On Nov. 10, Google opened Gemini 4 Carbon to all paying developers and enterprises. When the model was unveiled two weeks ago, it was available only to a small group of cybersecurity defenders through the Fairwind program. Now it is live in Google AI Studio, the Gemini API and the enterprise-focused Gemini for business, while Google AI Ultra subscribers can use it directly in the Gemini app, in AI Mode in Search and in the coding tool Antigravity.
The announcement is signed by Koray Kavukcuoglu, Google DeepMind’s chief AI architect, and the positioning is unchanged: cybersecurity and long-horizon agentic tasks.
“Carbon is our strongest model with frontier performance in cybersecurity capabilities.”
Cheap now, pricier later
Pricing matches the introductory rate Argon launched with: $2 per million input tokens and $10 per million output tokens. That rate holds only until Nov. 30. After that it returns to $4 for input and $20 for output, double the current price. The introductory period applies only to the public version of Carbon; “Carbon for cyber”, the defender-focused version inside Fairwind, is handled through a separate application process.
In the same announcement, Google cautions that Carbon uses more tokens than Argon because of its deeper reasoning and self-verification. It therefore recommends that most software engineering and knowledge work still start on Argon, and that teams switch to Carbon for complex tasks.
A rough calculation: suppose an agentic task on Argon reads 200,000 tokens and writes 30,000. At the introductory rate that costs $0.40 + $0.30 = $0.70. If the same task produced 50% more output on Carbon, the cost per run after December would come to about $0.80 + $0.90 = $1.70. The extra 50% is our assumption; Google has not published a ratio of token consumption between the two models, so the real gap will depend on the task.
Results concentrate on agentic benchmarks
The scorecard that comes with the public release shifts its weight from the vulnerability benchmarks of the last announcement toward agentic and knowledge work. Google says Carbon ranks first on CursorBench 4.0, Perplexity’s WANDR and Zapier’s AutomationBench, at a per-task cost more than 50% lower than the second-ranked external model.
On MKA, Artificial Analysis’s multimodal knowledge-agent benchmark, Carbon ranks second, with an average per-task cost more than six times lower than the first-place model. On a general financial-agent benchmark from the hedge fund Balyasny, it ranks first among 23 frontier model configurations.
The security figures have been updated as well. In simulated attack environments, Carbon blocked 99% of attack trajectories and was breached on 0.8% of single attempts, against 3.1% for Argon. On Gray Swan’s automated cyberattack queries, the success rate is 2.17%, versus 9.86% for Argon. The pass rate on 375 honesty tasks rose from Argon’s 70% to 92%.
Google’s internal Project Fortify benchmark shows 100% scan recall and 95% triage precision. These internal figures have not been independently reproduced, and Google has not disclosed the size of the test set.
Other items released alongside
Besides the model itself, Google did three other things at the same time:
- Free Argon access, opened four weeks ago to 10,000 scientists, is extended to Carbon. Applicants can use the highest usage tier in Antigravity free for six months, with reviews rolling weekly.
- Antigravity gets a preview of a
/swarmfeature, which splits a single prompt across multiple agents that work on it together. - In a scan of two large SaaS vendors done with Wiz, the model found zero-day vulnerabilities within two hours. The two vendors have not been named.
For both Argon and Carbon, Google followed the same cadence: security teams first, then general availability two weeks later. This time, though, the consumer side is limited to Ultra subscribers, and Pro users cannot use it for now. The announcement gives no timetable for when the Pro tier will follow.
Sources: Google official blog, Google DeepMind model card, CocoLoop; items verified include the introductory and post-promotion API prices, the benchmark rankings and the security-test percentages. The cost estimate is an editorial back-of-envelope figure.