Gemini 4 Carbon reaches the API: $2/$10 until November 30, then double, and a safety report that calls it no material change

Thirteen days after announcing it, Google made Gemini 4 Carbon generally available on November 10. Paying developers can now call it through Google AI Studio and the Gemini API, enterprises through Gemini for business, and Google AI Ultra subscribers get it in the Gemini app, AI Mode in Search and the Antigravity coding environment. Until now, access ran almost entirely through Google’s Fairwind program for vetted cyber defenders, which is why our earlier look at Carbon could only weigh third-party benchmarks of a model most builders could not touch.

The launch post, from Google DeepMind’s Koray Kavukcuoglu, also brings the paperwork that was missing: a model card and a dedicated safety and security report.

Price, limits and positioning

The introductory price is $2 per million input tokens and $10 per million output, the same as Gemini 4 Argon. On November 30 it rises to $4 and $20 for the public Carbon model. When Carbon was announced in October the increase had no date; developers now have a 20-day window at the lower rate. At $4/$20, Carbon costs the same per token as Claude Opus 5.5.

The model card fills in the specs. Carbon accepts text, images, audio and video, outputs text, and has a combined input-plus-output context window of up to 1 million tokens. Its knowledge cutoff is March 2026. It is built on Argon, and the card defers to Argon’s documentation for architecture, training data and hardware.

Google is explicit that Carbon is not the default choice. The launch post calls it “our strongest model” but says Argon “remains the ideal choice for the majority of software engineering and knowledge work.” Carbon is for harder tasks where spending more thinking tokens on deeper reasoning and verification pays off, and the model card warns it “may use more tokens to maximize performance, especially at higher thinking levels,” with occasional slowness or timeouts. That matters for budgeting: the same price per token does not mean the same price per task.

The benchmark claims

Google’s headline claims are rankings with cost attached, which is the right framing for an expensive reasoning model:

Evaluation	Carbon’s reported position
CursorBench 4.0, Perplexity WANDR, Zapier AutomationBench	#1, at more than 2x lower cost per task than the next best external model
Multimodal Knowledge Agent (with Artificial Analysis)	#2, at more than 6x lower average cost per task than the top model
Balyasny General Financial Intelligence (pre-release)	Top of 23 frontier model configurations
Hebbia E2E Financial Agentic (pre-release)	Tied with the best model tested

These are vendor-reported, and several come from partners who tested pre-release builds. The independent evidence so far, covered in our earlier post, put Carbon at the top of the Artificial Analysis index but behind Claude Opus 5.5 on SemiAnalysis’s GDPx and on coding-agent rankings, at roughly a third of the cost per task. Google’s numbers fit that picture: Carbon’s case is cost-adjusted leadership, not outright dominance everywhere.

On security work, the report gives Carbon 71.0% Pass@1 on CWE-bench v1, an end-to-end audit-and-patch benchmark of 120 tasks across 73 weakness types and six languages, up from Argon’s 68.0%. On ExploitGym, which measures exploit generation, it reached 54.8%, 12.8 percentage points above Argon. Carbon is also the model that wrote all 6.5 million lines of proof in DeepMind’s same-day machine-code verification of Signal, a more concrete demonstration of long-horizon agent work than any leaderboard.

Why the safety report did not reassess Carbon

The most interesting detail sits in the safety report. Google’s Frontier Safety Framework requires a full critical capability assessment only when a model shows a “Material Capability Change.” Google measures that with an internal General Capability Index modeled on Epoch AI’s Capabilities Index, and treats a gain as material if it exceeds four months of frontier progress; historically, Gemini releases have gained about 4.7 points a month, so the bar is roughly 19 points. Carbon’s increase over Argon fell below it.

So Google did not run a fresh dangerous-capability assessment. It carried Argon’s determinations forward: it cannot rule out that Carbon, without external mitigations, reaches the Cyber Uplift Level 1 critical capability level, the CBRN Uplift Level 1 level for biological information, or the tracked capability level for stealth and situational awareness. It rules out the chemical, radiological and nuclear thresholds and the harmful manipulation and ML R&D levels.

The report itself flags the tension: despite falling below the material-change bar, Carbon showed “a strong improvement over Argon’s already high baseline” on ExploitBench and ExploitGym, and Google says it hardened its cyber mitigations to match. A model marketed as Google’s strongest and an aggregate index that says it is not different enough to re-test can both be accurate, since an index averaged across many benchmarks can hide a large jump in one domain. That is the case for domain-specific triggers alongside aggregate ones.

Mitigation numbers

The report and launch post give these figures against Argon:

• An adaptive red-teaming agent had 99% of attack trajectories blocked; the per-attempt breach rate fell to 0.8% from 3.1%.
• On Gray Swan’s automated cyberattack queries, success fell to 2.17% from 9.86%.
• External tester Trajectory Labs found no new universal jailbreaks in 132 hours and more than 13,000 requests.
• On a 375-task honesty benchmark, Carbon passed 92% against Argon’s 70%, declining to fabricate missing experimental data 98% of the time.
• Automated content safety improved 3.50 points on text and 3.55 on multilingual prompts, but slipped 1.00 point on image-plus-text inputs.

The honesty gain does not settle the hallucination question raised by Artificial Analysis’s AA-Omniscience test, where Carbon’s hallucination rate rose from 4% to 11% as it answered more questions. The two tests measure different behavior, and teams that relied on Argon declining rather than guessing should still evaluate Carbon on their own data. Google also says prompt-injection attacks on Carbon “are still possible,” despite a 0% attack success rate on Gray Swan’s indirect injection benchmark.

What to watch

• November 30. The price doubling will show whether Carbon’s cost-per-task advantage survives at Opus-level token prices, which is where most of its pitch rests.
• Vertex AI. Neither the launch post nor the model card lists Vertex AI, Google Cloud’s main enterprise platform, as a channel.
• Agent swarms. Antigravity’s /swarm command, in preview, coordinates a team of agents from one prompt, the pattern DeepMind used for Signal. How it behaves outside a research team will be telling.
• Free science access. Scientists can apply for six months of free Argon and Carbon access in Antigravity’s top usage tier, which could produce the first independent evidence on Google’s research claims.