Gemini 4 Carbon reaches the Gemini app, but only on Google’s top AI Ultra plan

Gemini 4 Carbon, the model Google had kept for a hand-picked group of security researchers, is now open to paying customers. Developers can call it through the Gemini API, companies can switch to it inside Gemini for business, and Google AI Ultra subscribers can pick it in the Gemini app and in AI Mode in Search. Everyone else keeps Gemini 4 Argon, which Google still recommends for most work.

Carbon is built for the jobs that make other models give up: debugging that spans a whole codebase, research that takes dozens of steps, reports assembled from piles of dense documents. The trade is time and compute. Google says Carbon spends more tokens than Argon exploring a problem, reasoning through it and checking its own answers before it replies.

The app gets a new menu along with it. According to 9to5Google, the model picker now labels Argon for “code & analysis” and Carbon for “most complex work”, and Gemini 3.1 Pro is gone from the app. Argon is available from the AI Pro plan up, while Carbon needs Ultra, the most expensive of Google’s consumer AI plans. Google’s subscription page also limits Carbon to Ultra subscribers in certain countries, and the launch post does not say which ones.

On the tests Google chose to highlight, Carbon leads. The company says it ranks first on CursorBench 4.0, Perplexity’s WANDR and Zapier’s AutomationBench, at less than half the cost per task of the best model from any other lab. On a new benchmark for agents that work through charts, blueprints and tables, built with the analysis firm Artificial Analysis, it places second, at a sixth or less of the average cost per task of the model in first place.

For developers, the bigger change may be /swarm, a feature Google is previewing in its Antigravity coding environment. A single prompt becomes a team of agents you can watch in real time: Carbon takes the roles that need the deepest reasoning, such as architect, coordinator or auditor, while faster and cheaper models handle the parallel work and separate verifier agents test every change. In one Google demo, a team of Carbon agents rebuilt a Google office as an interactive 3D model from seven city planning documents over ten overnight runs.

Carbon went to cyber defenders first for a reason. Google says it leads on benchmarks for finding, exploiting and patching software flaws, including a score of 88.2% on SEC-bench Pro for uncovering real vulnerabilities. Wiz, the cloud security company Google owns, used it to find previously unknown flaws at two major software-as-a-service providers in under two hours. Google researchers also used Carbon to write millions of lines of formal proof that check key security properties of the code behind Signal’s encryption protocol, work that historically took expert teams years.

That capability is also why the public version ships with extra locks. The full security toolkit stays inside Google’s Fairwind Program for vetted defenders. In Google’s own red-team tests, the public model blocked 99% of simulated attack attempts, and the breach rate per attempt fell to 0.8%, from 3.1% on Argon. Those are Google’s numbers on tests Google picked. The company also concedes that resistance to prompt injection, where hidden instructions in a web page or file hijack an AI agent, “remains an area for continued improvement.” The matching per-token price comes with its own catch: a model designed to think longer burns more tokens, so the same job can cost more on Carbon than on Argon.

Carbon launches at the same introductory rate as Argon, $2 per million input tokens and $10 per million output tokens, through the paid tier of the Gemini API in Google AI Studio and Android Studio. That rate ends on November 30, 2026, and afterwards Carbon costs $4 and $20, double the launch price. Scientists can apply for six months of free access to Argon and Carbon through Antigravity, a program Google opened four weeks ago for 10,000 researchers. Google first announced Carbon on October 28, 2026, when it released the model only to a subset of cyber defenders.

The order of the rollout says more than any benchmark. Google handed Carbon to the people who defend software two weeks before the people who build it, and it is now betting its safeguards are strong enough to give the same model to any developer with a billing account.

Tags: Google, Gemini, AI models, Google DeepMind, Gemini 4 Argon, Google AI Ultra