Google has a new number-one AI model, and you can’t use it. Gemini 4 Carbon, announced Wednesday, tops the independent Artificial Analysis leaderboard by a single point, posts record scores for finding, exploiting and patching software bugs, and is going first to a hand-picked group of cyber defenders. Developers, businesses and regular Gemini users get it later, on a date Google hasn’t named.
Key points
- Google calls Gemini 4 Carbon its strongest model, and Artificial Analysis independently ranks it first on its Intelligence Index v5 by one point, 59 to 58.
- Carbon goes first to a subset of cyber defenders through Google’s Fairwind Program, and developers, businesses and consumers get it later on a date Google hasn’t named.
- Its cyber scores, including 88.2% on SEC-bench Pro and 54.8% on ExploitGym, are Google’s own runs of the model evaluated without guardrails.
- Artificial Analysis found Carbon trails Claude Code with Opus 5.5 on coding agents, and its hallucination rate on AA-Omniscience rose to 11% from Argon’s 4%.
Carbon arrives just two weeks after Gemini 4 Argon, which makes it one of the fastest frontier-model turnovers any lab has managed. It also lands in a week when security people are openly bracing for AI-found vulnerabilities to arrive faster than humans can patch them. Google’s pitch is that the best way to survive that is to hand the strongest bug-hunting model to defenders first. Our job is to check how much of that pitch holds up.
What Google actually announced
In a blog post signed by Koray Kavukcuoglu, Google DeepMind’s SVP and Google’s chief AI architect, the company calls Carbon “our strongest model with state-of-the-art cybersecurity and long horizon capabilities.” The headline claims:
- #1 overall on version 5.0 of the Artificial Analysis Intelligence Index, with a score of 59.
- 88.2% on SEC-bench Pro for finding real vulnerabilities, 54.8% on ExploitGym for proving they can be exploited, and 71.0% on Collinear’s CWE-bench for writing fixes. Google notes these were “evaluated without guardrails.”
- Long-running agent work: Google says its teams have seen Carbon “run for days” on multi-step engineering jobs such as root-causing subtle bugs across large codebases.
- WebDev Arena: up 89 Elo points to fourth place, at 1768.
- Price: the same introductory rate as Argon, $2 per million input tokens and $10 per million output tokens, with cached input 95% off. After the intro period it rises to $4 and $20.
Google also passed along some internal anecdotes. It says Carbon more than doubles Argon’s success rate at generating secure code on internal tests. It says the Chrome team found Carbon performed “more than 10X better than another lab’s large frontier model” at writing high-quality patches, without naming the lab. And it says Wiz, the cloud security company Google now owns, sees Carbon leading its web penetration-testing benchmarks.
Who gets it, and who doesn’t
This is the unusual part. Google says it is “actively engaged in the U.S. government’s voluntary process for pre-release model testing” and that, starting this week, Carbon goes to “a subset of cyber defenders.” Access then widens gradually through the Fairwind Program, which Google launched on Sept. 2.
Fairwind is a vetted club. Google’s announcement said it had more than 650 partners spanning governments, critical-infrastructure operators and core technology platforms, and that access is limited to internal security, incident-response and penetration-testing teams using multi-factor authentication. Its earlier toolkit included a cyber-tuned Gemini 3.8 Flash and CodeMender, Google’s automated patching agent. SecurityWeek adds that some Fairwind partners already have exclusive access to cyber capabilities in Argon.
Everyone else waits. Google says it will keep collecting feedback and iterating on guardrails “before making Carbon available to developers, businesses, and consumers via our product surfaces as soon as possible.” Artificial Analysis confirms the model is not publicly available yet and that it tested Carbon ahead of launch.
The Google DeepMind demo, Argon edition
Google hasn’t posted a Carbon video. The closest official footage is this Google DeepMind clip from the Argon launch two weeks ago, showing how the company frames Gemini as a tool for defenders. Treat it as a preview of the workflow, not of Carbon itself.
What the independent scoreboard says
Artificial Analysis, which runs its own evaluations rather than copying lab numbers, published a detailed write-up the same day. It backs the top-line claim, then adds the fine print Google left out.
- The lead is one point. Carbon scores 59 on Intelligence Index v5, against 58 for Anthropic’s Claude Opus 5.5 at maximum effort.
- It wins four of nine evals, leading on HLE-Diamond, Terminal-Bench-Science, AA-Omniscience and AutomationBench-AA.
- It does not win at coding agents. On AA’s Coding Agent Index, Google’s Antigravity CLI running Carbon scores 59, behind Claude Code with Opus 5.5 at 62. Carbon places second on Terminal-Bench 4.0 (64%) and second on FrontierCode v1.1 (51%, against Opus at 56%).
- It trails on office-style agent work. On AA-Briefcase, Carbon scores 1609, a 126-point jump over Argon’s 1483, but still behind Grok 4.7 (1638), Muse Wonder (1659) and Kimi K3.1 Pro (1678).
- It is cheaper to run than its closest rival. AA puts the cost per task at $7.76, versus $10.04 for Opus 5.5 and $6.25 for GPT-6 Astra. Carbon also used about 123,000 output tokens per task, down from Argon’s 173,000.
One wrinkle in AA’s numbers deserves attention. Carbon’s score on AA-Omniscience, a knowledge test that penalizes confident wrong answers, rose to 54 from Argon’s 46, ahead of Opus 5.5 at 48. But its hallucination rate on that test also climbed, from 4% to 11%. That’s still the second-lowest rate AA measured, and miles below the 50% it reports for Opus 5.5 and GPT-6 Astra. It does mean the model got more knowledgeable and a bit more willing to bluff at the same time.
AA also describes the $2/$10 pricing as a 50% launch discount with no confirmed end date. So the real list price of Carbon is $4/$20, and anyone budgeting around the intro rate is guessing how long it lasts.
The cyber numbers, read carefully
The three security benchmarks map neatly onto a defender’s day: find the bug, prove it matters, fix it. SecurityWeek reports that in Google’s comparison Carbon beat GPT-6 Astra, Claude Opus 5.5 and Claude Fable 5.1 on all three. That is a strong showing, but these are Google’s own runs of public benchmarks, published by the company selling the model.
The phrase “evaluated without guardrails” is doing real work too. It means Google measured the raw model, not the filtered version that partners will actually touch. That’s the right way to measure dangerous capability. It also means the 54.8% exploitation score describes what the model can do when nothing is stopping it, which is exactly the number an attacker would care about if the weights or an unguarded endpoint ever leaked.
Our read: a model that can find 88% of the bugs in a hard benchmark and write working exploits for more than half is, by definition, an offensive tool with a defensive marketing plan. Google seems to know this, which is why the rollout looks the way it does. We saw the defender’s side of this race last week with PHP2Shell, when AI-found flaws in PHP turned into a patching scramble. Carbon is the industrial version of that capability.
Safety claims: better, and still self-graded
Google spends a big chunk of the announcement on alignment, and some of the numbers are striking:
- Successful cheating on Terminal-Bench 4.0 fell to 0.0%, with cheating attempts down to 0.4%.
- High-severity misalignment alerts in live internal coding environments dropped by “almost 80%.”
- Unsupported claims fell by about half compared with Argon.
- Overreach fell 26% and under-service fell 29%, meaning fewer cases of the model doing more than asked or quietly doing less.
- Attack success on Gray Swan’s Indirect Prompt Injection benchmark fell to 0.0%, from Argon’s already low 0.7%.
The catch: nearly all of this is internal measurement. “Misalignment alerts” depend on what Google’s monitors flag, and a drop could mean better behavior or blinder monitors. A 0.0% prompt-injection rate covers the attacks Gray Swan evaluated, not the next technique someone invents. These are useful signals, and they still need outside replication, which the limited rollout makes harder.
Why the timing matters
The launch lands in a nervous moment for security teams. Cloudflare CEO Matthew Prince told The New York Times, as quoted in MIT Technology Review‘s daily newsletter on Wednesday: “For the next two years, we’re going to be living in a state where, on average, every week there is a critical, internet-wide vulnerability.”
If that’s even half right, the question is who gets the strongest bug-finders first. Google’s answer is a defenders-first queue, run through a program it controls, with U.S. government testing in the loop. That’s more careful than dropping the model on a public API. It also makes Google the gatekeeper deciding which governments, utilities and platforms get a head start, and that is a lot of power for one company to hold without published criteria for who gets in.
There’s a commercial angle as well. Reuters framed the launch around the cybersecurity focus, and Google’s own post title calls Carbon “our next frontier model” outright (9to5Google has a good rundown of the launch details). A two-week gap between Argon and Carbon signals that Google wants the top slot on every leaderboard and is willing to ship fast to keep it. A one-point lead on a composite index is the kind of lead that disappears with the next Anthropic or OpenAI release.
What to watch next
- A public release date. Google says “as soon as possible.” Watch whether Carbon reaches the Gemini API and Gemini app within weeks or stays partner-only for months.
- A model card or safety report. Argon got a published Safety and Security report. Carbon needs one, including what the U.S. pre-release testing found.
- Independent cyber evals. Third-party runs of SEC-bench Pro, ExploitGym and CWE-bench would show whether Google’s margins hold.
- The real price. When the $2/$10 intro rate ends, Carbon’s cost advantage over Opus 5.5 narrows sharply.
- Fairwind’s membership. Which organizations get Carbon first, and whether Google ever publishes the criteria.
The takeaway
Gemini 4 Carbon looks like a real step up, especially at security work, and Artificial Analysis independently puts it at the top of its index by a nose. It is not the best coding agent on AA’s board, its hallucination rate went up, and almost every safety number comes from Google. The most interesting thing about Carbon may be the rollout: a frontier model treated as too sharp for general release, handed first to defenders by the company that built it. That precedent will matter longer than the leaderboard spot.
Hype in. Signal out.
Image: The entrance of 6 Pancras Square in London, home to Google and Google DeepMind. Photo by Gciriani / Wikimedia Commons, CC BY-SA 4.0; cropped to 16:9.
