On October 28, Google DeepMind announced Gemini 4 Carbon, arriving fourteen days after Gemini 4 Argon. Alongside improvements in general reasoning and long-horizon engineering tasks, DeepMind reported specific benchmark gains in software security. Carbon achieved 88.2 percent on SEC-bench Pro for identifying vulnerabilities, 54.8 percent on ExploitGym for autonomous exploit generation, and 71.0 percent on CWE-bench for automated patch generation.

DeepMind accompanied those capability gains with two operational choices. First, Carbon maintains the identical introductory price structure introduced with Argon: two dollars per million input tokens and ten dollars per million output tokens, with cached input tokens discounted by 95 percent. Second, DeepMind chose not to release the model directly through open API tiers. Instead, access is restricted to selected security researchers through its Fairwind Program and voluntary pre-release reviews with federal agencies.

Pricing a utility at constant marginal cost assumes that output variance is bounded and private. For document summarization, natural language extraction, or standard web application development, a token generated by a client produces utility for the buyer without imposing unpriced negative externalities on third parties. If a completion call fails or produces bad code, the buyer bears the cost of the discarded output. The provider collects a uniform ten dollars per million tokens and clears the queue.

That pricing structure disintegrates when applied to autonomous offensive capabilities. On ExploitGym, generating a candidate exploit script consumes several thousand output tokens, representing a raw API expenditure measured in pennies. The realized value of that script, however, is heavily fat-tailed. Most attempts fail, generating zero economic product. A single successful exploit chain targeting a common kernel flaw or cryptographic library produces either a five-figure vulnerability bounty or millions of dollars in defensive disruption across enterprise networks.

A foundation model provider cannot internalize the liability of weaponized outputs under a flat token tariff. If an open API allows anonymous callers to generate weaponized zero-day exploits at ten dollars per million tokens, the provider exposes itself to severe regulatory intervention, legal liability, and platform reputation damage. At the same time, the provider cannot raise the general token price to match the potential downside of an attack. Pricing tokens at five hundred dollars per million to price in tail liability would destroy the commercial market for benign engineering workloads.

When a price mechanism cannot clear a market safely, sellers resort to non-price rationing. DeepMind’s Fairwind Program, customer vetting requirements, and pre-release government reviews are institutional forms of capital rationing. Because the provider cannot use price discrimination to separate offensive attackers from defensive engineers, it replaces the open market with an administrative filter. The lab transitions from a public utility provider into a credentialing authority that decides who possesses sufficient clearance to purchase compute.

This administrative filter introduces structural distortions for downstream software teams. Large enterprise defense platforms and well-capitalized security vendors receive preferential access to frontier weights under managed partnerships. Independent security auditors, open-source maintainers, and smaller infrastructure teams remain confined to older model checkpoints. The ability to audit production systems against frontier capabilities becomes a function of corporate scale rather than technical necessity.

The operational reality inside engineering organizations complicates the defense narrative. DeepMind notes that Carbon doubles the rate of secure code generation compared to Argon on internal benchmarks, and the Chrome security team reported substantial gains in patch quality compared to older frontier models. In a static model where defense simply outpaces offense, providing automated patching tools would permanently eliminate software vulnerabilities.

In practice, the economic costs of offense and defense scale under opposing cost curves. On an exploitation benchmark like ExploitGym, an adversary requires a single valid execution path to achieve a successful compromise. An attack agent running automated loops at ten dollars per million tokens can afford dozens of speculative failures to secure one functional payload.

Defense requires universal coverage across every deployed endpoint, microservice, and third-party dependency. Even if a model successfully resolves 71.0 percent of known flaws on CWE-bench, the remaining 29 percent of unaddressed or incorrectly patched vulnerabilities leave the underlying attack surface viable. Automated code generators produce remediation suggestions in seconds, but verifying that a patch does not break existing production invariants requires human regression testing, staging deployments, and manual code review. Offense consumes cheap compute cycles, while defense continues to pay the fixed hourly rate of senior systems engineers.

The fourteen-day window between Argon and Carbon reveals a second friction in model adoption. Enterprise security teams often spend weeks evaluating a new model release against internal repositories, running penetration tests, and verifying compliance boundaries before approving deployment. When frontier model weights depreciate on a bi-weekly cycle, the evaluation phase lasts longer than the lifespan of the underlying version. Software teams must decide whether to freeze on an obsolete checkpoint or expend continuous engineering hours validating transient updates.

Gemini 4 Carbon marks the point where uniform API pricing reaches its limits. As frontier reasoning models demonstrate measurable capability on autonomous exploitation benchmarks, the fiction that compute can be sold as an unmetered, uniform commodity breaks down. Foundation model developers will increasingly rely on walled-garden partner programs, formal identity verification, and non-price rationing, leaving enterprise buyers to manage the asymmetric costs of verification on their own balance sheets.