Gemini 4 Carbon: Benchmarks, API Pricing and Access

Google announced Gemini 4 Carbon on 28 October 2026. Google calls it its strongest model, with a focus on cybersecurity and long, multi-day coding tasks. Carbon ranks first on the Artificial Analysis Intelligence Index v5.0 with a score of 59. The introductory API price is $2 per 1M input tokens and $10 per 1M output tokens, the same as Gemini 4 Argon. Later it rises to $4 / $20.

You cannot call it yet. Google is giving Carbon first to a small group of cyber defenders through its Fairwind Program. Developers, businesses and consumers come later, with no date. Gemini 4 Carbon is not on RouterPlex yet. If you need a model for authorized security work today, RouterPlex hosts three abliterated models that answer the security questions stock models often refuse.

Gemini 4 Carbon at a glance #

The intro period has no published end date. For Argon, the intro rate ran to 30 November 2026. Carbon may or may not share that date.

Gemini 4 Carbon API pricing #

Google lists the same intro price as Argon: $2 per 1M input tokens and $10 per 1M output tokens. A footnote says the rates are temporary. After the intro period they become $4 input and $20 output per 1M.

Cached input (prompt tokens the provider has seen recently) costs 95% less than fresh input. At the intro rate that is $0.10 per 1M. The cached rate after the intro period is not published yet. On Argon it was $0.20.

Here is what one call would cost at the list price. A turn with 40,000 input tokens and 2,000 output tokens costs $0.10 at the intro rate and $0.20 after it. Thinking tokens bill as output on Gemini models, so a high thinking setting raises the output side. Google ran its own benchmarks at the highest thinking setting.

Nobody can buy Carbon on the public Gemini API yet, so these prices only matter once access opens.

Gemini 4 Carbon benchmarks #

This is Google's full launch table. Blue cells mark Carbon as the best score. Grey cells mark another model's lead.

The same numbers as text, so you can search and copy them:

Carbon leads 15 of 17 rows. It trails on FrontierSWE 2, where GPT-6 Astra scores 65.5%. It also trails on OSWorld-2.1, where Claude Opus 5.5 scores 87.2%. The biggest jump over Argon is long context. On GraphWalks between 256K and 1M tokens, Carbon scores 96.2% against Argon's 84.2%.

Google computed many of the Gemini scores itself and took rival scores from vendor reports and public leaderboards. The methodology page lists the source for each row.

Gemini 4 Carbon cybersecurity results #

Google built Carbon to find, check and fix security bugs. The three security charts cover each step.

Finding bugs: SEC-bench Pro

SEC-bench Pro asks a model to write a proof of concept that crashes a vulnerable build of a JavaScript engine. Carbon passes 88.2% of the 183 tasks. GPT-6 Astra scores 85.4% and Argon 83.4%.

Exploiting bugs: ExploitGym

On ExploitGym a task counts only when the exploit captures the target flag. Google ran it with mitigations off and no internet. Carbon solves 54.8% with a 10-hour cap and 53.5% with 6 hours. GPT-6 Astra scores 42.4%.

Fixing bugs: CWE-bench

CWE-bench measures patches for known weakness types. Carbon scores 71.0%. Grok 4.7, Argon and GPT-6 Astra tie at 68.0%.

Google also reports more than 2x better secure code generation than Argon on internal tests. The Chrome team reports over 10x more high-quality patches than another lab's frontier model. Those two claims come with no public numbers.

Prompt injection: the Gray Swan result #

Prompt injection is when a web page, file or email hides instructions that hijack an agent. Gray Swan's indirect prompt injection test counts how often an attack works within 15 tries. Lower is better.

Carbon scores 0%, the only zero on the chart. Argon allows 0.7%, Claude Opus 5.5 1.0%, and GPT-6.1 Sol 8.6%. Open models do much worse here. GLM 5.3 allows 31.5% and Kimi K3 52.7%.

That matters if your agent reads untrusted pages or repos. Keep agents built on open models in a sandbox, and give them no secrets they do not need.

Gemini 4 Carbon release date and access #

Google gave no public release date. Access comes in stages.

1. Now, a subset of cyber defenders, starting the week of 28 October 2026.
2. Next, more trusted partners through the Fairwind Program.
3. Later, developers, businesses and consumers, "as soon as possible" after more feedback and guardrail work.

Fairwind is for approved partners only. Google names governments, national cyber agencies, critical infrastructure operators and core tech platforms first. Academic labs doing defensive benchmarks can apply. Partners go through background checks. Only security, incident response and pentest teams may use the access, and it cannot be resold.

So an indie researcher or a small security shop should not plan around Carbon this quarter. Argon took 13 days to move from announcement to the paid Gemini API. There is no promise of the same pace for Carbon.

Can I use Gemini 4 Carbon on RouterPlex? #

No. Gemini 4 Carbon is not on RouterPlex yet, because Google has not opened a public API. Separately, Gemini routes on RouterPlex are paused until further notice, as the models page states. Every other model works normally.

We will update this post if either changes. Until then, the honest answer for security work is the abliterated routes below.

Abliterated models for security work today #

Abliteration is a weight edit that removes a model's refusal behaviour. The model then answers security questions that stock models often decline. RouterPlex hosts three abliterated routes. USD per 1M tokens, from the RouterPlex catalog, checked 28 October 2026.

Each route has a 1M-token context, tool calling and image input. RouterPlex sets these prices. They are not a vendor list price.

Security teams use them for work they are authorized to do.

• Red-teaming their own LLM apps with real attack prompts.
• Drafting pentest plans and reports for systems in scope.
• Reading how a disclosed CVE works, then writing detection rules and patches.
• Triage of suspicious scripts, logs and malware samples during incident response.
• Practice on CTF challenges.

Be clear about the gap. Abliteration removes refusals. It does not add skill. On Google's own ExploitGym chart, stock GLM-5.3 solves 15.0% against Carbon's 54.8%. On SEC-bench Pro, stock DeepSeek-V4.1-Flash scores 62.8% against 88.2%. What you get today is a capable model that answers the question, at a price you can see.

Call an abliterated model with the API #

Set ROUTERPLEX_API_KEY in your environment. Never paste a key into code. This call uses the cheapest route. Swap the model id for either of the other two.

curl https://api.routerplex.com/v1/chat/completions \
  -H "Authorization: Bearer $ROUTERPLEX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "glm-5.3-flash-abliterated",
    "messages": [
      {"role": "system", "content": "You assist an authorized penetration test. Scope: staging.example.com only."},
      {"role": "user", "content": "Explain how CVE-2021-44228 works and write a Sigma rule that detects exploitation attempts in web server logs."}
    ]
  }'

The same key works with the OpenAI SDK at https://api.routerplex.com/v1 and the Anthropic SDK at https://api.routerplex.com. That means you can point Claude Code, Codex CLI or OpenCode at an abliterated route and keep your agent setup.

Where it goes wrong #

HTTP 503 on a Gemini model id

Gemini routes on RouterPlex are paused. Use a model from the catalog that is live.

HTTP 402 on an abliterated route

Abliterated routes bill from paid top-up credit only. Bonus and match credit do not cover them, and neither does the $1 trial. Add a top-up and retry.

HTTP 402 on any route

Your balance hit $0, or your key hit its spend cap. The balance never goes negative. Top up or raise the cap.

Slow replies on DeepSeek

deepseek-v4.1-flash-abliterated can take 18 to 60 seconds. Raise your client timeout.

Model not found

Use the exact id, with the dot: glm-5.3-flash-abliterated.

Next step #

Create a RouterPlex account, add a $5 top-up with a $0 fee, set a hard spend cap on the key, and call glm-5.3-flash-abliterated. The same key reaches the rest of the model catalog. The terms apply to every request, and you are responsible for staying in scope.