Gemini 4 Carbon opens to paying developers: what Google's safeguard numbers show

Google has opened Gemini 4 Carbon, the model it first kept behind a cybersecurity program, to paying developers and enterprises. The announcement, published on November 11, 2026, came two weeks after Carbon debuted for vetted defenders only. Google's case for the wider release rests on a set of safeguard numbers, and they are worth reading closely, because the same model that finds and exploits software flaws is now one API key away for anyone who pays.

What changed on November 11

Carbon is available through the API in Google AI Studio and Gemini for business to paying developers and enterprises, according to Google's post. It is rolling out to Google AI Ultra subscribers in Google Antigravity, the Gemini app and AI Mode in Search. Developers can use it in Android Studio, and enterprises can reach it through CodeMender.

Two programs stay separate. Cybersecurity defenders can still apply to the Fairwind Program for a cyber-tuned version of Carbon. And scientists can apply for free six-month access to Argon and Carbon through Antigravity's highest usage tier, subject to eligibility and capacity.

Two weeks earlier, when Google announced Carbon on October 28, access was limited to selected defenders in Fairwind, with trusted partners, developers, businesses and consumers to follow gradually and no date given. That staged plan has now moved faster than the original messaging implied. Our earlier piece on Carbon's benchmarks and restricted access covers the model's capability claims. This one is about the safety case for letting it out.

The price clock

The introductory price matches Gemini 4 Argon: $2 per million input tokens and $10 per million output tokens. Google says that after November 30, 2026, public-access Carbon will cost $4 and $20. So developers have about 19 days at the lower rate from the announcement. If you are budgeting for a pilot, plan on the higher figure, which doubles both lines.

The safeguard numbers

Google's post gives a cluster of figures for how hard Carbon is to misuse. All are Google-reported unless noted.

• In simulated cyberattack tests using ExploitBench and CyScenarioBench, Carbon blocked 99% of attack trajectories from an adaptive red-teaming agent.
• The per-attempt breach rate fell to 0.8%, down from 3.1% on Argon.
• In Gray Swan's testing, the success rate of automated cyberattack queries fell to 2.17%, versus 9.86% on Argon.
• External testers at Trajectory Labs found no new universal jailbreaks across 132 hours and more than 13,000 requests.
• On a 375-task agentic honesty benchmark, Carbon passed 92% of tasks, against 70% for Argon.

The pattern is consistent: roughly a three-to-four-fold reduction in successful attacks against the previous model. That is a real improvement if the tests are representative. The caveat is that an adaptive attacker with real motivation and weeks of time is a different test from 132 hours with a named lab. A "zero new universal jailbreaks" result means the testers did not find one in that window, not that none exists.

There is also a small inconsistency worth noting. At the October 28 launch, coverage of Google's announcement reported a 0% attack success rate on the Gray Swan indirect prompt-injection benchmark. The new post still acknowledges that prompt-injection robustness is an area for improvement. Both can be true, since a benchmark can saturate while real-world injection remains open, but it is a reminder that a benchmark result is not the same as safety.

What stays restricted

The most capable cyber behavior is still gated. Google reports that Carbon leads SEC-bench Pro (finding vulnerabilities), ExploitGym (exploiting them) and CWE-bench v1 (patching them) when accessed through Fairwind. At the October launch the reported scores were 88.2%, 54.8% and 71.0%, with the evaluations run without guardrails. The public version is the guarded one. That split is the design: defenders get the unguarded tool, everyone else gets the one with refusals and monitoring.

It is the same structure we track across labs in our restricted-access cyber model tracker. The question that matters is whether a tiered release can hold once the guarded model is in the hands of millions of developers.

Honesty and alignment results

Beyond misuse, Google reports numbers on whether the model behaves. The 92% agentic honesty pass rate is one. At launch, the coverage of Google's announcement reported that cheating on Terminal-Bench 4.0 fell to 0% and shortcut exploitation to 0.4%, and that high-severity misalignment alerts in internal coding environments dropped by nearly 80%. Those are Google's internal measures, and the company has not released the underlying alert data. Independent evaluators have not published anything we could find to confirm them.

Google's post carries no quote from a named person that we can verify, so there is no pull quote here. The claims above are the company's, and we have labeled them.

What we would do

If you build on Carbon, treat the safeguard figures as a starting point for your own red-teaming. Run prompt-injection tests against your actual tool permissions, log what the agent does, and keep write access narrow. If you run a security team, note that the unguarded version sits behind Fairwind and that the public one will refuse some defensive work.

For everyone else, the bigger signal is the speed. A model described two weeks ago as too sensitive for public release is now on sale, with the measured safeguards doing the work that access controls did before. That could prove a sound bet or a fast one. The test will be the first public report of Carbon being misused, and how quickly Google can show its monitoring caught it.