Google has opened Gemini 4 Carbon to every paying developer and enterprise customer, two weeks after handing it to a circle of security defenders and nobody else. Koray Kavukcuoglu announced the wider release on 10 November in a post on the Google blog. Developers reach it by API through AI Studio, and businesses through Gemini for business, while Google AI Ultra subscribers are getting it in the Gemini app, AI Mode in Search, and Google Antigravity, the company’s coding workspace.
When we covered the debut on 28 October, the story was a flagship model held back while Google tuned its safeguards. The waiting room is now much emptier. The price matches Gemini 4 Argon, the earlier release: $2 for each million tokens read and $10 for each million written. Google pitches Argon as the default for most coding and office work, and Carbon for jobs that justify spending extra tokens on exploring a problem and checking the answer repeatedly.
That pitch makes the cost claims worth reading closely. Google says Carbon takes first place on three outside tests: Zapier’s AutomationBench, Perplexity’s WANDR, and CursorBench 4.0. It claims the cost per task is more than twice as low as the closest rival’s. On a new Multimodal Knowledge Agent benchmark built with Artificial Analysis, it lands second while costing more than six times less per task than the leader. These are the comparisons Google picked, and the post names no rival models and gives no dollar figures per task. Carbon also spends more tokens than Argon by design, so an identical per-token price does not mean an identical bill for the same job.
The security story keeps its gate. The headline results on finding, exploiting, and patching vulnerabilities (SEC-bench Pro, ExploitGym, and CWE-bench v1) come from the Fairwind Program, and defenders who want that version still have to apply and wait for a rolling slot. Google offers early field evidence: on an internal benchmark, its Project Fortify system caught every flaw when scanning (100% recall) and was right 95% of the time when sorting them. The security firm Wiz, using Carbon, found previously unknown flaws at two major SaaS providers in under two hours.
Google is also selling the safeguards. In its simulated attack tests, Carbon blocked 99% of attack paths from an adaptive red-team agent, and the per-attempt breach rate fell to 0.8% from 3.1% on Argon. An outside group, Trajectory Labs, spent 132 hours and more than 13,000 requests looking for a universal jailbreak and reported finding no new one. Google concedes that resistance to prompt injection, where hidden text in a document hijacks an agent, still has room to improve, even after the 0% result it reported on the Gray Swan benchmark two weeks ago.
The newest product piece is /swarm, which Google is previewing in Antigravity. A single prompt becomes a team of agents the developer can watch in real time. Carbon takes the roles that need the deepest reasoning, such as designing the architecture, coordinating, and auditing. Lighter, faster models do parallel work in separate sandboxes, and verifiers built to attack the code test each change. The post gives no pricing or usage limits for the preview, which matters because a swarm multiplies token spend.
Scientists get a separate lane. Google says it is expanding Carbon access for the researchers in its free six-month Antigravity program, which opened to 10,000 applicants four weeks ago.
At $10 per million output tokens, Carbon and Argon cost the same on paper, so the only number that will separate them in your invoices is how many tokens Carbon spends on your own tasks.
Reported by the Google blog on 10 November 2026.
