Gemini 4 Carbon is now the top-scoring model on the Artificial Analysis Intelligence Index, and almost no enterprise can use it yet. Google announced Carbon on October 28, 2026 and is releasing it first to a subset of cyber defenders in its Fairwind Program, with no date for developers or businesses. If you run a security team at a bank, hospital, utility, telecom or government agency, apply for Fairwind access and plan a vulnerability-triage eval. Everyone else should budget at the $4/$20 post-introductory price and leave production model choices alone until Carbon ships somewhere you can buy it.
Three details matter more than the rank. The lead over Claude Opus 5.5 is one point. Carbon costs more per task than Opus 5.5 at a setting that scores two points lower. And its hallucination rate rose from Argon's.
What Did Google Ship on October 28?
Google shipped a model you can read about but probably cannot call. In the launch post, Koray Kavukcuoglu calls Carbon Google's "strongest model with state-of-the-art cybersecurity and long horizon capabilities." Access starts with "a subset of cyber defenders" and expands to more trusted partners through Fairwind. Developers, businesses and consumers get it "as soon as possible," while Google gathers feedback and iterates on guardrails. Google also says it is "actively engaged in the U.S. government's voluntary process for pre-release model testing."
The post does not mention the Gemini API, Vertex AI or Gemini Enterprise by name, and gives no end date for introductory pricing. Carbon arrives two weeks after Gemini 4 Argon, which Google positions as its predecessor.
Pricing follows Argon's template: $2 per million input tokens and $10 per million output tokens to start, cached input at 95% off, then $4 and $20 after the introductory period, per Google.
How Big Is Carbon's Benchmark Lead?
On the general index the lead is one point, which is small. Artificial Analysis's leaderboard puts Carbon (high) at 59, Claude Opus 5.5 (max) at 58, and GPT-6 Astra (max) at 57. Google's own Argon scores 50 on the same index. A one-point gap on a composite of many evaluations is the kind that disappears on a single workload, so treat it as "tied for first" when you brief your leadership.
The security numbers are where Google is staking its claim, and they are vendor-reported. Google cites 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on ExploitGym for exploiting them, and 71.0% on Collinear's CWE-bench for patching. Google also says it ran those external benchmarks without guardrails, which means the model your security team gets may score differently.
You can't check the CWE-bench figure on Artificial Analysis yet. Its own implementation, CWE-Bench-AA, grades all-or-nothing: a task passes only when a programmatic exploit check confirms the vulnerability is closed and legitimate behavior still works. Its top visible pass@1 score is DeepSeek V4.1 Flash 1017 (Max) at 69.2%, and Carbon did not appear in the page's visible results when we checked on October 29. Until an independent run appears, the 71% is Google's number.
Two claims have no published data behind them. Google says Chrome's security team found Carbon more than 10x better than "another lab's large frontier model" at generating high-quality patches, and WinBuzzer reports that Google cited Wiz results on web penetration testing without numbers. Write both down as anecdotes.
Where Does Carbon Fall Short?
Carbon trails on agentic coding and computer use, and it hallucinates more than Argon. According to WinBuzzer's tally, Carbon scores 61.2% on FrontierSWE 2 against GPT-6 Astra's 65.5% and Opus 5.5's 62.3%, and 81.5% on an offline OSWorld subset against Opus 5.5's 87.2%. On the Artificial Analysis Coding Agent Index, Claude Code with Opus 5.5 scores 62 and Carbon in Antigravity scores 59, per the same report.
Hallucination is the number to bring to your risk committee. Artificial Analysis's AA-Omniscience evaluation lists Carbon's hallucination rate at 11%, against 4% for Argon, the lowest on that page. WinBuzzer notes that Carbon answered more questions correctly than Argon, so the higher rate means it guesses more often when it doesn't know. For vulnerability work, a confidently wrong finding costs analyst hours. A confidently wrong patch costs more.
It is also verbose. The Artificial Analysis model page shows Carbon producing 200M output tokens to run the index against a 64M median, with 102.5 output tokens per second and a 100.31-second time to first token in reasoning mode. That latency rules it out of anything interactive. For overnight code scanning it hardly matters.
What Will Carbon Cost Per Task?
Plan on about what Argon costs per task, which is more than Opus 5.5 at xhigh effort. Artificial Analysis already prices Carbon at the post-introductory $4/$20 and measures $7.76 per index task. That compares with $7.68 for Argon, $10.04 for Opus 5.5 at max effort, $6.05 for Opus 5.5 at xhigh, and $6.24 for GPT-6 Astra at max. Opus 5.5 at xhigh scores 57 for $1.71 less per task than Carbon.
The introductory discount is real but temporary. Argon's introductory pricing ends November 30, 2026. Carbon's post gives no end date. At the standard rate, every billion output tokens moves from $10,000 to $20,000 per month, and Carbon's token appetite means you will burn more of them than the index median. Build the business case at $4/$20. Anything cheaper is a bonus for a few weeks.
We made the same call on Argon: the $4/$20 rate was the one to budget. Per-token price is the wrong comparison anyway; Sonnet 5.5 can cost more than Opus 5.5 at a matched score. Cost per completed task is the number that holds up.
Who Can Get Fairwind Access?
Fairwind is built for critical infrastructure and governments, and its terms are strict. The Fairwind Program page prioritizes governments and national cyber authorities, critical infrastructure operators (healthcare, telecommunications, energy and financial networks) and core technology platforms. Academic labs doing defensive benchmarking may apply. Google says the program has more than 650 partners.
The conditions are worth reading before you apply:
- Use is limited to authorized threat simulation, reverse engineering and malware analysis for defense or academic research. Creating malware is prohibited.
- Access must sit behind user-level authentication and phishing-resistant MFA, limited to internal security, incident response or penetration-testing teams, with employee use tracked.
- Organizations undergo background checks and may not share, redistribute or sell access.
- Zero data retention is supported when Argon is accessed as a managed model on Gemini Enterprise. The page does not yet describe Carbon's terms.
Review is "as soon as we can," with no published timeline. Fairwind pairs with CodeMender, Google's code security agent, which is where students and ineligible organizations are pointed instead.
When Will Everyone Else Get It?
Probably weeks, based on Google's own last launch, though Google has promised nothing. Argon was announced September 30 to trusted testers and Fairwind defenders, and Google's Argon post says it became globally available to developers and enterprises via the API on October 13. That was 13 days.
The other precedent runs the opposite way. Anthropic gated Claude Mythos Preview through Project Glasswing in April 2026 and says it does "not plan to make Claude Mythos Preview generally available." We covered that gated release at the time. Google's wording, "as soon as possible" for developers and businesses, reads closer to Argon than to Mythos. Still, a staged release that waits on government testing and guardrail tuning can slip, and OpenAI pulled GPT-6.1 Astra after testing found problems late.
What to Do About Carbon
The right move depends on whether your security team qualifies for Fairwind.
This Week:
- If you operate critical infrastructure or a core technology platform, have your security lead submit the Fairwind interest form, and name in it which internal team (IR, AppSec or red team) will hold access.
- Pull 20 to 30 closed vulnerabilities from your own repos, with the fixing commits, into a held-out set. That is your eval for Carbon, Argon and whatever you use now. Public benchmarks scored without guardrails won't tell you how the gated model performs on your code.
This Month:
- Run Argon, which you can already buy, against that set as the baseline. Score patches the way CWE-Bench-AA does: the exploit must fail and your tests must pass. No partial credit.
- Add a hallucination check. Count findings that cite code that doesn't exist or a CWE that doesn't apply. Carbon's 11% rate on AA-Omniscience says this is where it will cost your analysts time.
- Update the AI budget line for Gemini 4 to $4/$20 per million tokens, and model Carbon at about $7.76 per task-equivalent rather than the introductory price.
Before Your Next Model Commit Decision:
- Do not move production coding or agent workloads to Carbon on a one-point index lead. Opus 5.5 and GPT-6 Astra still lead on FrontierSWE 2 and computer use, and both are commercially available today.
- If your Google Cloud commit is up for renewal, ask your account team in writing when Carbon reaches the Gemini API, Vertex AI and Gemini Enterprise, and whether zero data retention will apply.
The Bottom Line
Carbon follows Anthropic's Mythos and Google's own Argon as a frontier model that reached security teams before anyone else. Mythos and Carbon were both framed around cyber capability that could help an attacker as easily as a defender. So far the pattern has two outcomes: Argon went public in 13 days, and Mythos stayed gated. Since you can't know which path Carbon takes, build the eval set now so you can score it in a day when access arrives, whether that comes through Fairwind or the API.
Apply for Fairwind if you qualify, and price the rest of your Gemini 4 plan at $4/$20.
Continue Reading
- Gemini 4 Argon Leads Vals at $15.68 a Task With No GA Date
- Anthropic's AI Too Dangerous to Release Publicly
- 55 Zero-Days in 2 Hours. Google's $32B Security Bet Went Live.
- OpenAI Pulled GPT-6.1 Astra Over a Flaw GPT-6 Astra Still Has
- Claude Sonnet 5.5 Costs More Than Opus 5.5 at the Same Score
- Anthropic's OSS Scanner Sends Vulnerability Reports Without Review