Gemini 4 Carbon API: Pricing, Benchmarks and Access

Google announced Gemini 4 Carbon on October 28, 2026 as its strongest model to date, topping the Artificial Analysis Intelligence Index v5.0 with a score of 59. The catch is access: only vetted cyber defenders get it this week through the Fairwind Program, with no public API model ID yet.

Pre-announcement trackers still call Carbon an unconfirmed leak. Google now lists benchmarks and pricing, and this guide combines those claims with the independent Vals.ai evaluation and an Argon build-now plan.

Can you call Gemini 4 Carbon today?

No. Gemini 4 Carbon is announced but not generally available to developers, businesses, or consumers as of October 28, 2026. Google says a subset of cyber defenders gets access during announcement week, then trusted partners via the Fairwind Program, with broader availability promised as soon as possible and no firm date.

The stagger reflects unguarded cyber testing and pre-release safety work with U.S. government testing while Google iterates on guardrails. No public model ID, AI Studio listing, or rate limits are named.

This replaces last week's status. Before October 28, Google's developer docs listed only gemini-4-argon as the Gemini 4 API model, and trackers correctly said no Carbon ID existed. That was accurate then and outdated now: Carbon exists as an announced product, just not as a callable endpoint.

If you see a provider listing gemini-4-carbon today, treat it as unverified until the provider documents the upstream model, route type (public, restricted, experimental, or alias), and permissions. A listing alone does not prove Google routed that checkpoint to the caller.

What Carbon is actually for

Gemini 4 Carbon targets sustained, multi-day engineering work rather than single-turn chat. Google says internal teams watched it run for days, persisting through dead ends on tasks like root-causing subtle bugs, patching them across large codebases, and working in low-level systems.

That positioning comes from user feedback on coding, agentic work, scientific tasks, full-stack web development, and multimodal understanding. The one external leaderboard Google cites here is WebDev Arena: Carbon gained 89 Elo points to reach 1768 and rank #4, which Google attributes to better output quality and better generated artifacts.

Google also claims more than a 2x uplift over Gemini 4 Argon in internal secure-code-generation success rate. The multiplier is unpublished in absolute terms — no baseline, dataset size, or language breakdown — so read it as direction, not a migration justification. The related Chrome-team claim of more than 10x better high-quality patches than another lab's large frontier model has the same problem: the rival model is unnamed and the metric undefined.

Argon launched in mid-October 2026; Carbon tops the same line and safety stack.

The cyber scorecard, and what the numbers leave out

Carbon's headline differentiator is full-lifecycle cyber coverage: find vulnerabilities, validate exploitability, then patch root causes. Google reports all three external evaluations were run without guardrails, so they measure underlying capability, not what a guarded production endpoint will permit.

Three caveats matter more than the percentages. First, do not multiply 88.2% x 54.8% x 71.0% into an end-to-end success rate; each score comes from a separate task set. Second, discovery (88.2%) is normally easier to automate than safe remediation (71.0%), and exploitation (54.8%) requires the most planning — the descending pattern is expected, not a flaw. Third, Google's Wiz finding of web-pen-testing leadership, tied to its Scan for Good initiative, ships with no benchmark name or score and cannot be compared.

The practical read: Carbon looks strongest as a defender triage and patching assistant for teams with large backlogs, not as an autonomous red team. Exploit capability is also why access is restricted in the first place.

Safety and integrity: 0% cheating, 0% prompt injection

Carbon's second claim is reliability under pressure, and the numbers are unusually specific. Google reports 0.0% successful cheating and 0.4% attempted cheating on Terminal-Bench 4.0 with overall accuracy up at the same time. High-severity misalignment alerts fell by almost 80% in live internal coding environments.

Prompt-injection resistance also improved on the Gray Swan Indirect Prompt Injection benchmark. Argon's prior leading result was 0.7% attack success; Carbon reports 0.0% with no successful attacks recorded in the reported evaluation. Google adds 26% less overreach and 29% less under-service versus the prior baseline, framed as more reliable multi-step execution within scope.

Each improvement lacks the denominator needed to replicate it. Google gives no attack count behind the 0.0%, no baseline alert rate behind the almost-80% drop, no scoring rubric for overreach versus under-service, and no cheating-detection methodology. Treat the direction as encouraging for agent deployments, but keep your own tool-call logs and branch protections. Google's internal stack (training, real-time misuse defenses, prompt-injection resilience, chain-of-thought monitoring) does not transfer to your harness automatically.

The independent check: Vals.ai ranks it #2, not #1

Vendor benchmarks need a second source, and Vals.ai published one on October 28, 2026. Its overall Vals Index puts Carbon at #2 of 29 with 70.36% (±0.97), between Claude Sonnet 5.5 at 70.85% and Claude Opus 5.5 at 70.18%. Test cost was $10.51 with a 47-minute 45-second evaluation latency at high reasoning effort.

The breakdown is more useful than the rank. Carbon is #1 of 87 on Legal Research Bench and #1 of 33 on the Vals Finance Index, #2 of 35 on EMB v1.1, and #4 of 57 on Terminal-Bench 4.0 at 63.13%. Its weakest listed result is 17.50% on HLAB-Vals-1.1 (#6 of 30), and its 89.06% on Vibe Code Bench v1.1 only ranks #8 of 121 — strong raw score, crowded field.

Carbon's edge concentrates in research, finance, and legal-agent work plus solid coding, not uniform dominance. Vals lists a 1-million-token context window with private weights and $4 per million input / $20 per million output pricing (post-introductory rates), matching Google's standard-tier numbers below. Vals cautions some benchmarks may use different providers or parameters, so check per-benchmark configs before citing a single figure.

Pre-announcement trackers predate both the pricing and Vals update; one detailed analysis still states no price has been published.

What it will cost when the API opens

Google published Carbon pricing at announcement, at the same introductory rates as Argon. There is no expiration date for the introductory period and no subscription or rate-limit sheet yet.

Cached-input math is derived, not printed: 95% off $2 is $0.10, and 95% off $4 is $0.20. Long-context agent runs with repeated code context benefit most from that discount, but output tokens still dominate the bill at 5x the input rate.

Do not budget on sticker price alone. Measure cost per accepted result — total spend including retries, discarded outputs, repeated context, and repair calls divided by accepted results. A cheaper route that needs three repair passes routinely loses to a pricier route that lands in one. Google discloses no latency or throughput figures for Carbon, so tokens-per-second comparisons are speculation.

Related reading on the current bill: Gemini 4 Argon API pricing and availability and what we know about Gemini 4.

Why early testers sound annoyed

Pre-release testers report the same tradeoff in TestingCatalog's October 23 roundup: visibly better 3D generation than Argon, but much slower responses and continued weak frontend and UI output, with one tester estimating roughly 2-4x slower responses depending on the task.

Access frustration dominates real-user discussion more than any benchmark:

i really don't understand google's model release strategy. gemini 4 carbon looks impressive on benchmarks, but once again, people can't use it. access it initially limited, with no date for GA release.

— @Ananth7e

The complaint pattern repeats across threads: quota consumption feels unpredictable on Argon, five-minute sessions hitting hourly limits, and edition fragmentation across the Gemini App, AI Studio, and Antigravity. Another tester distills the verification problem:

Only vetted cyber defenders get access this week, wider release "soon". My take: a leaderboard run inside the maker's own harness is half a result. Wait for someone to run it in a neutral one.

— @jimmyyangrz

What to build on this week

Do not pause development waiting for Carbon. The practical setup is: ship on a confirmed model now, keep the new model as a swappable candidate.

1. Build on gemini-4-argon today using its documented API, and keep base URL, API key, and model ID outside business logic.
2. Freeze a 30-to-50-task eval set from your own repo — bug fixes, refactors, security reviews — and record pass rate, review time, and cost per accepted result before Carbon arrives.
3. Add agent guardrails now that multi-day runs will need anyway: branch-based work, spending caps, tool-call audit logs, checkpoints, and human review gates.
4. When a Carbon route is documented for your account, add it as a candidate, rerun the same set, and compare quality, latency, cost, and feature support (streaming, images, function calling, structured output) before shifting traffic. Start new sessions rather than swapping models mid-task.

Teams with large AppSec backlogs should additionally log every tool call and test for benchmark-style cheating (hard-coded outputs, test-file edits) in their own repo. Google's 0.0% is a vendor result on its harness, not a guarantee in yours.

Gemini 4 Carbon FAQ

Is Gemini 4 Carbon available via API?

Not publicly. Announcement-week access is limited to cyber defenders, expanding to Fairwind trusted partners. Developers, businesses, and consumers have no date. Build on Argon and keep the model ID configurable.

What is the model ID for Gemini 4 Carbon?

Google has not published one. Do not assume gemini-4-carbon works. Use only an identifier your provider explicitly documents with endpoint, permissions, and pricing.

How much does Gemini 4 Carbon cost?

Introductory $2 per million input and $10 per million output tokens, with cached input 95% off (~$0.10). Standard pricing later is $4 input and $20 output (~$0.20 cached). No duration for the introductory window is given.

How does Carbon compare with Argon?

Google claims more than 2x secure-code uplift, 26% less overreach, 29% less under-service, and 0.0% versus 0.7% prompt-injection success. Independent Vals data covers Carbon only; treat Argon deltas as vendor-internal until neutral reruns land.

Does Carbon beat Claude Opus 5.5 or GPT-6.1 Terra?

Not proven head-to-head. One pre-launch employee impression reported via GetAICodingAgent said Carbon feels like Opus 5.5 for coding, and Vals has Carbon (70.36%) a hair above Opus 5.5 (70.18%) overall but below Sonnet 5.5 (70.85%). No controlled Carbon-versus-Terra result is published.

When is general availability?

Google says as soon as possible after defender and partner phases, with no date. Watch the official DeepMind blog and your provider's model catalog, not leak threads.