Gemini 4 Carbon opens to developers: $2/$10 per million tokens until Nov 30

Google has opened Gemini 4 Carbon, the model it first announced on 28 October to a small group of cyber defenders, to paying developers, enterprises and Google AI Ultra subscribers. On 10 November it priced the model at $2 per million input tokens and $10 per million output tokens until 30 November, then $4 and $20. GitHub Copilot added it the same day. Google's headline claim is not a higher score alone but a lower cost per task on several agent benchmarks, and most of the evidence for that is Google's own.

Key points

• Gemini 4 Carbon is available on 10 November through the Gemini API (Google AI Studio and Gemini for business) for paying users, and to Google AI Ultra subscribers in Google Antigravity, the Gemini app and AI Mode in Search.
• Price: $2 per million input tokens and $10 per million output tokens, the same introductory rate as Gemini 4 Argon; after 30 November 2026 it is $4 and $20.
• Google says Carbon ranks #1 on CursorBench 4.0, Perplexity WANDR and Zapier AutomationBench at more than 2X lower cost per task than the next best external model, and #2 on the Multimodal Knowledge Agent benchmark.
• On the Artificial Analysis Intelligence Index v5.0, Carbon scored 59 at launch per Google's 28 October post; a third-party write-up of Artificial Analysis data lists 59.4, ahead of Claude Opus 5.5 (Max) at 58.4.
• GitHub says Carbon is generally available in Copilot Pro+, Max, Business and Enterprise, billed at provider list pricing.

What happened

Google announced Gemini 4 Carbon on 28 October 2026 as "our strongest model" with state-of-the-art cybersecurity and long-horizon capabilities, two weeks after Gemini 4 Argon. Access then began for a subset of cyber defenders through the Fairwind Program, and Google said it would take a deliberate rollout while participating in the US government's voluntary pre-release model testing. It set no date for general access.

On 10 November Koray Kavukcuoglu, Google DeepMind's SVP and Chief AI Architect, announced the wider release. Carbon sits above Argon, which Google positions for most software engineering and knowledge work. Carbon is meant for harder jobs such as complex multi-step coding and open-ended scientific research, and it spends more tokens reasoning and verifying.

Who gets it, according to Google's post:

• Paying developers and enterprises through the Gemini API, Google AI Studio and Gemini for business (API or the model dropdown), plus Android Studio, Google Antigravity and CodeMender.
• Google AI Ultra subscribers in Google Antigravity, the Gemini app and AI Mode in Search.
• Cyber defenders through "Carbon for cyber" in the Fairwind Program, which opened earlier.
• Scientists, who get free access for six months at Antigravity's highest usage tier through a rolling application process.

A new preview feature, /swarm, in Google Antigravity turns one prompt into a coordinated team of agents tracked in real time. Google says Carbon takes the high-reasoning roles (architecture, coordination, auditing) while faster models handle parallel workspaces and adversarial verifiers.

GitHub's changelog the same day says Carbon is generally available in Copilot for Pro+, Max, Business and Enterprise plans, across VS Code, Visual Studio, Copilot CLI, the coding agent, JetBrains IDEs, Xcode, Eclipse, github.com and GitHub Mobile. Rollout is gradual. Business and Enterprise administrators manage access through the model policy. GitHub does not state a premium-request multiplier; it says the model "is billed at provider list pricing under usage-based billing".

Background

Frontier labs have lately released models in tiers: a cheaper workhorse for everyday work and a costlier model for the hardest tasks. Google followed that pattern with Argon in mid-October and Carbon two weeks later. Anthropic's two-model release is the closest comparison; see our look at Claude Fable 5.2 and Mythos 5.2.

Carbon also shows up in DeepMind's formal-verification work: Google says it used Carbon with other models to help prove key security properties of the Signal protocol in Lean. We covered the underlying project in AlphaProof Code.

The numbers

Google's 10 November post reports:

• CursorBench 4.0, Perplexity WANDR and Zapier AutomationBench: Carbon is #1 on each, with cost per task more than 2X lower than the next best external model.
• Multimodal Knowledge Agent (run with Artificial Analysis): #2, with more than 6X lower average cost per task than the top model.
• Hebbia's end-to-end financial agentic evaluation: matched the best model tested (pre-release). Balyasny's financial intelligence benchmark: top of 23 frontier configurations (pre-release).
• Cyber (Fairwind access): leads SEC-bench Pro (finding vulnerabilities), ExploitGym (exploiting) and CWE-bench v1 (patching). The 28 October post gave 88.2%, 54.8% and 71.0% for SEC-bench Pro, ExploitGym and CWE-bench, measured without guardrails.

The independent view comes from Artificial Analysis. We could not open its site, so these figures come from a third-party write-up by eesel.ai that cites its Intelligence Index v5.0 and cost-per-task data:

Carbon (High)59.4

Claude Opus 5.5 (Max)58.4

GPT-6 Astra (Max)56.9

GPT-6.1 Sol (Max)54.5

Argon (High)50.4

Kimi K3.1 Pro46.0

Artificial Analysis Intelligence Index v5.0 (as listed by eesel.ai) (index points)

	index points
Carbon (High)	59.4
Claude Opus 5.5 (Max)	58.4
GPT-6 Astra (Max)	56.9
GPT-6.1 Sol (Max)	54.5
Argon (High)	50.4
Kimi K3.1 Pro	46.0

Source: Artificial Analysis data via eesel.ai

The same write-up lists cost per task at list price: Carbon (High) $7.76, Claude Opus 5.5 (Max) $10.03, GPT-6 Astra (Max) $6.24, GPT-6.1 Sol (Max) $1.27, Argon (High) $7.68. So by that data Carbon scores higher than Argon by about nine index points at nearly the same cost per task ($7.76 against $7.68), but it is not the cheapest strong model: two OpenAI configurations cost less per task and score lower. The write-up's promotional-rate figure for Carbon ($3.88) is the author's own arithmetic, not a measurement.

Google's safety figures, all from its own post: against an adaptive red-teaming agent in simulated cyberattacks (ExploitBench, CyScenarioBench) Carbon blocked 99% of attack trajectories, with a per-attempt breach rate of 0.8% against 3.1% for Argon. On Gray Swan automated attack queries, success fell to 2.17% from 9.86%. External tester Trajectory Labs found no new universal jailbreaks across 132 hours and more than 13,000 requests. Prompt injection success on the Gray Swan IPI benchmark was 0%, though Google says that remains an area for improvement. On a 375-task agentic honesty benchmark Carbon passed 92%, up from 70% for Argon.

What it means

For developers the story is price against reasoning cost. Carbon's list price is not low, and it spends more tokens per task than Argon (123K output tokens against 116K per task in the eesel table). Whether it saves money depends on whether your tasks fail less often. Google's "2X lower cost per task" claims are about those agent benchmarks, not about your workload; run your own evaluation before routing production traffic.

The promotional price is also a deadline. The introductory $2 and $10 rate ends on 30 November, after which Google's post lists $4 and $20, double. Budget for the higher rate.

For security teams, Google says Carbon "leads" vulnerability discovery, exploitation and patching benchmarks and gives defenders a dedicated Fairwind route. Two sides of that same capability are worth keeping in view: the model is stronger at finding and exploiting bugs, and Google describes added misuse safeguards.

For Copilot users it is one more model in the picker, billed at list pricing, so heavy agent use is metered rather than flat.

What we don't know yet

• Context window. Google's post does not state it.
• Independent verification. Most benchmark claims are Google's, and several evaluations are pre-release or run by partners. The Artificial Analysis figures we cite are second-hand.
• Post-promotion costs. Batch, flex or priority tiers and cached-input pricing after 30 November are not in Google's 10 November post.
• The Fairwind results. Google Cloud Vulnerability Research says it used Carbon to prove two open-source bugs exploitable, with details pending responsible disclosure.
• Conflicting reports. Several outlets reported Carbon as restricted to cyber defenders as of late October. That matched Google's 28 October post and has been superseded by the 10 November announcement.

What to watch next

• Google's Carbon model card and Safety and Security report, which the post links.
• Independent Artificial Analysis and LMArena results now that the model is public.
• How Anthropic and OpenAI respond on price.
• Whether Google extends the introductory rate past 30 November.

Sources

• Google: Gemini 4 Carbon is now available (10 November) (primary)
• Google: Gemini 4 Carbon, our next frontier model (28 October)
• GitHub changelog: Gemini 4 Carbon in GitHub Copilot
• eesel.ai: Gemini 4 Carbon pricing