Gemini 4 Carbon Is Locked: Here's What It Means for Your Budget and Your Patch Window

On 28 October, Google DeepMind released Gemini 4 Carbon, and it went straight to the top of the Artificial Analysis Intelligence Index with a score of 59. If you build software for a living, you probably cannot use it yet. Carbon is going first to a small group of cyber defenders through Google's Fairwind Program while it goes through US government pre-release testing. Developers and businesses get it later, and Google has not said when.I went through the independent test data, the security research behind Carbon's benchmarks, and Google's own launch notes. Two things matter far more for most of us than who sits at number one. The first is what this class of model will cost to run. The second is what it means for how quickly we need to patch our own code.What Carbon Costs Per Task Leaderboards tell you which model scored highest. They rarely tell you what it costs to get that score, and for a startup running agents all day, that is the number that decides whether a model is usable. Artificial Analysis publishes exactly that. Running its full Intelligence Index, Carbon cost $7.76 per task. Claude Opus 5.5 at its highest setting cost $10.04, and GPT-6 Astra at its highest setting cost $6.25.Scale that to a team running 10,000 hard agent tasks a month and the gap becomes real money: Model (highest reasoning setting) Cost per task 10,000 tasks a month GPT-6 Astra $6.25 $62,500 Gemini 4 Carbon $7.76 $77,600 Claude Opus 5.5 $10.04 $100,400 A word of caution before anyone builds a budget on this. These are costs on a demanding evaluation suite at standard prices, so your own workload will differ. Treat them as a comparison between models, not a quote. Google is also offering Carbon at half price at launch, $2 per million input tokens and $10 per million output tokens, before it rises to $4 and $20. The more interesting detail is why Carbon is cheaper than Opus. It used about 123,000 output tokens per task against 173,000 for Opus 5.5. A model that reaches the answer with fewer tokens saves money on every single call, and for agent loops that run for hours, that adds up faster than any headline discount.Where It Wins and Where It Doesn't Carbon is not the best at everything, and the independent data shows where. On the Artificial Analysis Coding Agent Index, it scored 59, second behind Claude Code running Opus 5.5 at 62. It also came second on Terminal-Bench 4.0 with 64%, and on FrontierCode with 51% against 56% for Opus. If your product is mainly an autonomous coding agent, Carbon is a strong option, not an automatic upgrade.Reliability is the other number to watch. Carbon is more accurate than Google's previous model on the Artificial Analysis knowledge benchmark, but its hallucination rate rose from 4% to 11%. That is still the second lowest of any model tested, behind only Argon. In practice, it means Carbon knows more but guesses more when it does not know. If your app depends on factual answers, keep a verification step in place.Why It's Gated: Attackers Are Getting Faster The reason most of us are waiting is in Carbon's cybersecurity scores. Google says it found real vulnerabilities in 88.2% of SEC-bench Pro cases, patched them at the root cause in 71.0% of CWE-bench cases, and turned flaws into working exploits in 54.8% of ExploitGym cases. Those tests were run "without guardrails." That last benchmark is the uncomfortable one. A model that can turn a bug into an attack is useful to defenders testing their own systems, and just as useful to the people they are defending against.This did not appear overnight. In 2024, Daniel Kang's group at the University of Illinois showed that GPT-4 could exploit 87% of a set of 15 known vulnerabilities when given the public description, and just 7% without it. Every other model they tested scored zero.By May 2026, a 16-author team including Dawn Song and Nicholas Carlini had built ExploitGym from 898 real vulnerabilities across userspace programs, Google's V8 engine and the Linux kernel. They found that exploitation is still hard, but frontier agents now succeed on a meaningful share of cases, even with common defences turned on.Meanwhile, human attackers were already speeding up. Google's Mandiant team analysed 138 vulnerabilities exploited in 2023 and found the average time from disclosure to exploitation had fallen to about five days. In 2018 and 2019, it was 63. Seventy per cent were exploited as zero-days, before a patch existed.Put those two trends together, and the logic behind gating Carbon is easy to follow. Google wants the patching capability in defenders' hands before anything similar becomes widely available. Anthropic made the same call in April when it limited Claude Mythos Preview to its Project Glasswing partners, and has since widened access to about 150 more organisations in more than 15 countries. Neither model is public.What You Can Do Before It Opens Here is the part I think matters most. Most teams reading this will not be on a Fairwind or Glasswing list, and attackers will not wait for the general release. So what can a small engineering team actually do this month? Use what is already available. Gemini 4 Argon has been on the paid Gemini API since 13 October. Google's CodeMender agent, which upstreamed 72 security fixes to open-source projects as large as 4.5 million lines in its first six months, can be run with public models by any Google Cloud customer, according to Google's Fairwind announcement.Patch what is known to be exploited first. CISA's Known Exploited Vulnerabilities catalogue held 1,665 entries as of August 2026. If a dependency you ship is on it, that comes before any new feature.Prioritise by difficulty, not headlines. Mandiant found no reliable link between media coverage and how fast a bug is exploited. What mattered was how easy the exploit was and how valuable the target. An easy bug in a payment flow deserves more urgency than a famous one that is hard to use.Assume the window is days, not weeks. Automated dependency updates, fuzzing in your build pipeline and network segmentation all buy time when a patch is not ready.Ask to get in. Fairwind says it is staged for governments, critical infrastructure and core technology platforms, with more than 650 partners so far. If your company runs infrastructure other people depend on, it is worth asking.Wrapping Up Gating Carbon is the right decision. A strong exploit writer released to everyone on day one would hand attackers a head start that defenders could not close. But it leaves an open question for the rest of us. Fairwind's published priorities name large institutions. Glasswing's expanded list reached Europe, North America and parts of Asia. Smaller companies, independent researchers and teams in places like Lagos or Nairobi are not clearly covered by either. If the best defensive tools reach well-funded organisations first, the gap between the well-defended and everyone else could widen just as attacks get cheaper.Until that changes, the practical lesson is simple. Do not wait for the model on top of the leaderboard. Use the tools you can access, patch what attackers are already using, and plan your budget around cost per task rather than rank.