Key points
Google announced on November 10 (U.S. time) that it is expanding access to its top-tier AI model, Gemini 4 Carbon, to developers, businesses, researchers, and AI Ultra subscribers.
The model was made available on a limited basis to cybersecurity experts two weeks ago. It is designed for complex coding, long-running agent tasks, and scientific research. Google recommends its existing Gemini 4 Argon for general software development and knowledge work.
Carbon has already found real-world security flaws. Security firm Wiz said it used the model to discover zero-day vulnerabilities at two major software-as-a-service (SaaS) companies in under two hours.
Google has unveiled a top-tier artificial intelligence (AI) model specialized in cybersecurity and scientific research. Gemini 4 Carbon uses more computation than earlier models to analyze complex problems and verify its results through multiple steps.
Google said on November 10 (U.S. time) that it is expanding access to Carbon to developers, businesses, scientists, and other users. Individuals can access it through a Google AI Ultra subscription.
Carbon was first made available to cybersecurity defense experts two weeks ago through the Fairwind program. Its uses are now being expanded to include software development, business tasks, and scientific research.
Google describes Carbon as its most capable model, saying it delivers top-level performance in cybersecurity, complex software development, and long-running agent tasks.
It has a different role from the existing Gemini 4 Argon. Google recommends Argon for general coding and knowledge work, while Carbon is aimed at tasks requiring advanced reasoning, such as multi-step debugging, complex system design, and open-ended scientific research.
Carbon uses more tokens than Argon to explore problems. It is designed to solve complex tasks by repeatedly reasoning and checking its work.
◆ Ranked first in evaluations by Cursor, Perplexity, and Zapier
Google highlighted Carbon’s ability to carry out real-world tasks using agents. The model ranked first in CursorBench 4.0, developed by coding tool Cursor; Perplexity’s WANDR; and AutomationBench, from workflow automation platform Zapier.
Google said Carbon’s cost per task in those evaluations was less than half that of the next-best external model. The results measured how accurately and economically AI models can complete real tasks, rather than simply answer questions.
Carbon also performed well in complex document analysis. Google developed the Multimodal Knowledge Agent (MKA) benchmark in collaboration with AI evaluation firm Artificial Analysis.
The benchmark measures an AI’s ability to analyze large documents containing tables, charts, blueprints, and images, find relevant information, and produce results. Carbon ranked second, with an average cost per task of less than one-sixth that of the top-ranked model.
The model also delivered results in finance. Financial research firm Hebbia said Carbon performed well in complex financial research and generated more structured Excel models and PowerPoint materials.
Hedge fund Balyasny Asset Management said Carbon achieved top-level performance among 23 leading model configurations in its in-house financial benchmark, which evaluates legal knowledge, coding, and data analysis.
◆ Multiple AIs work simultaneously in experimental “/swarm” feature
Google has also begun testing a new multi-agent feature, “/swarm,” in its Antigravity development tool. It allows multiple AI agents to divide up and handle a single instruction.
Developers can assign Carbon tasks requiring deeper reasoning, such as system design, task coordination, and code audits. Faster, lighter models can be assigned other tasks to work on in parallel.
Each agent runs in a separate working environment. Developers can also use an agent to independently verify changes.
Google shared several demonstrations. In one, the system analyzed seven publicly available city planning documents in PDF format and recreated a Google office building in 3D. It extracted 206 blueprints and produced a 3D model made up of about 900,000 triangles.
The model also reconstructed the Eiffel Tower’s construction from 1887 to 1889 using historical photographs and engineering drawings. The result was presented as a 3D exhibit that users could explore themselves.
Google also created an open-world 3D game set on its headquarters campus. Multiple agents divided up tasks including 3D modeling, game development, and visual effects.
Google also shared assessments from external developers. Coding startup OpenCode said Carbon created a new Rust UI library overnight and rewrote an existing desktop app.
App developer HubX evaluated the model on 16 real bugs in a codebase with 14,000 tests. It said Carbon resolved 94% of the issues without introducing regressions in existing features.
◆ Wiz finds zero-days at two SaaS companies
Cybersecurity is one of the areas where Carbon is attracting particular attention. Google said its cybersecurity-focused model, Carbon for Cyber, outperforms earlier models at finding vulnerabilities, analyzing how they could be exploited, and generating security patches.
The model, available through the Fairwind program, achieved leading scores on major security benchmarks, including SEC-bench Pro, ExploitGym, and CWE-bench v1.
It has also produced results in real-world security research. Security firm Wiz used Carbon through its public-interest security testing program, Scan for Good. After testing two major SaaS companies, Wiz said it found zero-day vulnerabilities in less than two hours. A zero-day is a security flaw that the developer or administrator has not yet addressed.
Wiz said the model carried out vulnerability research in a short time that could take weeks using conventional methods. It then worked with the companies to fix the issues. The findings were assessed as helping reduce risks that could potentially affect tens of thousands of businesses.
Google also reported improved vulnerability analysis within the company. In an evaluation by its autonomous security system, Project Fortify, Carbon achieved 100% recall and 95% precision in detecting vulnerabilities. Recall indicates how many of the actual vulnerabilities were found; precision is the proportion of items classified as vulnerabilities that were genuine flaws.
In an evaluation of open-source code, Carbon’s vulnerability-detection recall was more than 25% higher, in relative terms, than Argon’s. Google Cloud’s vulnerability research team also used Carbon to demonstrate that two open-source software bugs were exploitable vulnerabilities. The team created proof-of-concept code demonstrating the attack potential, then helped have the bugs reclassified as critical vulnerabilities and security patches released.
Security firm SentinelOne said Carbon found four additional verified vulnerabilities in kernel drivers that other evaluated models had missed.
◆ Blocks 99% of cyberattacks
As cybersecurity capabilities improve, the risk that they could be misused for attacks also increases. Google said it strengthened Carbon’s safeguards against misuse alongside its release.
In simulated cyberattack evaluations, the AI acting as an attacker revised its plan and tried again each time it was blocked. Carbon blocked 99% of attack paths in this environment. The defense failure rate per attack attempt fell from 3.1% for Argon to 0.8% for Carbon.
In testing by external evaluator Gray Swan, the success rate of automated cyberattack prompts fell from 9.86% for Argon to 2.17% for Carbon.
Trajectory Labs tested the model’s security over 132 hours, submitting more than 13,000 requests. The company said it found no new general-purpose jailbreak techniques during the evaluation.
The model also improved on measures of honesty. Carbon passed 92% of tasks in an agent honesty benchmark comprising 375 tasks, compared with 70% for Argon.
It refused 98% of requests to fabricate experimental data that did not exist. When research methodology was flawed, it pointed out the problem in 68% of cases.
Carbon also performed well in evaluations of indirect prompt-injection attacks, in which malicious instructions are hidden in external documents or data to alter an AI’s behavior.
Its attack success rate was 0% on the Gray Swan benchmark. Google cautioned that this was a result from a specific evaluation and said defenses against prompt-injection attacks still need to be improved.
◆ From cryptographic verification to protein research, supporting 10,000 scientists
Carbon is also being used in scientific research. Google researchers applied it to the mathematical verification of the safety of code implementing the cryptographic protocol used by Signal, an encrypted messaging service.
The researchers used Carbon alongside other models to translate security requirements into mathematical theorems. They then used the formal verification framework AlphaProof Code to generate millions of lines of code in Lean, a language for mathematical proofs. Google said work that would normally take expert teams years was carried out in a matter of weeks.
The model also showed potential in laboratory research. It analyzed lab notes and raw data and identified a problem in which an automated mixing device had not mixed samples thoroughly enough. It also detected a chromatography issue in which trace amounts of a sample remained and affected the next measurement.
In protein structure prediction, the researchers tackled the difficulty of finding similar proteins in existing databases. Using Carbon with multiple agents, they searched large-scale gene sequence and protein structure datasets for similar proteins with distant evolutionary relationships. Across seven protein families included in the CASP17 evaluation, the average number of similar proteins found increased 40-fold.
Google said this showed the potential to expand the information available for analysis without retraining structure-prediction models.
Google is also expanding support for researchers. It previously launched a program offering 10,000 scientists free access to Antigravity for six months. Carbon has now been added to the program, alongside Argon. Participants will be enrolled in stages, subject to eligibility, capacity, and the selection process.
◆ API pricing: $2 per million input tokens and $10 per million output tokens
Carbon is available to paying developers and businesses through Google AI Studio and the enterprise Gemini API.
Its introductory price is the same as Argon’s: $2 per million input tokens and $10 per million output tokens. A token is a unit that AI uses to process text. Input refers to data sent to the model, while output is the result it generates.
Carbon is designed to use more tokens than Argon. As a result, even with the same per-token price, the total cost of a task may differ.
Google AI Ultra subscribers can use Carbon in the Gemini app, Search AI Mode, and Antigravity. Businesses can access it through Gemini for Business and development tools. The cybersecurity-specific version is separate and requires users to apply for access through the Fairwind program.
Google is expanding Carbon as its top-tier model for general work and advanced research while keeping its cybersecurity-specific capabilities available on a limited basis.
The announcement shows how competition among AI models is expanding beyond answering questions to include the ability to perform real work, conduct scientific research, and solve security problems.
How reliably Carbon performs in real business environments and whether it can maintain cost-effective performance on long-running tasks remain to be tested.