Google's Gemini 4 Carbon Tops AI Rankings, but Cyber Defenders Get It First

Google has released Gemini 4 Carbon, a new frontier AI model that the company says is its strongest yet for cybersecurity and long-running engineering tasks. The model was announced on October 28, 2026, by Koray Kavukcuoglu, senior vice president of Google DeepMind and Google's chief AI architect, and it is going first to a small group of vetted cyber defenders rather than to the public.

The launch matters because Carbon arrives just two weeks after Gemini 4 Argon, and it immediately took first place on the newly revised Artificial Analysis Intelligence Index with a score of 59. Developers, businesses and consumers will have to wait. Google has not given a date for wider access, saying only that it will come "as soon as possible" after more guardrail testing.

Key facts at a glance

• Who and when: Google DeepMind announced Gemini 4 Carbon on October 28, 2026, two weeks after Gemini 4 Argon.
• Access: A subset of cyber defenders gets it this week, then more partners in phases through Google's Fairwind Program, which has more than 650 partners.
• Benchmarks (Google-reported, guardrails off): 88.2% on SEC-bench Pro for finding flaws, 54.8% on ExploitGym for exploitation and 71.0% on Collinear's CWE-bench for patching.
• Independent ranking: 59 on the Artificial Analysis Intelligence Index v5, the top score among the models the firm tracks.
• Price: An introductory $2 per million input tokens and $10 per million output tokens, rising later to $4 and $20.

How Google got here

Google has been releasing Gemini 4 models at an unusually fast pace. Argon launched in mid-October and was itself restricted to selected users at first. Carbon builds on Argon's safety stack, which Google describes as a mix of model training, real-time misuse defenses, prompt-injection resistance and monitoring of the model's chain of thought.

The restricted rollout reflects a problem the whole industry now faces. A model that is very good at finding and fixing software vulnerabilities can, in the wrong hands, also help someone exploit them. Google says it is taking part in the U.S. government's voluntary process for testing frontier models before release, and it is using Fairwind to decide who gets early access.

Fairwind already gives some partners access to Argon, which can be paired with CodeMender, Google's code security agent. According to the program's own rules, partners must pass background checks, use phishing-resistant multi-factor authentication, limit access to internal security, incident response or penetration testing teams, and never share or resell access. Priority goes to governments, national cyber authorities, critical infrastructure operators and large technology platforms.

What Carbon can do on security tasks

Security is the headline capability. Google frames Carbon's skills around the full defensive cycle: detect a vulnerability, validate whether it can be exploited, then fix the root cause. The three external benchmarks map to those steps, and Google says Carbon leads all three.

On SEC-bench Pro, which tests whether a model can find real bugs in real software, Carbon scored 88.2%. Google's own chart puts OpenAI's GPT-6 Astra second at 85.4% and Argon at 83.4%. On ExploitGym, an exploitation benchmark that defenders use to judge which bugs are urgent, Carbon scored 54.8%. On Collinear's CWE-bench, which measures whether a model can turn a finding into a working code fix, it reached 71.0%.

Google also shared results from its own teams. It says Carbon more than doubled Argon's success rate at generating secure code on internal tests. The Chrome team reported that Carbon did more than 10 times better than "another lab's large frontier model" at producing high-quality patches, though Google did not name that rival. Google added that Wiz, its cloud security business, sees Carbon leading on web penetration testing benchmarks.

An important caveat: Google says these cyber benchmarks were run without guardrails, and all three figures are Google's own reporting. Real-world performance for a defender using the guarded, production version may differ.

Long-horizon coding and the independent scorecard

Carbon is built for long jobs. Google says its engineers have watched the model work for days on multi-step tasks, such as tracking down and patching subtle bugs across large codebases and low-level systems. On WebDev Arena, a public ranking for web development output, Carbon gained 89 Elo points to reach fourth place with a score of 1768.

Artificial Analysis, the independent benchmarking firm whose index Google cites, confirmed the overall lead on its version 5 index. The firm says Carbon holds the top score on four of the nine evaluations in the index: HLE-Diamond, Terminal-Bench-Science, AA-Omniscience and AutomationBench-AA.

The same firm is clear that Carbon does not lead everywhere. On its Coding Agent Index, Carbon scored 59 using Google's Antigravity CLI, three points behind Anthropic's Claude Code running Claude Opus 5.5 at 62. On AA-Briefcase, a test of agentic office work, Carbon reached 1609 Elo, a 126-point improvement over Argon but still behind several rivals.

Figures from Artificial Analysis at standard pricing.

Safety claims: cheating, honesty and prompt injection

Google put unusual weight on alignment numbers. It says Carbon cut successful cheating on Terminal-Bench 4.0 to 0.0%, with attempts to cheat dropping to 0.4%. In live coding work with Google's own teams, high-severity misalignment alerts fell by almost 80%, the company says.

On honesty, Google says Carbon makes about half as many unsupported claims as Argon. It also says the model now flags missing evidence or blocked actions in its output instead of guessing. Google reports that Carbon reduced overreach by 26% and under-service by 29%, meaning it was less likely to go beyond the scope of a task and less likely to leave work unfinished.

Prompt injection is a sharp test for any model that reads outside content. Prompt injection means hiding instructions in a web page or document so that the AI follows them instead of the user. On Gray Swan's Indirect Prompt Injection benchmark, Google says Carbon had a 0.0% attack success rate, compared with 0.7% for Argon.

What it means for you

For developers in the US, UK, Canada and Australia, the short answer is that you cannot use Carbon yet. It is not in the Gemini API, and Artificial Analysis lists no public API. If you are planning budgets, Google's introductory price matches Argon at $2 per million input tokens and $10 per million output tokens, with cached input 95% cheaper. The standard price afterwards is $4 and $20, and Google has not said when the introductory period ends.

For security teams, the relevant path is Fairwind. Organizations that already qualify for Argon access are the likeliest early users. Expect strict conditions: phishing-resistant MFA, named internal teams and no sharing.

For everyday users, Carbon is not in the Gemini app yet. The practical effect today is indirect: if vendors like Chrome's security team use it to find and fix bugs faster, that should show up as quicker patches in the software you already run.

The other side: what critics and rivals point out

Not everyone sees the launch as a full release. Artificial Analysis notes that Carbon, like Argon before it, is "not yet publicly available" and is going only to selected users. That makes many of the claims hard for outsiders to check.

The firm also flags a trade-off in its own data. Carbon's accuracy on AA-Omniscience rose 10 points over Argon to 58%, but its hallucination rate also climbed, from 4% to 11%. That is still the second lowest of any model the firm tracks, well below the 50% it measured for both Claude Opus 5.5 and GPT-6 Astra, but it is a step back from Argon.

Speed is another question. Artificial Analysis lists a time to first token of more than 97 seconds for the high-reasoning setting, which suits long background jobs better than chat. And on coding agents and office work, rival models from Anthropic, OpenAI and others still score higher.

What happens next

Google says it will add more trusted partners in phases through Fairwind, then bring Carbon to developers, businesses and consumers through its products. There are no dates for any of those steps.

Open questions include when the U.S. government's voluntary pre-release testing ends, when the introductory pricing expires, and whether the guarded production model keeps the cyber scores Google measured without guardrails.

Conclusion

Gemini 4 Carbon is a significant step for Google on paper: first place on a major independent index, top marks on three security benchmarks and cleaner safety numbers than its predecessor. But it is a limited release, and most of its security claims come from Google itself.

Takeaways:

1. Do not plan on Carbon access yet unless your organization qualifies for Google's Fairwind Program; there is no public API date.
2. Budget with both prices in mind: $2/$10 per million tokens at launch, $4/$20 afterwards.
3. Treat the cyber scores as vendor claims until outside testers can run the guarded model.
4. Compare on your own tasks: Carbon leads overall reasoning, but rivals still score higher on coding agents and office work.
5. Keep patching quickly: faster AI-assisted bug finding means security updates will keep arriving at a fast pace.

FAQ

Can I use Gemini 4 Carbon in the Gemini app?

Not yet. Google says consumer access will come later, after guardrail testing.

Who can apply for early access?

Organizations can apply through Google's Fairwind Program, which prioritizes governments, critical infrastructure operators and major tech platforms and runs background checks on applicants.

Is Carbon better than Claude Opus 5.5?

It tops Artificial Analysis's overall Intelligence Index, but trails Claude Opus 5.5 on the firm's Coding Agent Index, 59 to 62, and costs about 23% less per index task at standard pricing.