Gemini 4 Carbon Reaches Every Paying Gemini API Developer at $2 per Million Input Tokens, With the Price Set to Double After November 30

Google has opened Gemini 4 Carbon, which it calls its strongest model, to all paying Gemini API developers, enterprises and Google AI Ultra subscribers. The release on November 10, 2026 ends a two-week period in which Carbon was available only to a group of cybersecurity defenders through Google’s Fairwind Program.

Koray Kavukcuoglu, SVP at Google DeepMind and Google’s Chief AI Architect, describes Carbon as the company’s “strongest model with frontier performance in cybersecurity capabilities and long-horizon agentic workflows.” Google positions it above Gemini 4 Argon, which it says “remains the ideal choice for the majority of software engineering and knowledge work.” Carbon is meant for the hardest jobs, such as multi-step coding and debugging and open-ended scientific research, and Google says it uses more tokens than Argon to explore, reason and run extended verification loops.

An introductory price with an end date

Carbon is available through the Gemini API in Google AI Studio and Gemini for business at $2 per million input tokens and $10 per million output tokens, the same introductory price as Argon. That rate is temporary. A footnote on the launch page says that after the introductory period ends on November 30, 2026, the price becomes $4 per million input tokens and $20 per million output tokens for the public-access Carbon model.

Developers have about three weeks at the lower rate. Google says Carbon ranks first on CursorBench 4.0, Perplexity’s WANDR and Zapier’s AutomationBench “at more than 2X lower cost per task compared to the next best external model.” On a new Multimodal Knowledge Agent (MKA) benchmark, built with Artificial Analysis to test agents working over dense files with charts, schematics and tables, Google says Carbon ranks second while costing more than six times less per task than the top model.

Beyond the API, Carbon is rolling out to Google AI Ultra subscribers in Google Antigravity, the Gemini app and AI Mode in Search.

/swarm turns one prompt into a team of agents

The launch also previews /swarm in Google Antigravity, a feature that turns a single prompt into a coordinated team of agents that users can track in real time. Google suggests assigning Carbon to roles that need the deepest reasoning, such as architectural design, coordination and auditing, while lighter, faster models work in parallel isolated workspaces and adversarial verifiers test each change.

Google’s demonstrations lean on that setup. In one, a team of Carbon agents used seven public city-council planning PDFs, containing 206 extracted engineering drawing views, to build an interactive 906,000-triangle Three.js reconstruction of a Google office across 10 overnight loops.

On finance work, Google says Carbon matched the best model tested on Hebbia’s E2E Financial Agentic evaluation and ranked first of 23 frontier model configurations on Balyasny Asset Management’s General Financial Intelligence benchmark. All of these results come from Google or its partners.

Cyber access stays gated

The general release does not open Carbon’s full security tooling to everyone. “Gemini 4 Carbon for cyber” remains available through the Fairwind Program, where Google says it leads benchmarks for finding (SEC-bench Pro), exploiting (ExploitGym) and patching (CWE-bench v1) vulnerabilities. Defenders must still apply for access on a rolling basis.

Google listed early results. In Project Fortify, its internal autonomous scanning and remediation system, Carbon reached 100% recall on scanning and 95% precision on triage on an internal benchmark. Google’s Cloud Vulnerability Research team used it to show that two bugs in a popular open-source project were exploitable, leading maintainers to reclassify the issue as critical; details are being held until disclosure completes.

Google says its researchers built a formal-verification framework called AlphaProof Code, whose agents used Carbon, alongside other models, to generate millions of lines of Lean to prove key security properties of the code behind Signal’s cryptographic protocol in weeks.

New safety numbers for the wider release

Because the general model carries stronger cyber capabilities, Google published updated safeguard results. Google says that in simulated attack environments, Carbon blocked 99% of attack trajectories from an adaptive red-teaming agent, and the per-attempt breach rate fell to 0.8%, down from 3.1% for Argon. In Gray Swan’s testing, automated cyberattack query success dropped to 2.17%, against 9.86% for Argon. Trajectory Labs found no new universal jailbreaks across 132 hours and more than 13,000 requests.

On a 375-task agentic honesty benchmark, Google says Carbon passed 92% of tasks compared with 70% for Argon. The company repeats that Carbon reached a 0% attack success rate on the Gray Swan indirect prompt injection benchmark, but adds that “prompt injection robustness remains an area for continued improvement.”

Google is also extending its free-access program for scientists. Four weeks earlier it opened applications for 10,000 scientists to use Argon in Antigravity free for six months. Current and future participants will now get Carbon as well, with onboarding continuing weekly.