Number One, Behind a Gate: What Google's Gemini 4 Carbon Measures and What It Doesn't

On Wednesday, 28 October 2026, Google announced Gemini 4 Carbon, which it calls “our strongest model with state-of-the-art cybersecurity and long horizon capabilities.” The post is signed by Koray Kavukcuoglu, SVP at Google DeepMind and Google’s chief AI architect. It comes two weeks after Gemini 4 Argon became available to developers through the Gemini API on 13 October. Argon itself had been shown to cyber defenders on 30 September, a rollout this blog covered at the time.

Carbon follows the same pattern, only faster. Starting this week it goes to “a subset of cyber defenders” and will widen gradually to trusted partners through Google’s Fairwind Program. Developers, businesses and consumers get it “as soon as possible”, and Google gives no date. The model had circulated for weeks under its internal codename: Business Insider reported in early October that Google staff were testing it, and an anonymous checkpoint later showed up on LM Arena.

The headline number

Google’s main claim is that Carbon ranks #1 on version 5.0 of the Artificial Analysis Intelligence Index, with a score of 59. Artificial Analysis (AA) is an independent benchmarking firm, and its own model page confirms the ranking: Carbon (High reasoning mode) is first of 57 models. Press coverage puts Claude Opus 5.5 one point behind at 58, with GPT-6 Astra at 57. On a nine-test composite, that one-point gap is within noise. It is still the first time in months that a Google model has led the index outright.

AA’s write-up adds detail Google’s post leaves out:

Carbon leads on four of the nine evaluations, including Humanity’s Last Exam (Diamond), Terminal-Bench Science and AA’s own knowledge-and-hallucination test, AA-Omniscience.
On AA’s Coding Agent Index, which runs models inside their native coding harness, Carbon in Google’s Antigravity CLI scores 59. Claude Code with Opus 5.5 at max effort scores 62. That puts Carbon second, three points behind, and AA notes that coding agents are where “Google has historically underperformed.” It also scores 64% on Terminal-Bench 4.0, again second.
On AA-Omniscience, accuracy rose 10 points over Argon to 58%. The hallucination rate also rose, from 4% to 11%. That is still the second-lowest of any model AA tracks, behind only Argon, but the direction is worth noting: the model knows more and makes things up more often.

The cyber numbers

The capabilities that explain the gated release are in security. Google reports three external results, all measured without guardrails:

Benchmark	What it tests	Carbon
SEC-bench Pro	Finding vulnerabilities	88.2%
ExploitGym	Building working exploits	54.8%
CWE-bench (Collinear)	Producing correct patches	71.0%

For comparison, Argon scored 68.0% on CWE-bench v1 at launch, tied with GPT-6 Astra. Carbon’s 71.0% is a gain of about three points, not a leap. The exploitation score matters more. A model that turns more than half of the ExploitGym targets into working exploits is the kind of tool vendors keep away from an open API. That reasoning also sits behind Anthropic’s and OpenAI’s own staged releases this autumn.

Google adds internal claims that cannot be checked from outside: a “more than 2x uplift” over Argon in generating secure code; a Chrome team result in which Carbon did “more than 10X better than another lab’s large frontier model” at writing high-quality patches, with the other lab not named; and a statement from Wiz, which Google acquired this year, that Carbon leads its web penetration-testing benchmarks, with no numbers given.

The safety claims

Google says Carbon uses the same layered safeguards as Argon: training-time refusals, real-time misuse detection, prompt-injection resistance and chain-of-thought monitoring. It cites three results:

Gray Swan prompt-injection benchmark: 0.0% attack success, down from Argon’s 0.7%.
Terminal-Bench 4.0: successful cheating, such as tampering with tests instead of solving the task, fell to 0.0%, with cheating attempts at 0.4%.
Internal live coding: “high-severity misalignment alerts dropped by almost 80%.”

These are welcome numbers, but the post does not give sample sizes, and a 0.0% on a fixed attack set says nothing about attacks that are not in it. Google also says it is taking part in the U.S. government’s voluntary pre-release testing process. It does not say what that testing found.

What a developer should note

The practical facts, as far as they are published:

Price: the same introductory rate as Argon, $2 per million input tokens and $10 per million output, with cached input 95% off. The standard rate afterwards is $4 / $20, the same as Opus 5.5. Google has not said when the introductory period ends.
Context: AA lists a 1-million-token context window and text, image, speech and video input.
Cost per task: on AA’s index runs, Carbon cost $7.76 per task. Opus 5.5 at max effort cost $10.04, about 23% more, and GPT-6 Astra cost $6.25. Carbon used 29% fewer output tokens than Opus 5.5, yet AA still rates it “very verbose” against the field.
Latency: this is the weak spot. AA measured a time to first token of about 98 seconds on Google’s API, against a median of about 3 seconds. Output speed, once tokens start, is an average 85 tokens per second. Early LM Arena testers had already called the model “incredibly slow.” For long-running agent jobs a minute and a half of thinking may not matter. For anything interactive, it rules Carbon out in its current form.

Why it matters

Three points stand out.

Release cadence. Google shipped Argon to developers on 13 October and announced its successor fifteen days later. Model generations are now measured in weeks, so tooling, evals and prompts tuned to one model have a short shelf life. Teams that pin a model version and rerun their own evals on each release will cope better than teams that chase leaderboards.

“Released” keeps meaning less. For the second time in a month, Google’s strongest model exists, has a price, and tops a leaderboard, yet almost nobody can call it. Defender-first access is now standard practice across the frontier labs. When you read a launch post, check the availability section first.

The race is close enough that harnesses decide it. On the composite index Carbon leads by one point. On the coding-agent index it trails by three. Which model “wins” depends on the task, the reasoning effort and the agent wrapped around it. For most engineering teams, the useful question is not which model is best but which model-and-harness pair works on their own codebase at an acceptable latency and cost.

Open questions

When will Carbon reach the Gemini API and Vertex AI, and under what model ID? Will developers get Carbon’s cyber capabilities, or a guarded variant?
Will the higher hallucination rate show up in production, especially in agentic workflows that act on what the model asserts?
Is the 98-second time to first token inherent to the High reasoning mode, or a capacity limit of an early, restricted deployment?
Google published no model card or safety report specific to Carbon. The post links Argon’s safety report.

Carbon looks like a real step forward for Google, especially in coding agents, where it has lagged. Most of the evidence still comes from Google itself, the independent data shows real costs in latency and hallucination, and for now only a small group of defenders can test any of it.