Gemini 4 Carbon Released: Major Leap in Agentic Workflows and Cybersecurity Capabilities

Google DeepMind's latest frontier model, Gemini 4 Carbon, is now available to developers, enterprises, scientists, and consumers. This is another major advancement in model capability following Gemini 4 Argon. Carbon is not meant to replace Argon, but is positioned as a cutting-edge tool for tasks that "test the upper limits of model intelligence"—complex multi-step coding and debugging, open-ended scientific research, and long-horizon autonomous agent workflows.

Carbon vs. Argon: Two Positions, One Price

In the announcement, Koray Kavukcuoglu, Senior Vice President at Google DeepMind, made it clear that Argon remains the ideal choice for most software engineering and knowledge work, while Carbon is built for tasks that require consuming more tokens, deeper reasoning, and extended verification loops. In other words, Carbon trades higher compute investment for deeper exploration and verification capabilities.

On pricing, Carbon is consistent with Argon: $2 per million input tokens and $10 per million output tokens. For enterprises that need to call frontier models frequently, this pricing means they can gain stronger deep reasoning capabilities without increasing their budget. Developers can access it via the Google AI Studio and Gemini for business APIs; Google AI Ultra subscribers can experience it in Antigravity, the Gemini app, and AI Mode in Search.

Benchmarks: Leading Accuracy, Significantly Lower Cost

On multiple independent benchmarks designed for real-world workflows, Carbon demonstrates a combination of frontier accuracy and practical production economics. It ranks first on CursorBench 4.0, Perplexity's WANDR, and Zapier's AutomationBench, with per-task cost more than 2x lower than the next-best external model.

For multimodal knowledge work, Google partnered with Artificial Analysis to launch a new Multimodal Knowledge Agent (MKA) benchmark that tests models' multimodal performance in agentic workflows. Carbon ranks second on this benchmark, but its average per-task cost is more than 6x lower than the best-performing model. This result shows that in scenarios involving dense documents, charts, and engineering drawings, Carbon offers an extremely cost-effective option.

Agent Collaboration: /swarm Turns a Single Prompt into a Team Operation

A major highlight of Carbon is the /swarm feature previewed in Google Antigravity. It can turn a single prompt into a team of agents that can be tracked in real time. Developers can assign Carbon to roles requiring the deepest reasoning—such as architecture design, coordination, and auditing—while pairing it with lighter models working in parallel, and using adversarial verifiers to test every change.

The examples given in the announcement are quite compelling: seven public urban planning PDFs (from which 206 engineering drawing views were extracted) plus a single prompt, and a multi-agent Carbon team built an interactive 906K-triangle Three.js reconstruction of the Google Platform 37 office building over 10 overnight loops; starting from historical photographs and engineering plates, the same mechanism also generated an interactive 3D exhibition of the Eiffel Tower's construction from 1887 to 1889.

On the software development side, Carbon can run build-verify loops, recover from errors, and simultaneously inspect code and the rendered UI, producing complete, usable applications. Examples include an open-world 3D game in which a pelican rides a Google Bike to explore the Mountain View campus, and a redesigned Google merchandise store frontend delivered within two prompts.

Adversarial Verifier: In multi-agent collaboration, an adversarial verifier is an agent assigned the role of "finding faults"; its goal is not to cooperate with the generator but to actively seek out logical gaps, factual errors, or implementation defects in the output. This design, which separates the generator and the verifier, draws on the ideas of generative adversarial and red-team/blue-team approaches, and can reduce the blind spots that arise when a single model self-reviews. Combined with the build-verify loop, the system can repeatedly execute the closed loop of "generate change—run tests—read errors—fix," allowing long-horizon tasks to converge even when unattended. This is also the prerequisite for Carbon's ability to run multiple loops continuously overnight.

Three.js and Triangle Count: Three.js is a JavaScript 3D graphics library that runs in the browser. The "906K triangles" in the model refers to the total number of triangular faces in the scene geometry, a commonly used metric for measuring the fineness of 3D reconstruction and rendering overhead: the higher the number, the richer the detail, but the higher the demands on rendering performance and memory. Using it to describe the building reconstruction result actually shows that the output is not merely a textual description, but a complete graphical asset that can be interacted with directly in the browser.

Cybersecurity: Full-Chain Capabilities from Discovery to Remediation

Carbon demonstrates the strongest capabilities to date on cybersecurity benchmarks. When accessed through the Fairwind Program, it leads on key benchmarks for vulnerability discovery (SEC-bench Pro), exploitation (ExploitGym), and patching (CWE-bench v1).

The real-world application data is noteworthy: in Google's Project Fortify autonomous system, Carbon achieved 100% recall in scanning and 95% precision in classification on internal benchmarks; in open-source codebase tests, it improved on Argon's already strong recall by more than 25%, discovering real logic defects that had not been detected before. When the Wiz Scan for Good project team used Carbon to scan two large SaaS providers, they found 0-day vulnerabilities within two hours, compressing vulnerability research that typically takes weeks into a single afternoon.

Scientific Reasoning: From Formal Verification to Protein Homolog Search

Carbon shows clear improvements in reasoning across physics, mathematics, and the life sciences. The most striking case is AlphaProof Code: researchers used Carbon to generate millions of lines of Lean code and, within weeks, mathematically proved the security properties of the underlying code of the Signal encryption protocol—tasks that historically required expert teams and years.

In protein structure prediction, the research team used Carbon in a multi-agent setting to autonomously search petabyte-scale unannotated sequence archives and 3D structure databases. On 7 low-homology protein families in the CASP17 blind test set, it increased the average number of retrieved homologs by 40x without retraining the structure prediction model. This provides an upstream solution to the sparse homologous sequence problem that plagues AlphaFold 3-class models.

Lean and Formal Verification: Lean is an interactive theorem prover and also a dependently typed functional programming language. Formal verification refers to using mathematical methods to rigorously prove that a program or protocol satisfies its specification, rather than relying only on test sampling. In Lean, proofs themselves are code, and the compiler checks their logical correctness line by line. Therefore, "generating millions of lines of Lean code" means decomposing security properties into machine-checkable mathematical propositions. This process traditionally relies on specially trained experts and takes years; the value of large models lies in taking on labor-intensive steps such as proposition decomposition, lemma search, and writing repetitive proof scripts, while human experts are responsible for key modeling decisions and final review.

Protein Homolog Search and CASP: Homologs are proteins in different species or different genes that evolved from a common ancestor and have similar sequences or structures. Structure prediction models usually first perform multiple sequence alignment (MSA) using homologous sequences, extracting co-evolutionary signals to constrain the 3D structure. When the family to which the target protein belongs is sparse in the database (low homology), MSA information is insufficient and prediction accuracy drops noticeably—a known bottleneck of AlphaFold-class models. CASP is a blind structure prediction assessment held every two years, during which target structures are kept confidential from participants. Carbon increased the number of retrieved homologs by about 40x on low-homology families, effectively making the sparse input denser upstream without modifying the downstream prediction model itself.

Safety and Alignment: Attack Success Rates Drop Sharply

Carbon's stronger cyber capabilities also bring higher risk of misuse, so Google further hardened the safety stack on top of Argon's. In simulated cyberattack test environments instrumented with ExploitBench and CyScenarioBench, Carbon blocked 99% of attack trajectories from adaptive red-team agents, reducing the breakthrough rate per attempt to 0.8% (Argon: 3.1%); in Gray Swan's tests, the success rate of automated cyberattack queries dropped to 2.17% (Argon: 9.86%). External testing by Trajectory Labs found no new general-purpose jailbreaks across 132 hours and more than 13,000 requests.

On alignment, Carbon passed 92% on a 375-task agent honesty benchmark (Argon: 70%), refused to fill in missing experimental data in 98% of cases, and flagged methodological flaws in 68% of cases. On the previously announced Gray Swan IPI benchmark, Carbon achieved a 0% prompt injection attack success rate, the first time this milestone has been reached.

Prompt Injection: Prompt injection is a class of attacks against large model applications in which attackers disguise malicious instructions as data processed by the model (web content, emails, documents, tool return values), inducing the model to deviate from its original task, leak system prompts, or perform unauthorized actions. Indirect prompt injection (IPI) refers to malicious instructions that are not directly entered by the user but hidden in external content that the model autonomously browses or retrieves. This is especially threatening to agentic workflows, because agents continuously read large amounts of untrusted content and act on it. Gray Swan's IPI benchmark specifically measures the success rate of models being hijacked in such scenarios; "0% attack success rate" means that across all test cases in the benchmark, the model was never misled by hidden instructions.

How to Get Started

Developers can build applications in AI Studio and the paid tier of the Gemini API in Android Studio; enterprises can use it through the Gemini for business API, the model dropdown, Google Antigravity, or CodeMender; general users can access it through the Gemini app and AI Mode in Search (requires a Google AI Ultra subscription). For researchers, Google previously opened six months of free access to Argon in Antigravity to 10,000 scientists, and has now included Carbon in that program, with applications remaining open.

One-line Summary

Google releases Gemini 4 Carbon, offering stronger deep reasoning, agent collaboration, and safety at the same price.

Paragraph Summary

Google DeepMind launches the frontier model Gemini 4 Carbon, positioned as a cutting-edge tool for tasks that test the upper limits of intelligence and complementary to Argon, which targets routine software engineering. Both are priced the same ($2 input, $10 output per million tokens). Carbon ranks first on CursorBench 4.0, WANDR, and AutomationBench with per-task cost more than 2x lower, and ranks second on the multimodal knowledge work benchmark MKA at more than 6x lower cost. Its /swarm feature turns a single prompt into a collaborative agent team capable of completing complex projects such as 3D building reconstruction and full application development. In cybersecurity, it achieves 100% scan recall and 95% classification precision, and finds 0-day vulnerabilities within two hours; in scientific research, it completes formal verification of Signal protocol code and increases homolog retrieval by 40x. On safety and alignment, its attack interception rate reaches 99%, with a 0% prompt injection success rate.