Reverse Engineering Gemini 4 Carbon

Google Just Shipped Gemini 4 Carbon. Here's How It Actually Works, Reverse-Engineered From the Docs.

---

Google already had a frontier coding model two weeks old when it launched another one. Gemini 4 Carbon isn't a replacement for Gemini 4 Argon. It's a second tier above it, built to spend more tokens on problems Argon gives up on.

A caveat before we start. Google has not disclosed Carbon's architecture, parameter count, or training data. "Reverse engineering" here means reconstructing the system from the launch post, the availability post, the AI Studio model page, the Google Cloud model page, and the Argon docs it inherits from. Almost every benchmark below is Google-reported. I mark where something is my inference rather than Google's statement.

The Problem It's Solving

Argon already handles most software engineering and knowledge work well, and Google says so itself. The gap Carbon targets is different. It's tasks that run for hours or days, hit dead ends, and need the model to keep verifying its own work. Google says internal teams have watched Carbon run for days, pushing through dead ends on tasks like root-causing and patching subtle bugs in large codebases and low-level systems.

The second problem is security. Finding, validating, and fixing vulnerabilities is a lifecycle, and models have been good at one step and weak at the others. Google positions Carbon as the first Gemini model to cover all three: detection, exploitation (to prioritize what's real), and root-cause patching. That's also why it shipped in two stages, which I cover below.

The third problem is trust in long runs. A model that runs unattended for hours has more chances to cheat on a test, fabricate missing data, or edit files it shouldn't. Much of Google's launch material is about that, not raw capability.

How Gemini 4 Carbon Actually Works

Where it sits in the family

Gemini 4 currently has three named members that I could confirm: Argon, Carbon, and Hydrogen. Hydrogen is described as the everyday coding and agentic option and powers a Search upgrade, but I don't have detailed specs for it. Google's own routing guidance is that Argon remains the right choice for most software engineering and knowledge work. Carbon is for tasks that test the limits of a model's intelligence, and it uses more tokens than Argon to explore thoroughly, reason deeply, and run extended verification loops.

My read: Carbon is a test-time-compute play. The same API surface as Argon, a different spend profile. Google hasn't said how it differs in training, so treat that as inference.

In the Gemini app the labels are "Code & analysis" for Argon and "Most complex work" for Carbon. 9to5Google reports the app dropped 3.1 Pro with this launch.

The API contract

Property	Value
Model ID	gemini-4-carbon (and gemini-4-carbon-cyber-permissive for projects approved through Fairwind, per Cloud docs)
Inputs	Text, image, video, audio, PDF
Output	Text only
Context window	1,048,576 tokens, unified across input, thinking, and output
Max output per request	65,536 by default; up to 1,048,576 with long decode
Thinking levels	low, medium, high
Caching	Implicit only; explicit caching not supported
Tools	Function calling, code execution, computer use, file search, URL context, Google Search and Maps grounding, structured outputs
Not supported	Image generation, audio generation, Live API
Consumption	Batch API, Flex inference, Priority inference

Two doc inconsistencies to know about. The Google Cloud page lists maximum output tokens as 1,048,576, while AI Studio lists 65,536 default synchronous and up to 1,048,576 with long decode. Those are probably the same thing described two ways, but verify before you size anything. Also, agentic video understanding is supported but defaults to static.

On Google Cloud, Carbon supports the GenerateContent, Interactions, Chat Completions, and Count Tokens APIs, with ML processing in the US and EU multi-regions. Carbon is also a "Google Frontier Model" under Section 34 of the Service Specific Terms, which covers abuse monitoring. Read that before putting regulated data through it.

Long decode is the feature to understand

Carbon's docs point to the same SDK floor as Argon for automatic continuation: Python google-genai ≥ 2.34.0, JS/TS @google/genai ≥ 2.32.0, Go ≥ 1.77.0, Java ≥ 1.80.0. The Argon documentation describes the mechanism. A single generation of up to about 1M tokens is split across multiple inference calls, with a continuation token passed back so the model resumes where it stopped. Treat the details below as Argon-documented behavior, and check them against Carbon's page.

A few things in there will bite you in production:

• max_tokens is a total budget across every hop, not per request.
• The conversation before a continuation must be resent unchanged. Don't inject a new user message mid-continuation.
• Token size grows with the decode and can reach several MB on long answers, so your client has to accept and resend bodies of that size.
• Explicit caching is skipped on continuation hops, per the OpenRouter migration notes for Argon. Carbon doesn't support explicit caching anyway.
• The cost of a long answer is the sum of every hop's usage.
• For the Interactions API, Google says background execution is the easiest way to run long decode, since it runs the continuation loop server-side until the model finishes or hits max_output_tokens.

Here's an illustrative sketch of that shape, adapted from the Argon docs. Confirm parameter names against Carbon's own page:

from google import genai

client = genai.Client()  # AI Studio route; Cloud route differs per docs

job = client.interactions.create(
    model="gemini-4-carbon",
    input="Audit this migration plan and list breaking changes by package.",
    generation_config={"thinking_level": "high"},
    background=True,   # server-side continuation loop
    store=True,
)
# Poll job status; only treat output as final once the status says so.

Per Google, the thinking level is your main lever on quality, latency, and token spend. The advice from the Argon docs applies equally here: run your evals at all three levels with a high output cap so limits don't truncate answers, then pick the lowest level that meets your bar.

The two-stage release

This is the part of the design that's about governance more than model internals:

1. October 28: Carbon announced and released only to a subset of cyber defenders, widening to trusted partners through the Fairwind Program. Google said it was engaged in the US government's voluntary pre-release model testing process.
2. November 10: General availability to paying developers, enterprises, and Ultra subscribers, with the cyber-permissive variant remaining gated.

The public model and the Fairwind variant are separate model IDs. Google's numbers for the strongest cyber results are for "Carbon for cyber" accessed through Fairwind. The public gemini-4-carbon carries the safeguards described below.

Cyber capabilities, and how to read them

Google reports Carbon, evaluated without guardrails, at 88.2% on SEC-bench Pro (finding), 54.8% on ExploitGym (exploiting), and 71.0% on Collinear's CWE-bench (patching). On internal benchmarks it reports more than 2x Argon's success rate at generating secure code.

Reported field results:

• Project Fortify (Google's internal scan-triage-remediate system): 100% recall on scanning and 95% precision on triage on an internal benchmark, plus over 25% relative improvement on Argon's recall in open-source repository testing.
• Chrome team: more than 10x better than another lab's large frontier model at generating high-quality patches.
• Google Cloud Vulnerability Research: used Carbon to build proofs of concept showing two bugs in a popular open-source project were exploitable, comparable in severity to the recent PHP2Shell exploit. The maintainers reclassified them as critical and patched. Details are pending disclosure.
• Wiz: found 0-days at two major SaaS providers in under two hours, which Google says compressed weeks of research into an afternoon. Wiz also says Carbon leads on web penetration testing benchmarks.

If you read my GPT-6 Cyber breakdown, the obvious question is who's ahead. OpenAI reports 48.45% on ExploitGym (intended-exploit success rate, highest tested reasoning budget) and 87.02% pass@1 on SEC-Bench Pro. Carbon's 54.8% and 88.2% look higher, but I wouldn't call a winner. The harnesses, access tiers, budgets, and grading details differ, and I haven't seen either vendor's numbers reproduced independently. Treat it as "both are in the same band, and both are vendor claims."

Alignment and safety numbers

Google frames Carbon as a step beyond Argon on behavior under pressure. Its reported numbers:

Behavior	Reported result
Cheating on Terminal-Bench 4.0	0.0% successful, 0.4% attempted, with accuracy improving
High-severity misalignment alerts in live internal coding	Down almost 80%
Unsupported claims vs. Argon	About 2x fewer
Overreach / under-service vs. Argon	Down 26% / down 29%
Gray Swan Indirect Prompt Injection benchmark	0.0% attack success (Argon: 0.7%)
375-task agentic honesty benchmark	92% passed (Argon: 70%)

Within that honesty benchmark, Google says Carbon declined to fill in missing experimental data 98% of the time and flagged methodological flaws 68% of the time. The behavior Google describes is retrieving sources and surfacing discrepancies to the user before acting, instead of guessing.

Misuse safeguards, per Google:

• An adaptive red-teaming agent that revisits its plan after each block, in environments seeded with ExploitBench and CyScenarioBench, was blocked on 99% of attack trajectories. Per-attempt breach rate fell to 0.8%, from 3.1% on Argon.
• Automated cyberattack query success in Gray Swan testing dropped to 2.17%, from 9.86% on Argon.
• External testing by Trajectory Labs found no new universal jailbreaks across 132 hours and over 13,000 requests.

Read those honestly. A 0.0% on one prompt-injection benchmark is real progress, and Google itself says prompt injection robustness remains an area for improvement and that its automated red teaming found room to improve in some distributions. A 0.8% per-attempt breach rate also means a persistent attacker gets many attempts. And the ~80% alert reduction comes from Google's own teams in Google's own environments.

What Teams Are Actually Using It For

Multi-agent engineering in Antigravity. Google is previewing /swarm in Google Antigravity, which turns a single prompt into a coordinated team of agents you can track in real time. The recommended pattern is to assign Carbon the roles that need the deepest reasoning (architectural design, coordination, auditing) and pair it with faster, lighter models in parallel isolated workspaces, with adversarial verifiers testing every change. Google cites multi-package migrations, cross-subsystem root-cause investigations, and complex architectural redesigns as the sweet spot. Its demos include a Three.js reconstruction of an office building from city planning PDFs across 10 overnight loops, and a playable fortepiano model built from CAD drawings and X-ray radiographs.

Web and UI work. Carbon runs build-and-verify loops, recovers from errors, and checks both its code and the rendered UI. It's #4 on WebDev Arena at 1768, up 89 Elo points.

Knowledge work. Google reports #1 on CursorBench 4.0, Perplexity's WANDR, and Zapier's AutomationBench, at more than 2x lower cost per task than the next best external model. It also ranks #2 on Artificial Analysis's new Multimodal Knowledge Agent benchmark at over 6x lower average cost per task than the top model. On the Artificial Analysis Intelligence Index v5.0, Carbon scores 59 and ranks #1. Note the framing: per-task cost, not per-token cost. Carbon burns more tokens, so the per-task claim is the one that matters for your bill.

Science. Drug toxicity company Axiom Bio says Carbon found toxicity mechanisms its team hadn't found before, and it's moving production analyses to Carbon and Argon. Google researchers used Carbon with an agentic framework called AlphaProof Code to help formally verify the code underlying Signal's cryptographic protocol in Lean, which Google says took weeks versus years for expert teams. In protein structure work, Carbon retrieved on average 40x more homologs across seven low-homolog CASP17 families, though Google notes broader benchmarking is still underway.

Why This Is a Bigger Deal Than It Looks

The tiering is explicit. Argon for the 90% case, Carbon for the hard 10%, is a routing decision you now make in code. A sensible pattern is to default to Argon and escalate on failure or complexity signals. Here's a sketch of that idea (my pattern, not Google's):

def pick_model(task):
    hard = (
        task.spans_many_packages
        or task.needs_root_cause_analysis
        or task.previous_attempt_failed
    )
    return "gemini-4-carbon" if hard else "gemini-4-argon"

Honesty is becoming a benchmarked product feature. "Declines to fill in missing data 98% of the time" is the kind of number buyers will start asking for. It matches what OpenAI published for GPT-6 Cyber on blocker reporting. Both labs are reporting behavior under pressure as a first-class metric next to capability.

Frontier cyber models are converging on gated release. Two models in the same month, both with a restricted tier for verified defenders. OpenAI uses Daybreak Red, Google uses Fairwind. Anthropic's Project Glasswing follows a similar shape for its most capable Mythos-class model. The pattern is that the strongest offensive-capable variant stays gated while a safeguarded version ships broadly.

Long-horizon reliability is the real frontier. The headline benchmarks matter less than a claim like "ran for days and persisted through dead ends." Whether that holds up outside Google's environments is the open question, and it's the one to test on your own repos.

Availability and Access

• Developers: paid tier of the Gemini API in Google AI Studio and Android Studio. Ultra subscribers can also use Antigravity and AI Studio.
• Enterprises: Gemini for business via API or model dropdown, Antigravity, or CodeMender. Carbon is GA on Google Cloud's Agent Platform as of November 10, 2026.
• Consumers: Google AI Ultra subscribers in the Gemini app and AI Mode in Search.
• Scientists: a free six-month program giving access to Argon and Carbon through Antigravity's highest usage tier, onboarded on a rolling basis.
• Security defenders: apply to Fairwind for Carbon for cyber.

Pricing: $2 per million input tokens and $10 per million output tokens as an introductory rate through November 30, 2026, then $4 and $20. Cached input tokens are priced at 95% off the input rate. That intro window is short, so benchmark your own workload now. Because Carbon is built to use more tokens than Argon, the per-token price is not the number to budget on. Run your tasks and measure cost per completed task.

What isn't public: architecture, parameter count, training data, and independent reproductions of the headline benchmarks. Google links a model card and a safety and security report for details I couldn't open.

Google shipped the model and the gate in the same week. The race is now about who can prove a long-running agent behaves, not who can claim the biggest benchmark.

Follow for more indepth coverage on MCP, agentic AI, and AI infrastructure.