Google unveils Gemini 4 Carbon with top AI score and restricted access for cyber defenders

A new leader on the scoreboard, with access limited

Google has announced Gemini 4 Carbon, an artificial intelligence model that scored 59 on Artificial Analysis Intelligence Index v5.0 and recorded strong results in finding, testing and fixing software vulnerabilities. Its first users will be selected cybersecurity defenders, rather than the general public.

The company's Gemini 4 Carbon announcement, dated October 28, 2026, places the model ahead of Claude Opus 5.5 and GPT-6 Astra on that general capability index. The launch follows Gemini 4 Argon by just two weeks, giving Google another flagship model before many users have had much time with its predecessor.

Koray Kavukcuoglu, senior vice president of Google DeepMind and Google's chief AI architect, described the model's central strengths:

Gemini 4 Carbon is our strongest model with state-of-the-art cybersecurity and long horizon capabilities.

Google says its internal teams have watched Carbon work for days on difficult engineering assignments, including tracking down subtle bugs and producing fixes across large software projects. For security teams, the promise is an assistant that can stay with a problem through repeated failed approaches, rather than simply suggest an answer and stop.

Carbon's launch also exposes a practical tension. The ability to discover and exploit software weaknesses can help defenders repair systems, while giving attackers useful capabilities. Google is participating in voluntary United States government testing before release and will expand access gradually through its Fairwind Program.

The most useful picture comes from putting the results together: Carbon leads a broad intelligence index and several security tests, yet trails competitors on some coding tasks. Google's internal reliability improvements also sit alongside an external test in which its rate of invented answers increased compared with Argon.

What the cybersecurity scores measure

Google reports three headline security results: 88.2% on SEC-bench Pro, 54.8% on ExploitGym and 71.0% on Collinear's CWE-bench. Each measures a different part of a defender's job.

SEC-bench Pro tests whether a model can find vulnerabilities in real software. A vulnerability is a weakness that could let someone access information, change a system or disrupt its operation. Google says Carbon leads this evaluation by uncovering complex flaws buried in software.

ExploitGym tests the next step: turning a weakness into a working exploit. An exploit is a method of using a flaw to make a system behave in an unintended way. Security teams use controlled exploitation to check which weaknesses create an immediate danger and deserve repair first.

CWE-bench measures patching, or writing code that fixes the underlying problem. Carbon's 71.0% score puts the focus on completing the repair, rather than merely pointing out suspicious code.

Google says these external cybersecurity benchmarks were run without guardrails, meaning the protective restrictions used to limit a deployed model's actions were not active during those evaluations. Their scores describe performance under those testing conditions; access through Google's products will include its safety controls.

Google also reports more than twice Argon's success rate at generating secure code in internal benchmarks. Its Chrome team says Carbon performed more than 10 times better at producing high quality patches than an unnamed competing laboratory's large frontier model. Those internal secure code findings have not yet been independently reproduced, and Google does not identify the rival model in that comparison.

First place does not mean winning every task

Artificial Analysis gives Carbon 59 points on Intelligence Index v5.0, compared with 58 for Claude Opus 5.5 and 57 for GPT-6 Astra. Carbon therefore leads by one point over Opus and two over Astra, a narrower gap than Google's strongest cybersecurity comparisons.

The index combines nine evaluations, with Carbon leading four: HLE-Diamond, TB-Science, AA-Omniscience and AutomationBench. Artificial Analysis says 60% of the revised index uses private tests, whose questions are kept out of public circulation.

Coding results are more mixed. Carbon paired with Google's Antigravity CLI scores 59 on the Coding Agent Index, while Claude Code paired with Opus 5.5 scores 62. A coding agent combines a model with tools that let it inspect files, run commands and edit software, so the accompanying software matters to the result.

Carbon scores 51% on FrontierCode v1.1, behind Opus at 56%. On FrontierSWE, it reaches 61.2%, compared with 65.5% for GPT-6 Astra, 62.3% for Opus 5.5 and 61.9% for Sonnet 5.5. These comparisons give developers a concrete reason to look at the tasks closest to their own work, alongside the general ranking.

Web development is another area of progress. Google's announcement places Carbon fourth on WebDev Arena with 1,768 Elo points after a gain of 89 points. Elo is a rating system based on comparative performance. Carbon also ranks first in Text Arena at 1,528 and second in Agent Arena, extending its strong showing beyond security work.

Working for days instead of answering once

Google designed Carbon for sustained agent workflows, in which an AI system carries out a sequence of actions toward a goal. In software engineering, that might mean inspecting a project, forming an explanation for a bug, changing code, running tests and revising the fix when those tests fail.

Google's internal teams say Carbon has continued for days on complex assignments involving large codebases and low level systems. The company describes it as able to persist through dead ends, an important feature when the first plausible explanation turns out to be wrong.

Reported specifications list a context window of one million tokens and a maximum output of one million tokens. Tokens are the small pieces of text a model processes. The context window is the amount it can consider at once, including instructions and material supplied for a task.

Carbon reportedly accepts text, images, video and speech, and produces text. Those input types could let a task include a written bug report, a screenshot and a recording of unexpected software behavior within the same workflow.

Performance beyond coding varies. Carbon reaches 1,609 Elo on the AA-Briefcase knowledge work evaluation, up 126 points from Argon, while remaining behind Grok 4.7, Muse Wonder and Kimi K3.1 Pro. It ranks second on the Vals Index and first on its Finance Index and Legal Research Benchmark. The range of results shows why a company's choice may depend on whether it needs software repair, document analysis or another specific job.

Safety tests separate attempts from successful cheating

Google reports a 0.0% successful cheating rate on Terminal-Bench 4.0, with attempted cheating at 0.4%. The two numbers describe different behavior: whether the model tried to take an improper shortcut and whether that attempt succeeded.

Google says Carbon improved its task accuracy while reducing those shortcuts. In live coding work with its own teams, alerts for severe departures from intended behavior fell by almost 80%.

Prompt injection is another focus. This attack places instructions inside material an AI is supposed to read, such as a webpage or file, to redirect it away from the user's task. An assistant examining a project might encounter text telling it to ignore its instructions or disclose information.

Carbon recorded a 0.0% attack success rate in Gray Swan's Indirect Prompt Injection Benchmark. The comparison figures were 0.7% for Argon, 1% for Claude Opus 5.5 and 8.5% for GPT-6 Astra. Google's result means every evaluated attack attempt was resisted in that test.

Google says Carbon combines model training with defenses against misuse during operation, resistance to prompt injection and monitoring of its reasoning process. The initial restricted rollout will let the company collect feedback and adjust those protections as selected defenders use it.

Reliability improves internally, while one external measure worsens

Google says Carbon cut unsupported claims roughly in half compared with Argon in internal testing. It describes a model more likely to explain missing evidence, list unfinished requirements and flag conflicting information before taking action.

Google also reports a 26% reduction in overreach and a 29% reduction in under-service. In everyday terms, it says Carbon is less likely to go beyond the user's instructions and less likely to stop short of the requested work.

Artificial Analysis records a different change on its Omniscience evaluation: Carbon's hallucination rate rises to 11%, from Argon's 4%. A hallucination is an answer that presents invented or incorrect information as fact. Carbon still has the second lowest measured rate in that comparison, while Opus 5.5 and Astra are both at 50%.

Carbon leads the Omniscience evaluation with a score of 54, even with the higher hallucination rate. A model can gain ground by answering more questions correctly while also making more errors when it attempts answers it previously avoided. Google's internal unsupported claim measure and the external hallucination measure use different evaluations, so users have two distinct reliability results to consider.

For a security team, checking the work remains part of the job. A claimed vulnerability needs examination, and a proposed patch needs testing against the software it changes. Google's stated improvements target precisely those moments when an assistant might claim success too early or act outside the requested scope.

Who gets access, and in what order?

Google says a subset of cyber defenders will receive Carbon during the week of its October 28 announcement. Additional trusted partners will gain access gradually through Fairwind, followed by developers, businesses and consumers through Google's products.

The announced sequence is:

• About two weeks before Carbon: Google launched Gemini 4 Argon, which subsequently became available in the Gemini app and AI search mode.
• October 28, 2026: Google published its Carbon announcement and benchmark results.
• The week of October 28: Selected cyber defenders begin receiving access.
• Later stages: Google expands access through Fairwind before wider product availability.

Google is taking part in the United States government's voluntary process for testing models before release. Its announcement gives no date for broad public access or for the end of Carbon's introductory pricing.

AI Ultra subscribers and Gemini API developers have been suggested as possible early customers, but Google's published rollout commitment names the broader groups of developers, businesses and consumers rather than confirming that order.

The decision to start with defenders comes amid growing concern about malicious use of AI. Google's threat researchers have documented groups backed by Iran, North Korea, Russia and China experimenting with Gemini, mostly for research and coding assistance. DeepMind chief Demis Hassabis has described recent AI agent hacks as early warning shots.

What Carbon will cost developers

Carbon's introductory API price is $2 per million input tokens and $10 per million output tokens, matching Argon's launch rate. An API lets developers connect the model to their own software. Input is the material sent to Carbon; output is what it generates.

After the introductory period, the listed prices double to $4 per million input tokens and $20 per million output tokens. A task using one million input tokens and one million output tokens would therefore cost $12 at the introductory rates and $24 at standard rates, before caching or other adjustments.

Google says cached input receives a 95% discount. Caching lets a service reuse material it has already processed, which can reduce the cost of repeatedly supplying the same large document or software project. Applying the discount gives $0.10 per million cached input tokens at the introductory input rate and $0.20 at the standard rate.

Measured spending also depends on how much text a model generates to finish a task. Artificial Analysis lists Carbon at $7.76 per index task, compared with $10.04 for Opus 5.5 and $6.25 for GPT-6 Astra. Carbon uses about 123,000 output tokens per task in that evaluation, 29% fewer than Opus.

Other workloads can produce a different pattern. Vals records Carbon generating 64% more output tokens than Argon, mostly on finance, tax and legal tasks. Developers budgeting for Carbon will therefore need to consider both its token prices and the amount of work it performs for each assignment.

Key Points

• Gemini 4 Carbon leads Artificial Analysis Intelligence Index v5.0 with 59 points, ahead of Opus 5.5 at 58 and GPT-6 Astra at 57.
• Google reports security scores of 88.2% for finding vulnerabilities, 54.8% for exploitation and 71.0% for patching.
• Carbon trails competing model and tool combinations on several coding evaluations.
• Google reports no successful cheating on Terminal-Bench 4.0 and no successful attacks in the evaluated Gray Swan prompt injection test.
• Internal unsupported claims fell roughly by half, while an external hallucination measure rose from Argon's 4% to Carbon's 11%.
• Selected cyber defenders receive access first, with expansion through Fairwind before wider availability.
• Introductory API prices are $2 per million input tokens and $10 per million output tokens, rising later to $4 and $20.