Gemini 4 Carbon Review 2026: Why Defenders Got It First

This analysis was written by the aifreetool Editorial Team — a group of full-time AI-industry researchers and writers who verify every claim against primary sources. Last updated October 30, 2026. We keep no affiliate relationship with the companies covered here.

TL;DR: Google announced Gemini 4 Carbon on October 28, 2026, and it takes first place on the Artificial Analysis Intelligence Index v5.0 by a single point: 59 against 58 for Claude Opus 5.5 and 57 for GPT-6 Astra. The release order matters more than the ranking. Access went to vetted cyber defenders first, then to Google's 650-partner Fairwind Program, with no public API and no date for one.

Read Google's three security numbers in sequence and the shape of the product becomes obvious. Carbon finds flaws far better than it fixes them, and fixes them better than it exploits them. That gradient is why the model is hand-delivered to defenders instead of dropped into a self-serve endpoint.

What Google Actually Shipped

Koray Kavukcuoglu, a senior vice president at Google DeepMind, published the launch post under the title "Gemini 4 Carbon: our next frontier model" on October 28. It is the second Gemini 4 model in two weeks, following Argon, and Google frames it around two capabilities: long-horizon agentic work, and security work covering vulnerability discovery, exploitation and patching. The launch details make the staging unusually explicit for a flagship release.

The phrase to note is that Carbon can "run for days" on complex engineering tasks. A model that keeps working for days touches a lot of systems, which is exactly why nothing about access is automatic.

At launch there was no model ID, no API endpoint, no pricing page, no general-availability date, and no list of Google products that will carry it. Carbon is also inside the US government's voluntary pre-release testing arrangement, which Google disclosed without detail.

Three Benchmarks, Three Different Jobs

Google reported three security results, each measuring a different step in the job. Read as a set they matter far more than any single number.

On the general index the lead is one point: 59 on Artificial Analysis Intelligence Index v5.0, against 58 for Claude Opus 5.5 and 57 for GPT-6 Astra. It does not hold everywhere. Carbon scores 81.5% on OSWorld-2.1 where Opus 5.5 scores 87.2%, it trails Astra on FrontierSWE 2, and Vals AI ranks it second on Vals Index v2.2 at 70.36%, behind Claude Sonnet 5.5 at 70.85%.

None of this is independently verified yet. The index score is vendor-submitted, the security benchmarks were run by Google without guardrails, and the Chrome and Wiz results are partner evaluations rather than outside replication. Treat every figure as a claim waiting to be tested.

Two partner claims are worth flagging anyway, because they are specific. Google says Carbon generates secure code with more than twice Argon's success rate, and that its Chrome team found Carbon writing patches roughly ten times better than another lab's large frontier model. A 10x claim about patch quality from a browser team shipping to billions of installs is the kind of assertion outsiders will attack first.

Why the Release Order Is the Story

Carbon's first cohort is a subset of vetted cyber defenders. Beyond that, access moves through the Fairwind Program, which Google announced on September 2, 2026 and describes as covering more than 650 partners. The program prioritises governments and national cyber authorities, critical infrastructure operators in healthcare, telecom, energy and finance, and core technology platforms.

The conditions are strict and worth reading as a template: background checks on applicants, user-level authentication with phishing-resistant multi-factor authentication, access confined to internal cybersecurity, incident response and penetration testing teams, access and use logging, and no sharing, resale or redistribution. Permitted dual-use work covers authorised threat simulation, reverse engineering and malware analysis for defensive or academic research. Building malware is out.

Note the loose end. At the time of writing the Fairwind page still names Gemini 4 Argon as the program's model, used alone or with the CodeMender code-security agent. The terms that will actually govern Carbon have not been published.

Argon went to defenders first too, two weeks earlier. That makes this the second data point in a pattern the industry settled into during 2026: OpenAI moved frontier training into an offline world and gated access, Anthropic restricted its strongest models, and Google now ships a security model to defenders before developers. Capability gating has become the default distribution model for anything that can find and use a vulnerability.

The practical consequence for enterprises is a split toolchain. Security and incident response may hold a model the engineering organisation cannot call, which inverts the usual flow where a security team reviews work produced on the same tool.

The PHP2Shell Problem Behind the Launch

Two critical PHP vulnerabilities disclosed in October 2026 affected roughly 70% of websites, and the response involved Wiz, OpenAI and the PHP maintainers working in parallel to ship patches. Wiz chief technology officer Tomer Schwartz described the dynamic to TechCrunch's Equity podcast: AI accelerates discovery, and manual patching cannot keep pace. He called what follows a vulnpocalypse.

That is the market Carbon is aimed at, and it reframes the benchmarks. If discovery outruns remediation, the 71.0% patch score is the number that decides whether a security team's week improves. An 88.2% find rate with a 71.0% fix rate produces more tickets than a team can close by hand, and roughly three in ten of the model's patches will not be good enough.

Calling the product defensive does not change the arithmetic for whoever receives the output. A model better at finding than fixing lengthens the queue before it shortens it.

What It Costs, and What to Budget

Google published Carbon's price list before opening the model: $2 per million input tokens and $10 per million output tokens during an introductory period, with cached input at 95% off the input rate. Afterwards, $4 and $20. No end date for the introductory window was announced.

Argon's equivalent window ends on November 30, 2026, with rates doubling on December 1, which is the clearest signal of how Google treats introductory pricing: a launch discount, not a commitment.

• Budget on $4 and $20 per million tokens, not $2 and $10.
• Long-horizon security runs read whole repositories, so input volume dominates the bill.
• Cached input at 95% off rewards repeated scans of the same codebase over one-off reviews.

• Key Takeaways:
  • Gemini 4 Carbon landed on October 28, 2026, leading the Artificial Analysis Intelligence Index v5.0 by one point at 59.
  • Its skill gradient is uneven: 88.2% at finding flaws, 71.0% at patching them, 54.8% at exploiting them.
  • Access is gated to vetted defenders and Fairwind partners; there is no public API and no release date.
  • All headline figures are vendor-reported and have not been independently replicated.
  • Plan on $4 and $20 per million tokens; the $2 and $10 introductory rate has no published end date.

My Take / The Bottom Line

Google shipped the right model in the right order and told the story badly. Leading with a one-point index win invites an argument it cannot win, because Opus 5.5 beats Carbon on OSWorld-2.1 and Sonnet 5.5 beats it on Vals. Leading with 88.2% at finding and 71.0% at fixing would have been more honest and more useful, because that pair defines the product: a very good bug hunter whose patches still need review.

Best for: security and incident response teams at regulated firms that can pass a background check and want a second opinion on vulnerability triage at scale. Trade-off: you give up self-service for vetting, and Fairwind access in November means paperwork, MFA and a scope agreement, while the terms governing Carbon specifically remain unpublished. The verdict I would defend: gating is correct and will be copied, but no team should let a defender-labelled model auto-merge a patch — at 71.0% on CWE-bench roughly three fixes in ten fail, and a wrong patch in production is its own outage.

Our tech deep dives archive tracks how labs tier access to their strongest models, and the Cua Spaces listing shows what a supervised agent desktop looks like when a human keeps the controls. The wider agent-safety thread runs through the AI industry trends archive.

FAQ

Q: What is Gemini 4 Carbon?
Google's frontier model announced October 28, 2026, built around long-horizon agentic work and cybersecurity: finding vulnerabilities, exploiting them and writing patches. It is the second Gemini 4 model, after Argon.

Q: Can I use Gemini 4 Carbon today?
Only if you are in the initial cohort of vetted cyber defenders or a Fairwind Program partner. There is no public API, and Google has given no date for developer or consumer access.

Q: How does Gemini 4 Carbon compare with Claude Opus 5.5?
On the Artificial Analysis Intelligence Index v5.0 it scores 59 to Opus 5.5's 58, a one-point lead. On OSWorld-2.1, Opus 5.5 scores 87.2% against Carbon's 81.5%.

Q: What does Gemini 4 Carbon cost?
An introductory $2 per million input tokens and $10 per million output tokens, with cached input 95% off, rising to $4 and $20 after the introductory period. Google has not published that end date.