llm-gemini 0.36: Gemini 4 Carbon in the CLI After Cyber-Defender Gating

Gemini 4 Carbon left the cyber-defender waiting list for API callers on November 10, 2026, when Simon Willison shipped llm-gemini 0.36 and announced it on his blog. Anyone with a Google AI API key can now run llm -m gemini-4-carbon from the shell—the first practical path most developers had to Google's strongest frontier Gemini without an allowlist.

That is separate from Vertex AI, where public documentation still centers on Gemini 4 Argon for most cloud projects, as we tracked in our November 10 Vertex access check. If you build on GCP billing and IAM, keep reading both threads.

TL;DR

What changed between defender-only and November 10

Google introduced Carbon on October 28, 2026 as its strongest Gemini for long-horizon and cyber work. The post gated early access:

• A subset of cyber defenders first.
• Broader access through the Fairwind Program.
• Later developer and consumer availability.

For two weeks, most builders outside that slice could read benchmark tables but could not call Carbon from their own scripts. Willison's November 10 post states Carbon is "available to everyone else" through the API stack his plugin targets—without publishing a separate Google press release we could find that day.

The GitHub release is minimal: one line tying 0.36 to Gemini 4 Carbon as llm -m gemini-4-carbon. The substance lives in Willison's hands-on notes: pelican SVG tests at three thinking levels and a Three.js city stomp demo routed through Google's Antigravity IDE.

Install and first commands

If you already use LLM for OpenAI or Anthropic models, the upgrade path matches prior plugin bumps we covered in LLM 0.37:

llm install -U llm
llm install -U llm-gemini
llm keys set gemini
llm models list | grep carbon
llm -m gemini-4-carbon "Summarize export-control news in five bullets"

Set thinking effort when you want to trade latency for depth (names paraphrase Willison's low/medium/high pelican runs):

llm -m gemini-4-carbon -o thinking_level high "Draft a threat model for this architecture"

Every prompt still logs to LLM's local SQLite database, which makes Carbon evals reproducible—same pattern as weight-space programming experiments Willison reran from published logs.

A terminal-style gear diagram illustrating Gemini 4 Carbon access through the LLM CLI plugin for developers

Pricing: intro window and the December 1 step

Willison quotes Carbon at $2/$10 per million tokens at launch—the same list band as GPT-6.1 Sol and Claude Sonnet 5.5 in his comparison—and says Google scheduled a doubling to $4/$20 on December 1, matching Opus 5.5 pricing.

Google's October announcement already warned that intro pricing would rise after an introductory period; Willison pins a calendar date aggregators had not uniformly repeated. For finance teams:

• Budget evals before December 1 if you need Carbon at Sonnet-tier inference cost.
• Pin eval harnesses so you can compare post-step-up bills without confounding prompt changes.
• Cross-check against frontier model comparison tables—Carbon's independent Artificial Analysis score of 59 is Google-cited, not independently reproduced by most teams yet.

Dual cost dials illustrating the December 1 Carbon API step-up on input and output bills

Thinking levels and what Willison tested

Carbon exposes low, medium, and high thinking efforts in the plugin path. Default is medium.

Willison's whimsical pelican SVG prompt is a useful smoke test: Carbon has shipped strong illustration-style outputs for months, so he stress-tested Antigravity IDE with a heavier prompt—OpenStreetMap-grounded Three.js animation across New York boroughs—after trying a similar task on Claude Fable 5.2 the prior day.

That is not a benchmark. It is evidence that Carbon is reachable from agentic IDEs and the LLM CLI on the same day—relevant if you route loop-style agent harnesses across vendors.

CLI access vs Vertex AI (do not conflate them)

Social posts on November 10 conflated "Carbon is live" with Vertex GA. They are different surfaces:

Our Vertex claimed-vs-verified post still stands: public SKU groups named Argon, not Carbon, on the day Willison shipped 0.36. Update your internal runbooks:

• Shell hackers and notebook users: try llm-gemini 0.36 today.
• GCP production: wait for an official model ID on Google's models documentation before cutover.

How Carbon fits the Gemini 4 family

Context from Google's October materials and explainx.ai coverage:

• Gemini 4 Carbon launch — defender-first story and Google-reported benchmarks.
• Gemini 4 Carbon vs Opus vs Astra vs Grok — lab tables and price bands.
• Gemini Robotics 2.5 — separate product line; do not assume Carbon weights power robotics endpoints.

Carbon competes on cyber and long-horizon tasks in Google's narrative—adjacent to Microsoft's MAI-Cyber preview but closed at Google.

Trust and safety shield framing Carbon's defender-first cyber positioning on the API path

Antigravity, Three.js, and why Willison's test matters

Willison's second November 10 test routed Carbon through Google Antigravity IDE with a long OpenStreetMap grounded prompt: a Three.js animation where Yonkers rises as a mech and walks across Manhattan, Queens, and Brooklyn. He first tried a similar creative task on Claude Fable 5.2 the day before, then compared Carbon's ability to produce a standalone HTML artifact without external dependencies.

That experiment is not a replacement for FrontierSWE rows. It shows three builder facts:

• Carbon is reachable from GUI IDEs, not only curl-style API calls.
• Geospatial + WebGL prompts stress tool use, libraries, and long outputs—a common failure mode for cheaper models.
• Willison had to nudge the model to embed everything in one HTML file—typical agent iteration, worth logging in LLM's SQLite history for regression.

He also pointed readers to a YouTube demo where Antigravity's /swarm feature reportedly coordinated subagents for a pelican-on-GBike open-world scene. explainx.ai did not verify that video's toolchain on November 10; treat it as secondary creative marketing, not a reproducible benchmark.

Plugin lineage: from Argon 0.35 to Carbon 0.36

If your scripts pinned argon for cost, keep them. Carbon is an opt-in -m switch until you finish evals. Google's October table still shows Argon as the workhorse for many throughput tasks; Carbon targets hard cyber and planning rows in Google's own comparison.

Token economics next to Sonnet and Sol

Willison's price comparison matters for routing:

• At $2/$10, Carbon matches Sonnet 5.5 and GPT-6.1 Sol list bands for a short window.
• After December 1, $4/$20 aligns with Opus 5.5 list pricing in his framing.

Teams running token inflation analysis should log output tokens per task now, then rerun the same harness after the step-up. Carbon's thinking levels can inflate output the same way Fable 5.2 pelican tests did—budget high thinking for incidents only.

Failure modes and support checklist

Before you route production cron jobs to Carbon:

If Carbon refuses benign prompts, compare against Gemini cyber-permissive Argon allowlist paths your enterprise may already use.

What people are asking

Does this replace Gemini 4 Argon in llm-gemini? No. Release 0.35 added gemini-4-argon. Both IDs should coexist; pick per task and price.

Will Carbon appear in Google AI Studio? Likely eventually, but Willison's path is the earliest third-party confirmation of general API access we cited November 10. Watch AI Studio for a selectable Carbon card.

Are pelican demos serious evals? No—they are regression tests for multimodal illustration and tool use. For security posture, pair Carbon trials with cyber benchmark culture and your own harness.

Does intro pricing apply to batch jobs? Google defines billing tiers in Cloud docs; Willison's numbers match the October launch post narrative. Confirm on your Google AI / Cloud billing console before large batch runs.

Enterprise and compliance notes

Quant and banking teams already fight over who may run coding agents—see Goldman Sachs restricting Claude Code. Carbon in a personal llm log is outside firm-controlled gateways unless InfoSec approved the key.

If you are on Google's cyber defender programs, this CLI path may be redundant—you may already have Carbon through governed channels. For everyone else, API keys on laptops raise the same exfiltration questions as any frontier model.

Related on explainx.ai

• Gemini 4 Carbon Vertex access: claimed vs verified
• Gemini 4 Carbon launch and defender gating
• Frontier models compared including Carbon
• LLM 0.37 core CLI changes
• Google TPU and cloud variant roadmap
• Gemini healthcare preview skills
• Semantic caching for LLM apps

Official sources: llm-gemini 0.36 release, Simon Willison announcement, Google Carbon introduction.

Pricing and model IDs are accurate as of November 10, 2026, per Willison's post and Google's October launch materials.