Gemini 4 Carbon: Access, Pricing and Cybersecurity Limits

Gemini 4 Carbon is Google’s new frontier model for coding and cybersecurity, but its announcement begins with restricted access. The useful decision for most teams is to prepare an evaluation, while confirming whether their organization can actually use it.

Google introduced Carbon on October 28. This article separates the announced capabilities and prices from FindMilan’s practical guidance for deploying an agent around valuable code or business systems.

What changed with Gemini 4 Carbon?

The official announcement emphasizes sustained engineering work and vulnerability discovery, validation and repair. Google reports that its teams have run Carbon on engineering tasks lasting days.

Google lists scores of 88.2% on SEC-bench Pro, 54.8% on ExploitGym and 71.0% on CWE-bench. It expressly says those external cybersecurity evaluations ran without guardrails. These are reported benchmark results, not acceptance tests for your application.

Carbon builds on Argon, but this is a distinct model announcement. Our Argon access and pricing guide covers that model’s available routes; its access conditions should not be carried over to Carbon.

Who can access Carbon?

Google says initial access starts with selected cyber defenders, followed by additional trusted partners through its Fairwind Program. Broader developer, business and consumer access is coming later.

The Fairwind page describes vetted organizations, controlled access and defensive-use governance. At this review, that page still names Argon in its technology and FAQ sections. Use the Carbon announcement for Carbon’s rollout statement; confirm your specific entitlement with Google rather than treating every existing program term as a Carbon guarantee.

For planning, record the exact model, account, access route, permissions and commercial terms you have been granted. An application to a program is not access, and another Gemini model appearing in a picker does not establish Carbon availability.

What pricing has Google announced?

Google also announces a 95% cached-input discount. The announcement does not give a calendar end date for the introductory period. These are announced token prices, not evidence of a generally available purchasing route.

As an illustration, one million uncached input tokens plus 100,000 output tokens would cost $3 at the introductory rates or $6 at the later rates. This arithmetic excludes tools, retries, infrastructure and other charges. Confirm the billing currency, applicable route and current terms before converting a token estimate into a project budget.

Why longer engineering runs change the evaluation

FindMilan’s practical interpretation: an agent that works for longer needs a stronger definition of completion. A plausible patch is only the beginning. The useful measure is whether the change solves the intended problem, passes relevant checks and stays within the operator’s permissions.

Start with a repository you are authorized to test and a small set of representative tasks. Include a normal defect, a misleading symptom and an issue where the right answer is to request missing information. Require the agent to distinguish observed evidence from assumptions.

For each run, preserve the starting revision, task description, changed files, test output, elapsed time and total cost. Have a reviewer assess correctness without relying on the agent’s own summary. Record failures and unnecessary changes alongside successful fixes; otherwise the evaluation will reward convincing explanations over reliable work.

Cybersecurity gains still need application safeguards

Google reports stronger alignment and prompt-injection resistance, including no successful attacks in one named evaluation. That result does not establish immunity against new attacks or against unsafe tool configuration.

Use a contained test environment with restricted credentials and explicit authorization for security work. Treat repository comments, web pages and tool responses as potentially hostile input. Keep approvals around deployments, external communications and changes outside the assigned scope.

A useful acceptance checklist is:

• Scope: the agent stays inside the permitted repository and systems.
• Evidence: a finding has a reproducible test and a clear statement of uncertainty.
• Repair: the patch addresses the cause and preserves intended behavior.
• Recovery: an interrupted run leaves a reviewable diff and a usable rollback path.
• Cost: repeated runs meet a defined spending limit, including failed attempts.

Test those boundaries deliberately before enabling unattended work. A model’s ability to discover vulnerabilities also increases the importance of controlling which systems it can reach.

What should a team do now?

Prepare the evaluation and confirm access before committing to a migration. Keep your current working route available until the candidate passes the same tasks, permission checks and cost constraints. Avoid redesigning a production workflow around an unreleased access assumption.

FindMilan’s AI consulting service helps define model evaluations around real product requirements. For longer agent runs, workflow automation planning can establish approval points and recovery behavior. AI Web Awards is related project context, not a claim that Carbon powers the platform.

Sources and review scope

• Google: Gemini 4 Carbon announcement and pricing footnote
• Google DeepMind: Fairwind access and governance

Primary sources checked October 29, 2026. Capability and benchmark statements are attributed to Google. Evaluation steps and deployment recommendations are FindMilan’s interpretation; this article does not claim hands-on Carbon testing.