things Argon only did halfway: finding security flaws and holding agentic work for hours or days instead of one chat turn.
Cybersecurity and Long-Horizon Work
Google pitches it as a state-of-the-art cybersecurity model: it finds a vulnerability, reproduces the bug and proposes the patch in one flow. The second axis, long-horizon work, is the one that matters to anyone building agents: tasks that chain dozens of steps without the context collapsing halfway through.
Read also
Two Weeks After Argon: The Timeline
Argon was announced on September 30 and opened to the public on October 13, with API access in AI Studio and the Gemini platform. Carbon followed the same announcement path and then stopped at the door. If you followed the Argon story, you already know the pattern.
The Numbers: Google's and the Independent One
There are two kinds of figures in this launch and they should not be mixed. Some are published by Google measuring its own model; the other is published by a third party scoring everyone with the same ruler.
88.2% on SEC-bench Pro and 54.8% on ExploitGym
Those are the two security benchmarks shipped with the announcement. SEC-bench Pro measures how many real vulnerabilities the model finds and fixes: 88.2%. ExploitGym measures something else, the ability to take a bug all the way to a working exploit in a controlled environment: 54.8%. Google also claims Carbon wins 16 of 18 benchmarks against competitors, a figure to read as exactly what it is, a vendor claim.
59 on Artificial Analysis v5 Against Argon's 50
The independent datapoint is Artificial Analysis's Intelligence Index v5.0, which puts Carbon at 59 and Argon at 50. That places it ahead of Claude Opus 5.5 at 58 and GPT-6 Astra at 57. A nine-point jump in two weeks is a lot within a single generation.
Where It Doesn't Win: The Coding Agent Index
The qualifier almost nobody repeats: on the same firm's Coding Agent Index, Carbon finishes second, behind Claude Code with Opus 5.5. On its knowledge test it scores 58% against Argon's 48%. A model can be the smartest on the board and still not be the best at driving coding agents, and for anyone picking a stack that distinction is the only one that counts.
Access Is the Story
The real headline is not the benchmark: it's that Google's best model has no endpoint.
Verified Defenders and the Fairwind Program
Carbon goes first to a subset of cyber defenders and expands to trusted partners through the Fairwind program. It is not a waitlist: it is a check on who you are and what you intend to do with it.
No API, No AI Studio, No Date
As of this writing there is no public API, no AI Studio access and no consumer app version. There is no announced date for opening it either. Industry coverage expects it to reach AI Ultra subscribers and Gemini API developers first, just as Argon did, but that is expectation, not a calendar.
What It Would Cost If It Opens
Pricing is already public even though access is not: 2 dollars per million input tokens and 10 per million output tokens, the same introductory rate Argon launched with.
Two Dollars In, Ten Out
That is launch pricing, not permanent: according to Ars Technica, the rate doubles once the introductory period ends, meaning 4 and 20 dollars. Any per-token cost estimate you build today on the 2-dollar figure is optimistic by a factor of two.
The 95% Cache Discount and Why Agents Care
The 95% discount on cached input tokens is the part that actually changes production math. An agent that repeats the same long context on every step pays almost nothing for that context and only pays for output; on a long-horizon task, the gap between cached and uncached can be an order of magnitude.
Why a Model Like This Stays Locked
The reason is dull and technical: the same model that finds a bug and proposes the patch can chain that bug into an exploit. Google packages it as defense and hands it only to people it can verify.
Dual Use: Finding the Bug and Chaining the Exploit
A vulnerability detector is, by construction, an attack-surface search engine. The line between defending and attacking isn't in the model, it's in the hands and the permission. That is why the closed door isn't marketing: it's the only way Google can ship offensive capability without giving it away.
What Already Happened With Other Models
The industry has already seen this up close. Anthropic acknowledged that an unreleased version of Claude chained vulnerabilities across Chrome, Safari, Android, Windows and Linux, and in Irregular's tests the open model GLM-5.3 from Z.AI solved 3 of 13 cyberattack scenarios, per Reuters. These are third-party reports, not audited proofs, but they explain the direction Google took.
What You Can Use Today
The practical answer is short: Argon, which is open, plus open models for anything defensive.
Argon on the API, Antigravity and the App
Argon is available through the API in AI Studio and the Gemini platform, in Antigravity for Ultra subscribers and in the app for Pro and Ultra plans. For defensive security work, NVIDIA's open models and options like Mistral Le Chonk cover another slice of the problem with the advantage that you can run them wherever you want.
How to Get Ready for the Day It Opens
The rule applies to any closed model: don't plan a product on something without an endpoint. Do get everything else ready, a client with context caching, per-task token metering and your own eval suite you can run against Carbon the day it shows up. When it opens, check three things before migrating: final rather than introductory pricing, how context holds up on long tasks, and usage limits, because a model like this usually arrives with quotas and filters.
Conclusion
Gemini 4 Carbon is Google's strongest model and, for now, its least reachable: 59 on the independent index, 88.2% on the company's own security benchmark and not a single line of code you can write against it. Benchmark leadership means nothing without an endpoint, and the real news is that Google split capability from access. That will happen again with the next model that finds exploits on its own, so read these launches for the fine print on access, not for the big number in the table.
