GOOGLE · NEW MODEL

Google Gemini 4 Carbon: capabilities, pricing and availability

Google has announced Gemini 4 Carbon, a model for complex coding and cybersecurity tasks. What is confirmed, what do the numbers mean, and how can you prepare for access?

Vibe Coding editorial team · October 28, 2026 · Checked against Google primary sources

As of October 28, 2026, Google has announced Carbon but has not released it to the general public. Selected cyber defenders receive access first; the company has not given a general release date.

What Carbon is and how it differs from Argon

Gemini 4 Carbon is a cloud model from Google for complex, multi-step tasks. Google highlights large codebases, web development, vulnerability analysis and patch generation. The company says internal teams have seen it work on some difficult tasks for days. These are reported capabilities under test conditions, not a promise that any project can run unattended.

Carbon follows Gemini 4 Argon. Argon is already available through the Gemini API and Google AI Studio; consumer access depends on subscription and region. Carbon is in an early rollout at announcement. Do not confuse Gemini with Gemma: Gemma can be downloaded locally, while Google has not announced an offline phone version of Carbon.

Is it really stronger than Claude and other models?

According to Google’s table, Carbon scored 88.2% on SEC-bench Pro for vulnerability discovery, 54.8% on ExploitGym and 71.0% on CWE-bench for patching. In that table, SEC-bench Pro scores are 88.2% for Carbon, 83.4% for Argon and 85.4% for GPT-6 Astra; no Claude Opus 5.5 result is shown for that test.

Results vary by test: Google’s table reports 72.5% for Carbon and 66.3% for Opus 5.5 on Chartography. That compares one task under Google’s conditions, not every kind of work. Google says its cybersecurity evaluations were run without guardrails; a public version may behave differently.

A practical test for a vibe coder: give models the same small task on a copy of a project, fix the requirements, and compare the working result, tests, time and cost. Do not give a new model secrets or production-server access simply because it scores well on a chart.

What the API will cost

Google announced introductory Carbon pricing of $2 per million input tokens and $10 per million output tokens, with a 95% discount for cached input. After the introductory period, the announced rates are $4 and $20 respectively. The announcement does not specify Carbon’s end date. These are API rates, not Gemini subscription prices or proof that all free Google services are ending.

Example: 100,000 input and 10,000 output tokens at introductory rates would cost roughly $0.30; at the subsequent rates, $0.60. This is a simplified estimate without caching, extra tools or taxes. Check reasoning charges and other terms in the final Carbon documentation when available.

What happened with PHP, and did Carbon find it?

On October 21, Google Cloud reported two critical PHP core vulnerabilities, CVE-2026-109618 and CVE-2026-109619. They can lead to remote code execution and information disclosure. Google says Wiz used a mix of models and that Gemini 4 Argon made an important contribution. That source does not establish that Carbon found these vulnerabilities.

If your site uses PHP, ask your host or developer to check the web server’s PHP version, containers and embedded components. Google lists fixed releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35; PHP 8.1 and older have no official fixes. Update the relevant runtime, rebuild and redeploy containers where needed, and restart workers. Check current guidance with your host and Google’s bulletin.

How to try it and what to do now

At launch Google is offering Carbon to a subset of Fairwind participants and plans to expand access to developers, businesses and consumers. An announcement is not availability: check Google AI Studio and Gemini API’s official pages when Carbon appears in their model lists. Do not enter API keys on third-party sites promising early access.

While waiting, prepare a safe test: back up the project, remove keys from test data, define acceptance criteria and keep final decisions with a human. For a local phone model, see our separate Gemma 4 guide.

How to install Gemma 4 on a phone or PC →