要点
- On 10 November 2026, Koray Kavukcuoglu, SVP of Google DeepMind and Chief AI Architect at Google, wrote that Gemini 4 Carbon is now available to developers, enterprises, scientists, and consumers. Two weeks earlier, Carbon went to cybersecurity defenders through the Fairwind Program. Google says Argon remains the ideal choice for the majority of software engineering and knowledge work, while Carbon is built for tasks that test the limits and uses more tokens than Argon.
- Carbon is available through the API in Google AI Studio and Gemini for business for all paying developers and enterprises, at the same introductory price as Argon, $2 per million input tokens and $10 per million output tokens. After 30 November 2026, Google says the price becomes $4 and $20 per million tokens for the public Carbon model. It is also rolling out to all Google AI Ultra subscribers in Google Antigravity, the Gemini app, and AI Mode in Search.
- Google claims Carbon ranks first on CursorBench 4.0, Perplexity's WANDR, and Zapier's AutomationBench at more than two times lower cost per task than the next best external model. On a new Multimodal Knowledge Agent benchmark with Artificial Analysis, Google says Carbon ranks second while more than six times lower in average cost per task than the top model. The post does not publish the underlying scores. These figures are Google-reported.
- When accessed through Fairwind, Google says Carbon leads on SEC-bench Pro, ExploitGym, and CWE-bench v1. In Project Fortify, Carbon hit 100% recall on scanning and 95% precision on triage, on Google's internal benchmark, and an over 25% relative improvement on Argon's recall in open-source repository testing. Google also reports a 0% prompt injection attack success rate on the Gray Swan IPI benchmark, which it calls a first, while saying robustness still needs work.
- A higher-token specialist priced the same as the default model is a serious product move if the cost-per-task benches hold, because users pay for tokens, not for the model name. Those benches are still Google-reported, the cyber numbers mix internal results and partner anecdotes, and Carbon will cost more in tokens whenever it "explores thoroughly." Independent leaderboards after this launch are what would confirm or break the claim.
On 10 November 2026, Google DeepMind said Gemini 4 Carbon is available to developers, enterprises, scientists, and consumers. The post is signed by Koray Kavukcuoglu, SVP of Google DeepMind and Chief AI Architect at Google. Two weeks earlier, Carbon went to a set of cybersecurity defenders through the Fairwind Program, Google's access path for security teams. Google is not presenting Carbon as a general successor to Gemini 4 Argon, which it still calls the ideal choice for the majority of software engineering and knowledge work. It is selling a model that uses more tokens for work that tests the limits, at the same introductory price as Argon, while claiming first place on three named workflow benches at more than two times lower cost per task than the next best external model.
[1]What Google actually shipped
Carbon is in the API in Google AI Studio and Gemini for business for all paying developers and enterprises, at the same introductory price as Argon, $2 per million input tokens and $10 per million output tokens. Tokens are the billed units of text a model reads and writes. After 30 November 2026, Google says that introductory price ends, and the public Carbon model moves to $4 per million input tokens and $20 per million output tokens. The model is also rolling out to all Google AI Ultra subscribers in Google Antigravity, the Gemini app, and AI Mode in Search.
Google's product split is explicit. Argon remains, in Google's words, "the ideal choice for the majority of software engineering and knowledge work." Carbon is built for tasks that test the limits, such as complex, multi-step coding and debugging, and open-ended scientific research. Google says it uses more tokens than Argon "to explore thoroughly, reason deeply, and run extended verification loops."
Google is also previewing /swarm in Google Antigravity, described as turning a single prompt into a coordinated team of agents. The post presents demonstrations, including a 906,000-triangle reconstruction of Google's Platform 37 office from seven public planning PDFs and 206 drawing views. Those are demos of what a team of agents produced in Antigravity. They are not the benchmarks.
Four weeks earlier, Google opened applications to give 10,000 scientists access to Argon in Antigravity free of charge for six months, and says it has already onboarded thousands. It is now expanding access to Carbon for current and future participants. Applications remain open, with weekly rolling onboarding, subject to eligibility, capacity, and selection.
[1]The cost-per-task claims
The claim that can be checked is not that Carbon is the default model. It is that, on named benches, Google reports a lead in cost per task. Cost per task is not the sticker price per million tokens. It is what it costs to finish one benchmark item, which depends on how many tokens the model uses to get there. A model priced like Argon can still be expensive on a hard job if it explores thoroughly. Google's claim is that Carbon still comes out cheaper per finished task on the benches it names.
Google says that "across independent benchmarks designed to test model performance in real workflows," Carbon ranks first on CursorBench 4.0, Perplexity's WANDR, and Zapier's AutomationBench, at more than two times lower cost per task than the next best external model. "Independent" here is Google's label. The rankings and the cost multiples are stated in Google's blog. The post does not publish the raw scores, and this article does not treat those leaderboards as independently re-run.
Google also says it partnered with Artificial Analysis to launch a new Multimodal Knowledge Agent, or MKA, benchmark, which tests how an agent works through dense files that include charts, images, blueprints, and tables. Carbon, Google says, ranks second, while being more than six times lower in average cost per task than the top model. The post does not name that top model, and we did not independently confirm the ranking on an Artificial Analysis page.
In pre-release evaluations, Google says Carbon matched the best model tested on Hebbia's E2E Financial Agentic evaluation, and ranked at the top of 23 frontier model configurations on Balyasny Asset Management's General Financial Intelligence benchmark. Those, too, are results as Google reports them.
[1]Cyber and safety numbers
When accessed through Fairwind, Google says Carbon leads on SEC-bench Pro for finding vulnerabilities, ExploitGym for exploiting them, and CWE-bench v1 for patching them. In Project Fortify, Google's own system for scanning, triage, and remediation, Carbon hit 100% recall on scanning, meaning it found all the cases in that test, and 95% precision on triage, meaning most of what it flagged was correctly classified, on an internal Google benchmark. On open-source repository testing, Google reports an over 25% relative improvement on Argon's recall.
Google also offers partner and internal anecdotes. Its Cloud Vulnerability Research team, it says, used Carbon to show that two bugs in a popular open-source project were exploitable, "comparable in severity to the recent PHP2Shell exploit," with details to come after responsible disclosure. As part of Wiz's Scan for Good program, the post says Carbon uncovered previously unknown vulnerabilities, known as 0-days, at two major SaaS providers in under two hours. These are claims about particular tests, not numbers a reader can recompute from a public board.
On safety, Google says Carbon achieved a 0% prompt injection attack success rate on the Gray Swan IPI benchmark, calling it a first. Prompt injection is an attack that hides instructions in content the model is asked to read, hoping it will follow those instructions instead of the user's. Google adds that robustness still needs work. It also reports a per-attempt breach rate of 0.8%, down from 3.1% on Argon, in a simulated setting; a Gray Swan automated cyberattack query success rate of 2.17%, down from 9.86% on Argon; zero new universal jailbreaks in Trajectory Labs testing across 132 hours and over 13,000 requests; and a 92% pass rate on a 375-task honesty benchmark, against 70% for Argon. All of these figures come from Google's post, including those attributed to outside testers.
[1]What is still Google-reported
Almost every number in the launch post is a Google-reported number. The cost-per-task leads, the MKA ranking, the finance evaluations, the Fairwind benchmark leads, the Fortify internal scores, the partner anecdotes, and the safety figures are all presented by the company that is selling the model. Some involve named partners. That is not the same as a public leaderboard a reader can inspect today, or a paper a third party has already rerun.
The scientific passages in the post, including work with Axiom Bio, a reported 40-fold increase in retrieved protein homologs across seven CASP17 families, and the AlphaProof Code verification of libsignal, are in the same category. They are Google's account of what its researchers and partners did with Carbon. They are not the cost-per-task claim, and they should not be folded into it.
[1]The fair case
The fair case is that a higher-token specialist, priced the same as the default model during an introductory window, is a serious product move if the cost-per-task benches are real. Users pay for tokens, not for the model name. If Carbon finishes named workflow tasks at more than two times lower cost than the next best external model, that matters more than the extra tokens used along the way.
The limit sits beside that claim. Those benches are still Google-reported. The cyber numbers mix an internal Fortify benchmark with partner anecdotes that cannot be checked from the blog alone. Carbon will cost more in tokens per task whenever it "explores thoroughly," which is when a buyer might reach for it. The introductory price ends on 30 November 2026, when the public model's unit price doubles. Independent leaderboards after this launch, and real bills after the introductory window, are what would confirm or break the thesis.
[1]Who should care, and what to watch
Developers and enterprises choosing between Argon and Carbon should care, especially if they pay per token and have jobs that need long, multi-step runs. So should security teams considering Fairwind, Ultra subscribers who will see Carbon in Antigravity, the Gemini app, and Search, and anyone reading the launch as a claim that Carbon should now be the default model.
In the next six months, the tests are whether independent leaderboards confirm a cost-per-task lead on CursorBench 4.0, WANDR, and AutomationBench, whether the MKA ranking appears on an Artificial Analysis page a reader can check, what happens to real unit costs after 30 November, and whether later Gray Swan or other injection tests still show a 0% attack success rate once more people are trying.
[1]Close
Carbon is being sold as a specialist that sits next to Argon, not as its replacement. The claim that matters is whether those named benches still show a cost-per-task lead once people outside Google can run them, and once the introductory price expires on 30 November 2026.
[1]