Gemini 4 Carbon: Google's new top AI model, and why you can't use it yet

Google announced Gemini 4 Carbon on Wednesday, 28 October, calling it its strongest model yet, built for cybersecurity and long, multi-step coding work. For now only a small group of cyber defenders can use it; developers, businesses and ordinary users will get it later, with no date given.

It arrives only weeks after Gemini 4 Argon, which Google also opened first to security partners. The pattern is now clear: Google’s most capable models go to defenders before anyone else.

What is Gemini 4 Carbon?

In the announcement, Koray Kavukcuoglu, Google’s chief AI architect and a senior vice president at Google DeepMind, described Carbon as “our strongest model with state-of-the-art cybersecurity and long horizon capabilities”. In plain words, “long horizon” means it can keep working on one big job for a long time, such as tracking down the root cause of a bug across a huge codebase and writing the fix, instead of answering one question at a time.

Google’s own figures:

• Artificial Analysis Intelligence Index v5.0: a score of 59, ranked first.
• SEC-bench Pro (finding security holes): 88.2%.
• ExploitGym (showing a hole can actually be exploited): 54.8%.
• CWE-bench (patching holes): 71.0%.
• WebDev Arena (building websites): up 89 points to 1768, fourth place.

Google also says its Chrome team found Carbon produced high-quality patches more than ten times as often as another lab’s large frontier model, which it did not name.

Who can use it, and what does it cost?

Access starts this week for a subset of cyber defenders and will widen step by step to trusted partners through Google’s Fairwind programme. Google says it is also taking part in the US government’s voluntary pre-release testing of new models.

The introductory price matches Argon: $2 per million input tokens and $10 per million output tokens, with cached input 95% cheaper. After the introductory period it doubles to $4 and $20.

Is it safer?

Google says Carbon makes roughly half as many unsupported claims as Argon in internal tests, that “overreach” (doing more than it was asked) fell 26%, and that high-severity misalignment alerts in live coding dropped by almost 80%. On one prompt-injection test (hidden instructions planted in a web page or file), Google reports a 0% attack success rate. These are the company’s own numbers; independent testers have not yet had a chance to check them.

Our take: what it means for Pakistan

The headline numbers matter less than the rollout. A model good enough at finding and exploiting software flaws is also useful to attackers, so Google is keeping it away from the public until its guardrails are tested. That is sensible, and it means Pakistani developers and freelancers will not see Carbon in their tools for a while.

When it does arrive, the price is the part to watch. Cheap input tokens make long coding jobs affordable for small software houses in Lahore, Karachi and Islamabad that compete on cost. And if tools like this help defenders patch faster, banks, telecoms and government websites here, which are regular targets, stand to gain.

The hype check: a first place on one index is a snapshot. Rival labs release new models every few weeks, and the real test is how Carbon does in independent benchmarks and in the hands of working engineers.

What to watch next: a wider release date, and the first outside results on Google’s safety claims.