Google ships Gemini 4 Carbon with zero percent prompt injection rate

Google has made Gemini 4 Carbon generally available after a two-week early-access testing phase, and the model arrives with a claim no competitor can match: a zero percent success rate for attackers on the Gray Swan IPI prompt injection benchmark. Google says this is the first time any model has reached that milestone. The launch, though, lands in the middle of the fastest model release cycle yet — Anthropic unveiled its new top model Fable 5.2 shortly before, and it outperforms Carbon in the Artificial Analysis index even at lower reasoning intensity. Two weeks ago, Carbon looked like Google's next leap ahead; today it already feels slightly less fresh.

What is Carbon, and how does it differ from Argon?

Google positions Carbon as a complement to Gemini 4 Argon, not a replacement. According to Google, Argon remains the better choice for most software engineering and knowledge work, while Carbon targets tasks that push the limits of model intelligence — complex multi-step coding, debugging, and open-ended scientific research.

That division is a bit surprising on paper, because both models share the same token price. But Carbon uses more tokens than Argon to reason more deeply on hard debugging or open-ended research and to run longer verification loops. In practice, the total bill for Carbon is likely higher despite identical per-token pricing.

How much does it cost per task?

In the Artificial Analysis test published two weeks ago, Carbon cost $7.76 per solved task, calculated at the regular standard price of $4 per million input tokens and $20 per million output tokens. That makes Carbon cheaper than the older budget model Flash 3.8 while delivering better performance.

The competitive picture from the same test:

• Opus 5.5 Max: $10.04 per task
• GPT-6 Astra Max: $6.25 per task
• Fable 5.2 (maximum tier): $26.50 per task
• Fable 5.2 (High tier): roughly $9 per task, while still sitting two points ahead of Carbon in the overall index (62 vs. 60)

Developers and business customers on paid tiers can access Carbon through the Gemini API in Google AI Studio, in Android Studio, or through Gemini for Business. The introductory price stays at $2 per million input tokens and $10 per million output tokens. A Flash variant of Gemini 4 is likely to launch soon.

What did the benchmarks show?

Beyond the performance data already known from late October, Google cites new benchmark results. Carbon takes first place on the coding benchmark CursorBench 4.0 — ahead of Fable 5.2 — on Perplexity's WANDR, and on Zapier's AutomationBench. On those benchmarks it runs at less than half the per-task cost of the next-best model, Fable 5.2.

For analyzing dense documents with charts, blueprints, and tables, Google partnered with Artificial Analysis to launch the new Multimodal Knowledge Agent (MKA) benchmark. Carbon finishes second there, just behind Fable 5.2 and just ahead of Opus 5.5, but costs less than one-sixth of what the top performer averages. The takeaway: Carbon trades a few benchmark points for a substantially lower bill.

What happened in the security tests?

From the two-week Fairwind Program early-access phase, Google shared concrete real-world cyberdefense results for the first time. As part of security firm Wiz's Scan for Good program, Carbon found real zero-day vulnerabilities while scanning two large SaaS providers in under two hours. Google's own cloud security team also used the model to write working proof-of-concept exploits for two known bugs in a popular open-source project.

Only through those exploits could the bugs be proven critically exploitable, comparable to the PHP2Shell vulnerability. In Google's autonomous security system Project Fortify, Carbon boosted the detection rate on open-source codebases by more than 25 percent over Argon. Cybersecurity is clearly the model's signature strength, and it's the area where Google offered the most tangible evidence.

What about safety and honesty?

Google has published a full safety report and the model card alongside the release. On an internal honesty test with 375 tasks, Carbon passes 92 percent of tests, compared to 70 percent for Argon, and refuses to fabricate missing experimental data in 98 percent of cases.

In simulated cyberattacks, the model blocked 99 percent of attack paths from adaptive red-teaming agents and cut the breakthrough rate per attempt from 3.1 percent with Argon to 0.8 percent. External testers from Trajectory Labs didn't find a single universal jailbreak across 132 hours and more than 13,000 queries.

The headline number: on the Gray Swan IPI benchmark, Carbon achieved a prompt injection success rate of zero percent — it wasn't cracked even once. Google says no model has done that before. One caveat worth keeping in mind: that doesn't mean prompt injections are solved, since the test itself may simply be saturated. Still, it's measurable progress, especially as some competitors remain more vulnerable here.

What is the "/swarm" feature in Antigravity?

Alongside the model launch, Google is previewing the "/swarm" feature in Google Antigravity, the company's counterpart to Claude Code. The feature turns a single prompt into a coordinated team of agents whose work can be tracked in real time. Carbon takes on roles that need deep reasoning — architecture design, coordination, and auditing — while faster, lighter models run in parallel isolated workspaces and act as adversarial verifiers.

Google demonstrated the capability with three projects: a 3D game where users explore the Google campus in Mountain View as a pelican riding a GBike, an interactive 3D reconstruction of the Eiffel Tower's construction based on historical photos, and a playable 18th-century fortepiano with seat-specific spatial acoustics.

The cost-benefit ratio of agent swarms remains contested. OpenAI and Anthropic have recently sounded cautious, and researchers are skeptical too. The main benefit appears to be speed through parallelization, but that's complex to achieve.

Why does this launch matter?

Carbon's release shows how quickly the frontier has compressed: a model that looked like a clear lead two weeks ago now shares the top of the rankings with a rival released days later. On security benchmarks, Google says Carbon leads on SEC-bench Pro (finding vulnerabilities), ExploitGym (exploiting vulnerabilities), and CWE-bench v1 (patching vulnerabilities) — though that applies only to the Fairwind Program version, and Google doesn't share specific numbers. With a Flash variant of Gemini 4 likely on the way, the question now is whether Google can shorten its own gap between unveiling a model and shipping it before the next competitor cycle overtakes it.