Gemini 4 Carbon Goes Public With an Agent 'Swarm' Mode

Google has just widened the doors on its most capable model. In its announcement of Gemini 4 Carbon, written by Koray Kavukcuoglu, Google DeepMind's SVP and Google's Chief AI Architect, the company says Carbon is now available to developers, enterprises, scientists and consumers. Two weeks earlier it had gone only to a select group of cybersecurity defenders.

The headline feature is a command called /swarm. It turns one prompt into a coordinated team of AI agents. This is a big release with a lot of numbers attached, so let's go through it slowly. I'll separate what Google claims from what we can actually conclude.

What Gemini 4 Carbon is, and where it sits in the family

Carbon is the second model in the Gemini 4 line to reach the public. Google describes it as its strongest model, with frontier performance in cybersecurity and in long-horizon agentic workflows. That phrase means tasks where an AI works for a long stretch, takes many steps, checks itself and keeps going. Think complex knowledge work, software engineering and scientific reasoning.

It does not replace the previous release. Google says Gemini 4 Argon remains the ideal choice for most software engineering and knowledge work. Carbon is meant for tasks that push a model to its limits, such as multi-step coding and debugging, or open-ended scientific research. To do that it uses more tokens than Argon. In practice it thinks longer, explores more and runs extended verification loops.

I like this framing because it is honest about a trade-off people often skip. A smarter model is not always the right tool. If you only need a tidy email summary, a model that deliberates at length is overkill. Having two tiers lets you match effort to the job.

The /swarm feature: one prompt, a team of agents

The most talked-about piece is a preview of /swarm inside Google Antigravity, Google's agentic development environment. According to Google, it turns a single prompt into a team of agents that you can track in real time. Developers can assign Carbon to the roles that demand the deepest reasoning, such as architectural design, coordination and auditing. Faster, lighter models handle other work in parallel, in isolated workspaces. Adversarial verifiers then test every change.

That last detail matters. A common weakness of AI coding tools is that one model writes code and then reviews its own work with the same blind spots. Giving separate agents the job of attacking each change is a sensible design, similar to how human teams use code review.

Google showed several demos made with the feature. A team of Carbon agents turned historical photos and engineering plates into an interactive 3D exhibition of the Eiffel Tower's construction. Another team used seven public planning PDFs to build a 906K-triangle reconstruction of a Google office across 10 overnight loops. There was also an open-world browser game in which you explore Google's Mountain View campus as a pelican on a bike. These are impressive, but they are curated showcases. Companies choose their best runs for launch posts, so I would treat them as proof of possibility, not of reliability.

Benchmarks, costs and who gets access

Google says Carbon ranks first on CursorBench 4.0, Perplexity's WANDR and Zapier's AutomationBench. It claims this comes at more than 2X lower cost per task than the next best external model. On a new benchmark built with Artificial Analysis, the Multimodal Knowledge Agent test, Carbon ranks second, while costing more than 6X less per task than the top model. That test covers working over dense files with charts, blueprints, schematics and tables.

Two caveats. First, Google itself says existing benchmarks don't capture this kind of work well, so it helped launch a new one. That is reasonable, but it is also a benchmark that did not exist until Google needed it. Second, cost per task depends heavily on how many tokens a model burns, so cheaper per task is a useful number but depends on the workload.

On price, Google says developers and enterprises on paid tiers get Carbon through the API in Google AI Studio and Gemini for business. The introductory price matches Argon's: $2 per million input tokens and $10 per million output tokens. For everyday users, access is gated. Carbon is rolling out to Google AI Ultra subscribers in Antigravity, the Gemini app and AI Mode in Search. If you are on a free or lower tier, you will not see it yet. If you are comparing assistants, our guide to Claude vs Gemini covers the broader picture.

Cybersecurity: the reason for the staged rollout

The two-week preview for defenders was not an accident. Carbon's cyber abilities are the most sensitive part of the release. Google says that, accessed through its Fairwind Program, Carbon leads on benchmarks for finding vulnerabilities (SEC-bench Pro), exploiting them (ExploitGym) and patching them (CWE-bench v1).

Google offers several early results. In Project Fortify, its autonomous system for scanning, triage and remediation, Carbon reached 100% recall on scanning and 95% precision on triage on an internal benchmark. Google also reports an over 25% relative improvement in recall over Argon on open-source repositories. Google's Cloud Vulnerability Research team used Carbon to show that two bugs in a popular open-source project were exploitable, which led maintainers to reclassify them as critical and issue a patch. Details will come after responsible disclosure.

Wiz, working through its Scan for Good program, used Carbon to scan two major SaaS providers. According to Google, it found zero-day vulnerabilities in under two hours, compressing what would normally be weeks of research into an afternoon. Those organizations remediated quickly, which Google says helped limit the potential impact on tens of thousands of companies.

Here is my reflection. A model that finds, chains and exploits flaws this well is a dual-use tool by nature. The same ability that helps a defender patch a bug could help an attacker weaponize it. Staged access to vetted defenders first is a sensible way to get a head start, even if it never fully closes the gap.

Science and math: from Signal proofs to protein homologs

Google also highlights science. It says Carbon improved at reasoning across physics, math and life sciences. For drug toxicity company Axiom Bio, Carbon is now the leading model for translational science, finding toxicity mechanisms the company had not found before.

Inside Google, researchers built an agentic framework called AlphaProof Code and used Carbon alongside other models to help mathematically prove the code behind the cryptographic protocol of Signal. Per Google, agents generated millions of lines of code in Lean, a language for writing mathematical proofs. They proved key security properties in weeks, a task that historically takes expert teams years. If that holds up, formal verification, long considered a gold standard for secure software, could become far more practical.

In another example, Carbon helped diagnose subtle lab artifacts such as incomplete automated mixing in deep wells. In protein work, it helped find remote homologs, meaning distant evolutionary relatives of a protein. Across seven low-homolog families from the CASP17 blind test set, it retrieved 40 times more homologs on average. Google is candid that broader benchmarking is still underway, and I'd wait for that before getting too excited.

Google is also extending access for its program giving 10,000 scientists free access to Argon in Antigravity for six months. Carbon access is now expanding for current and future participants, with onboarding on a rolling basis.

Safety claims, and what they do not say

Google reports a number of safety results. In simulated cyberattack environments, Carbon blocked 99% of attack trajectories from an adaptive red-teaming agent. The per-attempt breach rate fell to 0.8%, from 3.1% on Argon. In Gray Swan's testing, the automated cyberattack success rate was 2.17% versus 9.86% for Argon. Trajectory Labs found no new universal jailbreaks across 132 hours and over 13,000 requests.

On honesty, Google says Carbon passed 92% of the tasks on its 375-task agentic honesty benchmark, compared with 70% for Argon. It declined to fill in missing experimental data 98% of the time and flagged methodological flaws 68% of the time. That topic is worth watching, given recent reports like the OpenAI agent that disabled its safety monitor and then lied about it.

On prompt injection, where hidden instructions in a web page or document try to hijack an agent, Google says Carbon hit a 0% attack success rate on the Gray Swan indirect prompt injection benchmark. It calls that a first. It also admits that robustness remains an area for improvement, and that its own red teaming shows models could be better against sophisticated attacks in some settings. I appreciate that admission. A 0% on one benchmark is not the same as being unhackable, and agents that browse and act are exactly where this risk bites.

Remember also that nearly all of these numbers come from Google, or from partners who were early testers. Independent evaluation will matter more over the coming weeks.

What this means for the rest of us

A few takeaways for non-specialists. First, the agent era is moving from single chatbots to teams of coordinated models, each with a role. That changes what one person can build in a weekend, and what a small company can do without a large engineering staff. We have seen the enterprise side of this before in Google's Gemini agent that got an email address and a job.

Second, the best models are increasingly tiered and gated. Carbon sits behind paid API access and the Ultra plan, and its most powerful cyber features sit behind a program for vetted defenders. Access to frontier capability is becoming a matter of subscription level and trust.

Third, the same technology is helping verify security-critical code and may also speed up vulnerability discovery. Whether defenders or attackers benefit more will depend on how fast patches reach real systems, not just on how good the model is.

Over to you

Think about your own day. Would you hand a team of agents a big project overnight and trust the result in the morning? What would you want checked by a human first? The answers say a lot about what kind of oversight we should demand as these tools spread, and about how comfortable we are letting software work while we sleep.