Google has announced Gemini 4 Carbon, its new frontier model, just two weeks after Gemini 4 Argon. Google calls it its strongest model yet, with the headline gains in cybersecurity and long-running coding work. It also now sits at #1 on the Artificial Analysis Intelligence Index. The catch is the same one Argon had at launch: almost nobody can use it yet. Carbon goes first to a small group of cyber defenders, and Google has not given a date for developers.
Key points
- Carbon scores 59 on the Artificial Analysis Intelligence Index v5, the top score, ahead of Claude Opus 5.5 and GPT-6 Astra.
- Google reports state-of-the-art cyber results: 88.2% on SEC-bench Pro (finding vulnerabilities), 54.8% on ExploitGym (exploiting them) and 71.0% on CWE-bench (patching them).
- It is built for long agentic runs. Google says internal teams have seen it work for days on multi-step engineering problems.
- Access starts with a subset of cyber defenders, then trusted partners through Google’s Fairwind Program. Developers, businesses and consumers come later, with no date.
- Introductory API price matches Argon at $2 per million input tokens and $10 per million output tokens, rising to $4 and $20 after an introductory period Google has not defined.
What Google shipped
Carbon is the second Gemini 4 model, positioned above Argon rather than as the cheaper Flash-style tier many developers were waiting for. Google says it improves on Argon across coding, agentic tasks, scientific work, full-stack web development and multimodal understanding. On WebDev Arena it jumped 89 Elo points to 1768, fourth place.
According to Artificial Analysis, Carbon has a 1M-token context window and accepts text, image, video and speech input, with text output. It leads four of the nine evaluations in the index, including Humanity’s Last Exam and Terminal-Bench Science, but it does not lead everywhere.
The cybersecurity pitch
Google frames Carbon around the full defense loop: find a bug, confirm it is exploitable, then fix the root cause. Its reported numbers cover each step:
- Finding: 88.2% on SEC-bench Pro, which tests discovery of real-world software vulnerabilities.
- Validating: 54.8% on ExploitGym, which tests turning a vulnerability into a working exploit so teams can prioritize.
- Patching: 71.0% on Collinear’s CWE-bench, which tests turning findings into working fixes.
Google adds internal claims that are harder to check. It says Carbon is more than twice as successful as Argon at generating secure code, and that the Chrome team saw it produce high-quality patches more than 10 times better than “another lab’s large frontier model”, which Google did not name. Google also notes the external benchmarks were run without guardrails. That is the honest way to measure raw capability, and it is also why Google is gating the release: a model that is good at exploitation is useful to attackers too.
Long-horizon coding, and where it still trails
Carbon is pitched for sustained agentic work, such as root-causing subtle bugs across large codebases and low-level systems. Independent numbers back that up, with a caveat. On the Artificial Analysis Coding Agent Index, Carbon running in Antigravity CLI scores 59, three points behind Claude Code with Claude Opus 5.5 at 62. It ranks second on Terminal-Bench 4.0 (64%) and on FrontierCode. For Google, which has historically lagged in agentic coding, that is a real gain. For teams deciding today, it means Claude still holds the coding-agent lead on that index.
On agentic knowledge work, Artificial Analysis measured a 126-point Elo jump over Argon on its AA-Briefcase test, but Carbon still trails Grok 4.7, Meta’s Muse Wonder and Kimi K3.1 Pro there.
Safety and honesty claims
Google spends a large part of the announcement on behavior, not only scores:
- Less cheating: successful cheating on Terminal-Bench 4.0 fell to 0.0%, with cheat attempts at 0.4%. Google says high-severity misalignment alerts in its live coding environments dropped by almost 80%.
- Fewer made-up claims: about half as many unsupported claims as Argon in internal testing.
- Better scope control: 26% less overreach and 29% less under-delivery on multi-step plans.
- Prompt injection: 0.0% attack success on Gray Swan’s indirect prompt injection benchmark, versus 0.7% for Argon. Ars Technica reports Opus 5.5 at 1% and GPT-6 Astra at 8.5% on the same test.
One number points the other way. Artificial Analysis found Carbon’s hallucination rate on AA-Omniscience rose from 4% for Argon to 11%, even as accuracy climbed 10 points to 58%. That is still the second-lowest rate it has measured, far below the roughly 50% it reports for Opus 5.5 and GPT-6 Astra, but it is a reminder that “fewer unsupported claims” in Google’s own tests is not the whole picture.
Pricing and access
When it opens up, Carbon will cost the same as Argon: $2 per million input tokens and $10 per million output tokens at the introductory rate, with cached input 95% cheaper. After the introductory period, the price doubles to $4 and $20. Ars Technica notes that Argon’s discount runs to the end of November, while Google declined to give an end date for Carbon’s.
At standard pricing, Artificial Analysis puts Carbon at $7.76 per index task, about 23% cheaper than Opus 5.5 at max effort but about 1.2 times GPT-6 Astra. It also used 29% fewer output tokens per task than Opus 5.5.
Google says it is working within the U.S. government’s voluntary pre-release testing process. Ars Technica expects Carbon to reach AI Ultra subscribers and the Gemini API first, possibly within a couple of weeks if it follows Argon’s path, but Google itself has made no timeline promise.
What it means for builders
- You cannot build on it yet. Unless you are a cyber defense team in the Fairwind Program, plan around Argon or other models for now.
- Budget for the real price. Model your costs on $4 and $20 per million tokens, not the discount, since Google has not said when it ends.
- Security teams should watch closely. If the find, validate and patch numbers hold up outside Google, Carbon could become a default for automated vulnerability triage and patch drafting.
- Coding agents: test, don’t switch on headlines. Independent data still puts Claude Opus 5.5 slightly ahead for coding agents. Run your own tasks when access opens.
- Treat Google’s internal numbers as claims. The Chrome comparison names no rival, and several safety figures come only from Google’s own environments.
What to watch
Ars Technica points out that every frontier model now scores within a few points of the others, and that Carbon beats Argon by slim margins, which raises the question of whether it is a new model or a post-training upgrade. The questions that matter next are when developers get access, when the introductory price ends, and whether independent testers see the same cyber and honesty gains once the model leaves Google’s controlled rollout.
