Gemini 4 Carbon is now generally available, and its safety report says it isn't materially more capable than Argon

Gemini 4 Carbon, the model Google calls "our strongest model," is now available to everyone who pays for the Gemini API. Google announced general availability on November 10, two weeks after the October 28 launch that put Carbon in the hands of cyber defenders only. The API model ID is gemini-4-carbon, and the price through November 30 is $2 per million input tokens and $10 per million output tokens. On December 1 it doubles to $4 and $20.

The launch also brought the two documents that were missing in October, a model card and a 94-page Gemini 4 Carbon Safety & Security Report. The most interesting thing in them sits uneasily next to the marketing. Google's announcement, posted under the name of Koray Kavukcuoglu, Google DeepMind's SVP and chief AI architect, says Carbon "pushes the frontier even further" past Gemini 4 Argon. Google's safety report says Carbon "did not show meaningful new capabilities or material increases in performance compared with Gemini 4 Argon." Both statements come from Google, and both can be true. How they fit together says a lot about how frontier safety checks actually work.

Why Carbon skipped a full safety assessment

Google's Frontier Safety Framework requires a full critical capability assessment before a new frontier model's first external deployment. For later versions it first runs a Material Capability Change (MCC) test. It scores the model on GCI v2, an internal General Capability Index modeled on Epoch AI's Epoch Capabilities Index, which rolls many benchmarks into one number. A gap counts as material only if it exceeds four months of progress. At the roughly 4.7 GCI points per month that Gemini releases have gained historically, that is a bar of about 19 points.

The model card says plainly that "Gemini 4 Carbon is based on Gemini 4 Argon." In the report's Figure 3.1, Argon sits at roughly 132 and Carbon at roughly 135 (our reading of the chart; Google prints no exact values). That is far below the bar, so Google carried Argon's evaluation results and threshold determinations forward instead of rerunning them. The same chart shows where the big jump actually happened: Argon itself lands well above the trend line that earlier Gemini models follow.

Carrying forward did not let Carbon off lightly. Argon's determinations were already the strict ones. Google could not rule out that the model, without out-of-model mitigations, reaches the Cyber Uplift Level 1 Critical Capability Level (CCL), the CBRN Uplift Level 1 CCL for biological risks, or the Stealth and Situational Awareness tracked level. Those stay in force for Carbon, so it ships under the same assumption: safeguards are required, and the bare model is treated as possibly dangerous. Google rules out the chemical, radiological and nuclear thresholds, as well as harmful manipulation and ML R&D automation.

The cyber numbers that a general index doesn't see

The catch is that an overall index can stay flat while one domain moves a lot, and Google's own cyber evaluations show exactly that. All of these were measured without out-of-model safeguards:

The Argon figures for ExploitBench and ExploitGym come from Google's stated gains of 10 and 12.8 points. SRE-Bench is an open-source reverse-engineering benchmark from Columbia University researchers, covering malware analysis, firmware, network protocols and obfuscated binaries across 262 instances. A jump from about half solved to 99% solved in four tries is not a small change in a dual-use skill.

Google noticed. The report says that "given the increases in cyber exploitation benchmark scores," it ran Irregular's CyScenarioBench V2, its standard test of planning and executing multi-stage attacks, to check that end-to-end capability had not shifted. Carbon came out level with Argon or slightly behind it: 12 of 14 full scenarios and 88 of 104 segments, against 13 of 14 and 90 of 104. On that basis the carried-forward determination stood, and Google says it hardened the cyber safeguards anyway. In its simulated attack tests, the per-attempt breach rate fell to 0.8% from Argon's 3.1%, and Gray Swan's automated cyberattack query success rate fell to 2.17% from 9.86%.

So the procedure worked as written, and Google published the numbers that let readers question it. The question is still fair. A model that solves almost every reverse-engineering task in four tries, where its parent solved fewer than six in ten, went through the "no material change" route because a general index barely moved. Whether a domain jump like that should trigger a fresh assessment on its own is a design choice in the framework, and Carbon is a clear case where the two signals disagree.

The model card also settles a point we raised in October, when Google said its cyber headline numbers were "evaluated without guardrails." The card now says its cybersecurity results "reflect performance when accessed through the Fairwind Program," Google's gated channel for verified defenders. Public API users get Carbon with the full safeguard stack, not the configuration behind SEC-bench Pro's 88.2%.

What the price means in practice

Carbon and Argon have identical per-token prices, so the difference between them is how many tokens they spend. Google's developer guide says Carbon "spends more thinking tokens per turn" and recommends keeping Argon "where speed matters." Artificial Analysis' independent measurements on its Carbon page complicate that a little. Running the Intelligence Index, Carbon (High) produced 205 million output tokens to Argon (High)'s 113 million. Yet its weighted cost per index task, at the $4/$20 list price, is $7.76 against Argon's $9.95. It also takes less time per task, 25.6 minutes against 28.7.

Artificial Analysis' cost breakdown shows where the difference comes from. Output costs per task are close: $2.46 for Carbon and $2.33 for Argon. Argon spends more on input billed at the full rate, $5.64 per task against Carbon's $3.21. We can't tell from the data whether Argon takes more turns or re-sends more uncached context. Either way, "more tokens per turn" didn't mean "more expensive per task" on this benchmark. Developers should measure their own workload rather than assume Argon is the cheap option.

Against the competition, at list price:

Carbon lost the top spot it held in October to Claude Fable 5.2, but it costs less than a third as much per task. Until November 30, when every Carbon token price is halved, that is about $3.88. In October, Artificial Analysis measured a 97-second wait for the first token on Google's restricted endpoint. Its page now lists 66.85 seconds to the first answer token. That is still long, but this is a model whose developer guide recommends 15-minute HTTP timeouts.

A few practical details from the What's new in Gemini 4 Carbon guide matter for migration. Carbon has no free tier. Explicit context caching (cachedContents) is not supported, only implicit caching for prompts of at least 4,096 tokens, at a 95% discount. temperature, top_p and top_k are silently ignored. Synchronous responses stop at 65,536 tokens, and longer outputs, up to the shared 1M-token window, need background execution. Google itself is saying something about Carbon's appetite when it advises raising any max_output_tokens below 32K, because Carbon "can spend more of the limit on thinking." The knowledge cutoff is March 2026.

In consumer products, Carbon goes to Google AI Ultra subscribers in the Gemini app, AI Mode in Search and Antigravity, where Google is also previewing a /swarm command that splits one prompt across a team of agents. Google's other claims in the announcement are its own or its partners' measurements, including first place on CursorBench 4.0, Perplexity's WANDR and Zapier's AutomationBench at "more than 2X lower cost per task."

Carbon is a better-documented model today than it was on October 28, and the documents are more candid than the launch post. By Google's own accounting, it is Argon with deeper thinking and much sharper exploitation skills, not a new tier of capability. For buyers, the December 1 price is the one to plan around.