Google Gemini 4 Carbon: Capabilities, Access and Carbon vs Argon

According to Google, Gemini 4 Carbon has run for days on complex software engineering tasks, and it leads Google's published cybersecurity benchmarks. It is not generally available. Since 28 October 2026, access has been limited to selected cyber defenders in Google's Fairwind Program, with no public release date. Sydney and NSW organisations can't deploy it yet, but they can use the gap to prepare supervision, cost controls and patching capacity for multi-day AI agents.

An Announcement Ahead of the Product

Google unveiled Gemini 4 Carbon on 28 October 2026 US time, which was early on Thursday 29 October in Sydney. In its official announcement, Google DeepMind SVP Koray Kavukcuoglu called Carbon the company's "strongest model with state-of-the-art cybersecurity and long horizon capabilities". It arrived only 15 days after Gemini 4 Argon opened to developers.

The headline line is about time, not intelligence. Google wrote that "internally, our teams have seen Carbon run for days to persist through dead ends" on multi-step engineering work, such as root-causing and patching subtle bugs across large codebases and low-level systems.

That's a Google-reported observation from its own environment. It isn't an independent result or a service commitment. It still matters for planning, because a model that keeps working across several days changes how organisations need to supervise, budget and secure automated work.

What Google Says Carbon Can Do

Google's capability claims cluster in three areas. All figures below are Google's own, or third-party results that Google cites. Google says its external cybersecurity benchmarks were run without guardrails.

Gemini 4 Carbon: Reported Capabilities and Benchmark Results

• General intelligence ranking
• Google's reported result: First on the Artificial Analysis Intelligence Index v5.0, with a score of 59.
• What it would mean in practice: A strong all-round signal, measured on a newly revised benchmark suite.
• Finding vulnerabilities
• Google's reported result: 88.2% on SEC-bench Pro.
• What it would mean in practice: Uncovering flaws in real-world software without step-by-step direction.
• Validating exploitability
• Google's reported result: 54.8% on ExploitGym.
• What it would mean in practice: Helping defenders decide which flaws are urgent.
• Patching root causes
• Google's reported result: 71.0% on CWE-bench.
• What it would mean in practice: Turning a validated finding into a working code fix.
• Secure code generation
• Google's reported result: More than 2x the success rate of Argon on internal benchmarks.
• What it would mean in practice: Fewer vulnerabilities introduced while the AI writes code.
• Prompt-injection resistance
• Google's reported result: 0.0% attack success on Gray Swan's indirect prompt-injection benchmark, down from 0.7% for Argon.
• What it would mean in practice: Better resistance to malicious instructions hidden in documents or web pages, within the attacks tested.

Google also reports behaviour changes that matter more for long tasks than raw scores. It says Carbon cuts unsupported claims by about half compared with Argon, reduces overreach by 26% and under-delivery by 29%, and raises discrepancies with the user before acting instead of guessing.

Independent testing adds some nuance. VentureBeat's analysis notes that Carbon trails rival models on some software engineering and computer-use tests.

It also reports that Artificial Analysis recorded a higher hallucination rate for Carbon than Argon on one factual-knowledge evaluation.

The picture is broad progress, not across-the-board dominance.

Gemini 4 Carbon vs Argon

For Australian buyers, the most practical comparison is between what can be used today and what has only been announced.

Elyment's earlier analysis of Gemini 4 Argon's coding agents and million-token output covered Argon's capabilities.

Carbon has to be judged against Argon's access status as well as its benchmarks.

Gemini 4 Argon vs Gemini 4 Carbon: Availability and Pricing Comparison

• Announced
• Gemini 4 Argon: 30 September 2026.
• Gemini 4 Carbon: 28 October 2026.
• Wider availability
• Gemini 4 Argon: Opened to developers on 13 October 2026 via the paid Gemini API, Google AI Studio and Android Studio.
• Gemini 4 Carbon: Not yet. Limited to a subset of cyber defenders through the Fairwind Program.
• Introductory API price (USD)
• Gemini 4 Argon: $2 input and $10 output per million tokens.
• Gemini 4 Carbon: The same introductory rates.
• Later price (USD)
• Gemini 4 Argon: $4 input and $20 output per million tokens.
• Gemini 4 Carbon: The same later rates, once the introductory period ends.
• Introductory period end
• Gemini 4 Argon: Reported as 30 November 2026.
• Gemini 4 Carbon: Not specified.
• Published API specification
• Gemini 4 Argon: Yes.
• Gemini 4 Carbon: Not yet.

Google says Carbon improved on Argon in every row of its published comparison.

Identical token prices don't mean identical job costs, though. A model that runs for days, retries and reasons at length can use far more tokens to finish the same task.

Until Carbon's consumption data is public, cost per completed task can't be estimated reliably.

Limited Rollout Is Not General Availability

Google's announcement is precise on access.

"Starting this week, we will make Carbon available to a subset of cyber defenders and will gradually phase access to additional trusted partners through our Fairwind Program," the company wrote.

It added that it would keep gathering feedback and refining guardrails "before making Carbon available to developers, businesses, and consumers".

Google also says it is taking part in the US government's voluntary pre-release model testing process.

For a Sydney business, this means:

• No public endpoint. Carbon can't currently be selected in a standard Gemini app plan, Workspace subscription or self-serve API account.
• No release date. Google says "as soon as possible", which isn't a date to plan a project around.
• No final specification. Context limits, tool support and caching behaviour haven't been published for Carbon.
• Vendor claims need checking. Any provider claiming to deliver "Carbon-powered" services in November 2026 should be asked to show how it has access.

The staged path matches Argon's, which moved from a defenders-only announcement to developer access in about two weeks.

That's a useful precedent, not a guarantee. Carbon's stronger exploitation capability gives Google more reason to move carefully.

The Operational Problem With Days-Long Tasks

Most AI deployments in Australian businesses are built around tasks that take seconds or minutes: draft a reply, summarise a file, classify an enquiry.

A task running for days raises operational questions that a chatbot never did.

Who Is Watching at 2 am on Saturday?

A multi-day run will cross nights, weekends and public holidays. Someone has to own the task when it hits a blocker, asks for clarification or behaves unexpectedly outside business hours.

Google says Carbon raises discrepancies rather than guessing, which only helps if a person is there to answer.

What Does Progress Look Like?

Long tasks need intermediate evidence: a working log, test results and a record of decisions.

Without it, a team gets a finished result after three days with no way to tell whether the route taken was sound.

When Should It Stop?

Persistence is valuable when the agent is on the right path and expensive when it isn't.

A long-running agent needs limits on time, spend, retries and scope.

Elyment's analysis of why powerful AI agents need a kill switch covers the emergency stop.

Multi-day work also needs routine checkpoints that come well before any emergency.

What Happens to the Credentials?

An agent working for days needs access for days.

Short-lived credentials, narrow permissions and monitored sessions matter more as run times grow.

The Australian Signals Directorate's guidance on agentic AI harnesses calls the harness, the layer that grants tools and permissions and runs the control loop, "the component organisations can most directly govern, secure and control".

A Run Plan for Multi-Day Agent Work

When Carbon or a comparable model becomes available, a controlled first deployment could follow this sequence:

1. Write the brief like a contract.
2. Define the objective, the exclusions, the acceptance tests and the deliverables before the agent starts.
3. Set a run budget.
4. Cap token spend, wall-clock time and the number of retries, with an automatic pause when any limit is reached.
5. Schedule checkpoints.
6. Require a status report at fixed intervals, for example every four hours, covering what was tried, what failed and what comes next.
7. Assign an owner for each window.
8. Name who responds to escalations during business hours, after hours and on weekends.
9. Isolate the environment.
10. Run the agent in a sandbox or staging copy with no direct path to production systems or live customer data.
11. Review before release.
12. Treat the agent's output as a draft for human engineering and security review, however long it worked.
13. Measure cost per completed task.
14. Record tokens, time and review effort so later deployments can be compared on real numbers, not unit prices.

The same structure applies to managed agents running as background workers.

The difference with Carbon is scale: the longer the run, the more each control is worth.

The Cybersecurity Angle Sydney Organisations Shouldn't Miss

Carbon's defender-first release reflects a wider concern.

A model that can find, validate and patch vulnerabilities could also be misused to find and exploit them.

Google is giving defenders a head start, but the broader trend is that AI is shortening the time between a vulnerability being found and being exploited.

That puts pressure on the most basic control in Australian cyber guidance: patching.

The ASD's Essential Eight already ranks patching applications and operating systems among its core mitigation strategies.

If AI-assisted discovery speeds up, organisations with a slow patch cycle face growing exposure.

Practical Steps for NSW Organisations

• Measure the patch backlog.
• Know how long critical and high-severity patches currently take from release to deployment.
• Review managed service contracts.
• Check the patching timeframes your IT provider has actually committed to, and whether they include line-of-business applications.
• Inventory internet-facing systems.
• Websites, booking portals, client portals and remote access tools are the most likely targets for automated scanning.
• Update incident plans.
• Under the Notifiable Data Breaches scheme, organisations covered by the Privacy Act must notify affected individuals and the OAIC when a breach is likely to cause serious harm. Faster attacks leave less time to respond.

Public-sector bodies have an extra layer.

Cyber Security NSW coordinates the NSW Government's cyber response, and agencies must report incidents and their annual maturity against the NSW Cyber Security Policy.

Councils aren't bound by the policy but are encouraged to follow it.

Elyment's coverage of the industry warning on an AI-driven cyberattack surge sets out which operators face the most immediate pressure.

What Australian Guidance Already Says

Carbon doesn't arrive in a policy vacuum.

In May 2026, the ASD's Australian Cyber Security Centre and international partners published Careful adoption of agentic AI services.

It recommends deploying agentic AI incrementally, starting with low-risk tasks, and enforcing strict privilege controls, continuous monitoring, strong identity management and human oversight.

The guidance also suggests organisations consider whether a repetitive process should be removed altogether before it's automated.

That's a useful test for any multi-day AI project: is the work worth doing at all, and does it need an agent that runs for days?

What Business Leaders Should Take From Carbon

• Carbon's headline capabilities are Google-reported. Multi-day task execution and leading cybersecurity scores come from Google's own testing and selected benchmarks.
• Carbon isn't generally available as of 30 October 2026. Access is limited to selected cyber defenders through the Fairwind Program, with no public release date.
• Argon is the Gemini 4 model businesses can evaluate today. It is available at the same introductory token rates.
• Equal token prices don't guarantee equal costs. Long tasks can use far more tokens.
• Days-long tasks need operational controls. Run budgets, checkpoints, after-hours ownership and isolated environments are essential considerations.
• Faster AI-assisted vulnerability discovery makes patching speed a board-level issue.

Preparing Your Workflows for Longer-Running AI Agents?

Elyment reviews automation scope, access controls, run budgets and delivery processes so agentic AI is introduced with clear ownership and measurable outcomes.

Book an Operational Review →

The most useful response to Carbon is preparation, not a race for access.

Organisations that design their workflow automation with clear limits, measurable outputs and named owners will be ready to test Carbon when Google opens it up, and better placed to judge whether a days-long agent is worth the cost.

Sources and References

1. Google — Introducing Gemini 4 Carbon
2. Official Google Gemini 4 Carbon announcement
3. VentureBeat — Google Unveils Gemini 4 Carbon
4. Google Gemini 4 Carbon: Benchmark Performance and Limited Availability
5. Australian Signals Directorate — Agentic AI Harnesses
6. ASD guidance on agentic AI harnesses
7. Australian Signals Directorate — Essential Eight
8. Essential Eight Cyber Security Mitigation Strategies
9. Office of the Australian Information Commissioner — Notifiable Data Breaches
10. Notifiable Data Breaches Scheme
11. Cyber Security NSW — NSW Government Cyber Security
12. Cyber Security NSW Guidance and Framework
13. Australian Cyber Security Centre — Careful Adoption of Agentic AI Services
14. Careful Adoption of Agentic AI Services
15. Elyment — Gemini 4 Argon Analysis
16. Google Gemini 4 Argon: Coding Agents and 1M-Token Output
17. Elyment — AI Agent Safety and Control
18. AI Agents Are Getting Powerful Enough to Need a Kill Switch: What Businesses Should Set Before Automation Goes Live
19. Elyment — Managed AI Agents and Background Automation
20. AI Services Can Now Run as Background Workers: What Google's Managed Agents Change for Business Automation
21. Elyment — AI Cybersecurity Threats
22. OpenAI, Google, Microsoft and AWS Join 100 Firms Warning of an AI Cyberattack Surge: What Must Critical Operators Fix First?
23. Elyment — Workflow Automation Services
24. AI Systems Development and Workflow Automation
25. Elyment — Contact
26. Book an Operational Review