Google Opens Gemini 4 Carbon to All Paying Users at $2 Per Million Tokens

Google opened Gemini 4 Carbon to paying developers and enterprises on November 10, 2026, at an introductory price of $2 per million input tokens and $10 per million output tokens. The frontier model, first teased on October 28 through a restricted rollout to cybersecurity defenders, is now also reaching Google AI Ultra subscribers through Google Antigravity, the Gemini app and AI Mode in Search.

The pricing looks familiar, and that's deliberate. Carbon's introductory rates match Argon's per-token prices. But the developer documentation is clear that per-task costs won't match: Carbon generally spends more thinking tokens per turn than Argon, and every processed token is billed, including reasoning tokens. After the introductory period ends on November 30, 2026, prices double to $4 input and $20 output per million tokens on December 1.

For developers, that's the trade Google is asking them to evaluate: deeper reasoning in exchange for higher token use and latency.

Who gets access, and where?

The release splits along clear lines. Paying developers can use Carbon through the Gemini API in AI Studio and Android Studio. Enterprises get it through Gemini for business. Ultra subscribers see it roll out across Antigravity, the Gemini app and AI Mode in Search.

Scientists get a separate track. Google is expanding its research program to offer selected current and future participants both Argon and Carbon in Antigravity's highest usage tier, free for six months. Applications remain open, with rolling onboarding subject to eligibility, capacity and selection.

The specialized cyber configuration stays locked. Fairwind, the gate Google used for the original October 28 rollout to a subset of cybersecurity defenders, still controls access to that configuration through applications and rolling admission. The wider release makes Carbon a paid option for reasoning and agent work; it doesn't dissolve the separate cyber gate.

What's actually under the hood?

Carbon builds on Argon's pre-training foundation and architecture, according to the model card. What's new is post-training: additional training for deep reasoning, extended verification and multi-step agent workflows.

The model accepts text, images, audio and video as input and produces text. It handles up to 1 million tokens shared across input, reasoning and output, with a listed knowledge cutoff of March 2026. The card is candid about limitations: hallucinations, possible slowness or timeouts, and greater token consumption at higher thinking levels.

Developers can pick low, medium or high thinking levels, with medium as the default. Google positions the two models differently — Argon for interactive coding, routine feature work and fast production loops, Carbon for the heavier reasoning jobs. Migrating an existing Argon request requires changing only the model ID, not the request schema, though output limits and client timeouts may need adjustment.

One exclusion matters for hobbyists: Carbon is not available in the Gemini API free tier.

How does /swarm coordinate agent teams?

Alongside the model release, Google is rolling out the /swarm preview in the Antigravity app and command-line interface. It's a system for teams of agents working on the same codebase without stepping on each other.

The mechanism works like this. A coordinator creates specialized workers in isolated Git worktrees so their edits don't collide. Adversarial verifiers run tests and challenge code changes. Agents communicate through a shared append-only message board, and idle agents wait without consuming tokens.

Users get visibility into the whole process through a live board, member roster and graph timeline. They can inspect tool activity, steer individual agents and replay how a team reached its result. Roles can use different models — Carbon handling coordination, architecture or auditing while lighter models do routine implementation.

The Antigravity team reports five weeks of internal testing on multi-package migrations, cross-subsystem investigations and architectural redesigns. They also attach a warning worth reading twice: parallel multi-agent systems consume quota much faster than standard chat.

What do the benchmarks show?

The model card's results, current as of October 2026, show clear gains over Argon across the board:

• Artificial Analysis Intelligence Index v5.0: Carbon scores 59 versus Argon's 50.
• GraphWalks long-context test (256K-to-1M): Carbon scores 96.2% versus Argon's 84.2%.
• FrontierSWE 2: Carbon scores 61.2%, beating Argon's 55.0% but trailing the listed 65.5% for GPT-6 Astra and 62.3% for Claude Opus 5.5.

One caveat from the card itself: its cybersecurity results reflect access through Fairwind, not the general public configuration.

Are the cyber safeguards holding?

Google's safety report says Carbon did not cross its material-capability-change threshold relative to Argon, so a full new critical-capability assessment was not required. But it carries forward a significant determination: without safeguards outside the model, Carbon cannot be ruled out from reaching Cyber Uplift Level 1 — Google's threshold for cyber capabilities that could enable additional severe-scale harm from high-impact attacks. Google assesses that strengthened safeguards reduce the residual risk to an acceptable level.

The Gray Swan testing in the report gives the picture nuance. Carbon's automated cyberattack query success rate was 2.17%, down sharply from Argon's 9.86%. But the per-objective rate — whether a task was breached at least once across retries — remained 40% after 200 attempts at each of 25 high-severity tasks.

That contrast tells a specific story. Individual attacks became less reliable, but persistent retries still succeeded on a substantial minority of objectives. The safeguards add operational friction; they don't eliminate breaches.

Carbon also posted a 0% attack-success rate on Gray Swan's external indirect prompt-injection benchmark. The safety report still says such attacks remain possible. A clean benchmark score doesn't establish immunity for agents processing untrusted content — a point anyone deploying Carbon-powered agents on real data should weigh.

Why the release matters

The economics are the story here as much as the benchmarks. Matching Argon's introductory per-token rates doesn't guarantee matching per-task costs, because Carbon's extra reasoning tokens are billable. Developers comparing the two models on price need to compare what a full task costs, not what a million tokens cost.

The dual-gate structure is also notable. Google has built a model it considers powerful enough in cyber contexts to warrant a dedicated access program, then released the general version to everyone with a credit card. Whether the documented safeguards hold up will now be tested by a much wider user base running exactly the multi-step agent workflows Carbon was post-trained for.

The next data point arrives fast: introductory pricing expires November 30, 2026, and the doubled rates take effect December 1.