# Gemini 4 Carbon: Pricing, Benchmarks and Restricted API Access

Google's next frontier model leads a major independent index, but developers should separate its announced prices from actual access.

By Paras Madan | 2026-10-28

Google announced Gemini 4 Carbon on October 28, targeting harder coding and cybersecurity work. Access starts with selected cyber defenders this week, rather than a general developer release. For teams planning a migration, **availability is the first constraint**, even before benchmark scores or token prices.

## Gemini 4 Carbon pricing

[Google's announcement](https://blog.google/innovation-and-ai/models-and-research/gemini-models/introducing-gemini-4-carbon/) sets the following future token prices. These are announced launch prices, not evidence that you can call a public endpoint today.

| Per million tokens | Introductory price | After introduction |
| --- | --- | --- |
| Input | $2 | $4 |
| Output | $10 | $20 |
| Cached input | 95% below input price | Discount stated; detailed billing documentation pending |

The announcement does not give Carbon's introductory end date. Do not automatically borrow another model's billing calendar when estimating a production budget.

For a hypothetical uncached workload of one million input and one million output tokens, the listed introductory rates imply $12, rising to $24 afterward. That calculation excludes any tools, retries or other charges. A multi-step agent's useful cost metric remains the bill for a completed, reviewed task, not one model response.

## Is Gemini 4 Carbon available through the API?

Google is expanding access gradually through trusted partners in its Fairwind Program. Broader developer, business and consumer availability is still forthcoming, without a firm date in the announcement.

The [Gemini API model catalogue](https://ai.google.dev/gemini-api/docs/models) still lists Gemini 4 Argon as its available Gemini 4 model. It does not list a Carbon endpoint. Carbon's context window, output limit and public rate limits therefore remain unconfirmed here; Argon's specifications should not be copied across.

[Fairwind](https://deepmind.google/fairwind-program/) is a controlled-access program for defenders, including critical infrastructure organizations. Its governance includes organizational checks and restrictions on sharing access. Applying is different from receiving access, and membership should not be treated as a general-purpose developer subscription.

## What the independent benchmarks show

[Artificial Analysis](https://artificialanalysis.ai/evaluations/artificial-analysis-intelligence-index) lists Gemini 4 Carbon at High reasoning with a score of 59 on Intelligence Index v5.0. Claude Opus 5.5 at Max with Default Fallback follows at 58. The index combines nine evaluations across coding, reasoning, science and work tasks.

A one-point composite lead is useful evidence, but it does not establish a winner for every workload. Reasoning settings matter, and a composite can hide a model's weak spots. Teams should compare the tasks they actually need to complete rather than treat the overall position as a migration instruction.

The more specific comparison is in [CWE-bench v1](https://cwe-bench.com/), which tests security auditing and patching across 120 held-out tasks. Carbon with Antigravity scores 71% on the programmatic pass-at-one measure, against 68% for Argon with the same harness. Carbon's judge-panel result is 70%, and its four-attempt programmatic score is 81%.

That is a three-percentage-point improvement on the first-attempt measure, not a claim that Carbon fixes 71% of vulnerabilities in any company's software. The benchmark gives each rollout an hour and checks both whether the exploit is blocked and whether existing tests pass. Carbon has no published rollout-cost figure on that leaderboard yet.

## What changes for engineering teams

Google also reports 88.2% on SEC-bench Pro and 54.8% on ExploitGym, with the external cyber evaluations run without guardrails. Those are vendor-reported results. They should not be read as measured performance of the eventual guarded public service.

The useful question for an engineering team is whether a stronger model reduces the amount of human work between finding a suspicious pattern and accepting a safe patch. A proposed fix still needs reproduction, regression tests and review. Better first-pass results can make that queue smaller without making those checks optional.

For now, keep a representative set of difficult bugs and rejected patches ready for evaluation. When access arrives, compare completed fixes, regressions and total spend against the existing workflow. **A more capable agent becomes valuable when fewer problems survive the review process**, not simply when it produces more patches.

I'm Paras. I work at the intersection of AI, engineering and distribution.

I help technical founders turn launches and complex product updates into clear stories that developers and founders read and share.

[Book a 30-minute call](https://cal.com/paras-madan/30min)