Gemini 4 Carbon Takes the Intelligence Lead, With Cyber Defenders First in Line

Google announced Gemini 4 Carbon on October 28 (opens in new tab), two weeks after Argon, with an independently measured lead on Artificial Analysis's new Intelligence Index and substantially stronger results in software security. The company says its internal teams have used Carbon for engineering tasks that run for days, while reducing several kinds of agent misbehavior.

The first users will be selected cyber defenders, starting this week. Google plans to expand access through its Fairwind Program before bringing Carbon to developers, businesses and consumers. This is a frontier-model announcement with a restricted rollout, not a generally available Gemini API release.

The pricing also needs its footnote. Google announces introductory rates of $2 per million input tokens and $10 per million output tokens, but says they will rise to $4 and $20 after the introductory period. Carbon's announcement does not give that period an end date.

What the independent lead actually means

Artificial Analysis confirms Carbon is the new number one (opens in new tab) on its Intelligence Index v5.0. At high reasoning effort it scores 59, ahead of Claude Opus 5.5 at 58 and GPT-6 Astra at 57 in the operator's published comparisons.

That is a broad capability result, not a declaration that Carbon wins every coding task or is the safest model. The index primarily evaluates text-based, English-language capabilities. Its version 5 overhaul (opens in new tab), published October 27, changed the tasks and weights: knowledge work, coding, science and general capabilities each receive a quarter of the weight, and private or held-out evaluations account for 60% overall.

The changes include FrontierCode 2.0, Terminal-Bench-Science, HLE-Diamond and updated Omniscience and CritPt evaluations. Results from the older v4.3 index cannot be compared directly with this new scale. A model's score changing across those versions does not, by itself, mean the underlying model improved or regressed.

The following figures come from Artificial Analysis's current Carbon comparison (opens in new tab). Scores are rounded; higher benchmark scores are better, while lower task cost is better.

Kimi is the operator's unsuffixed model variant. The Opus comparison allows fallback to earlier Opus models on refusals; these are not identical reasoning settings across vendors. Task cost is Artificial Analysis's weighted evaluation cost, including measured token use and caching, at standard rather than introductory pricing.

Carbon's jump from Argon is substantial on both coding tests. But Opus remains ahead on FrontierCode 2.0, and Kimi scores higher on Terminal-Bench 4.0. Carbon and Sol round to the same FrontierCode figure despite a small difference in the underlying measurements.

Stronger coding, without a sweep

Artificial Analysis also tests complete coding-agent systems. Its Carbon analysis (opens in new tab) reports 59 on Coding Agent Index v2.0 for Carbon in Antigravity CLI, against 62 for Claude Code using Opus 5.5 at maximum effort with fallback.

That is a different measurement from the model-level table above. The coding-agent index combines FrontierCode v1.1, Terminal-Bench 4.0 and SWE-Atlas-QnA-AA, while the Intelligence Index uses different harnesses and the newer FrontierCode 2.0. Carbon's native-agent Terminal-Bench result is about 64%, not the 65.2% measured in the Index harness.

There are other losses worth keeping in view. Carbon reaches 1609 Elo on AA-Briefcase, a knowledge-work evaluation, below Opus's 1800 and Sonnet 5.5's 1812. On CritPt's hard physics subset, Carbon scores 63%, against 71.5% for Astra at high effort. On GDP.pdf, Carbon's 28.4% all-pass result trails Muse Wonder Full's 32.6%.

Google's own launch reports a gain of 89 Elo to 1768 on WebDev Arena, placing Carbon fourth. That supports an improvement in web-development output, not a first-place claim. The overall picture is a stronger general-purpose model with particular strengths, not one model replacing every rival.

The cyber results cover finding, exploiting and fixing bugs

Google presents three headline cybersecurity scores, explicitly evaluated without guardrails:

These stages have different jobs. Finding a suspicious code path is not the same as demonstrating exploitability, and producing a patch is not the same as proving it fixes the root cause without breaking the application.

There is useful operator evidence for the patching result. Collinear's CWE-bench leaderboard (opens in new tab) lists Carbon with Antigravity at 71% programmatic pass@1, ahead of Argon, Astra and Grok 4.7 at 68%, and Opus 5.5 at 67%. Carbon reaches 81% at pass@4. The separate judge-panel scores are 71% and 83% respectively.

The current evaluation has 120 held-out audit-and-patch tasks. Each model receives four rollouts per task at high reasoning, with a one-hour limit per rollout. The programmatic checks test whether the vulnerability is blocked and existing functionality still works; an additional judge panel assesses the result. Different agents and harnesses remain part of the comparison, and the operator has not yet published Carbon's average cost per rollout.

The 88.2% SEC-bench Pro and 54.8% ExploitGym figures remain Google-reported results here, rather than independent replications. Their unguarded evaluation conditions also differ from the safeguards Google intends to enforce for users.

Google adds several internal claims: more than twice Argon's success rate at generating secure code, and a Chrome-team result more than ten times better than an unnamed competing frontier model at producing high-quality patches. The announcement does not identify that rival or provide enough experimental detail to turn the latter claim into a reproducible purchasing comparison.

Running for days is a capability claim, not a service guarantee

Google says its teams have seen Carbon persist through dead ends for days while tracing and patching subtle bugs across large codebases and low-level systems. That is significant for agent workflows, where a model has to keep a useful plan, recover from failed approaches and validate its work over many steps.

Google has not published the task budgets or success rates behind those multi-day runs. The independent results offer more concrete evidence of what that persistence accomplishes: strong improvements over Argon, alongside tasks on which Opus, Kimi or Astra still do better.

Artificial Analysis reports that Carbon leads four of the Index's nine evaluations: HLE-Diamond, Terminal-Bench-Science, AutomationBench-AA and AA-Omniscience. Those strengths help explain the composite lead even though Carbon does not top the main software-engineering test.

Alignment gains, with important boundaries

In its launch assessment (opens in new tab), Google says Carbon reduced successful cheating on Terminal-Bench 4.0 to 0.0%, with attempts falling to 0.4%, while improving accuracy. It also reports almost 80% fewer high-severity misalignment alerts in internal live coding environments.

The other reported improvements include roughly halving unsupported claims relative to Argon, reducing overreach by 26% and under-service by 29%, and improving how the model handles ambiguity. These are Google's internal findings. The announcement does not provide the full sample sizes and experimental detail behind every percentage, so they are not estimates of how often a deployed agent will fail.

On Gray Swan's indirect prompt-injection benchmark, Google reports a 0.0% attack-success rate for Carbon, compared with 0.7% for Argon. Zero observed successes in an evaluated attack set is valuable evidence; it is not proof that a model cannot be prompt-injected.

Independent reliability results also resist a simple “everything is safer” reading. Carbon leads the AA-Omniscience reliability index and answers more questions correctly than Argon: 58.3% accuracy versus 48.3%. But its test-specific hallucination metric rises from Argon's 4.3% to 11.4%. Neither percentage is an everyday error rate across all responses. The combination shows why increased knowledge, willingness to answer and unsupported guessing need separate measurements.

Google says Carbon builds on Argon's layered controls, including model training, real-time misuse defenses, prompt-injection resilience and chain-of-thought monitoring. Restricted access is part of that deployment plan, not an optional detail around the benchmark announcement.

The token price has an introductory period

Google's announced rates (opens in new tab) are:

Google says Carbon will launch at Argon's introductory input/output rates. It does not give Carbon's discount an expiry date. Argon's separately documented pricing schedule is not evidence that Carbon shares the same deadline or every billing feature.

For a fixed example of 100 calls, each using 10,000 uncached input tokens and 1,000 billed output tokens, the announced base token cost is $3 at Carbon's introductory rates and $6 afterward. This is arithmetic on one million input tokens and 100,000 output tokens, not a quote for completing a particular job. It excludes caching, tools and any additional billing modifiers that Carbon's eventual service terms may specify.

Artificial Analysis uses undiscounted standard prices for its cost comparisons. Its $7.76 per Intelligence Index task is about 23% below Opus's $10.04, but higher than Astra and substantially higher than Sol. Carbon also uses about 123,000 output tokens per weighted Index task. Those measurements include the operator's actual workload and caching behavior, which is why list rates alone cannot predict the bill.

The operator does not yet publish a public-API output-speed or latency measurement for Carbon. A high benchmark score, a lower token bill and a faster completed task are three different claims.

Who can use it, and what is still unpublished

Google says a subset of cyber defenders will receive access starting this week, followed by more trusted partners through Fairwind (opens in new tab). The program prioritizes governments and organizations important to societal resilience, and participating organizations agree to access controls including user authentication and phishing-resistant multifactor authentication.

Wider developer, business and consumer access is coming later. Google has not supplied a firm public-release date. Carbon is not listed in the public Gemini API model catalog (opens in new tab) or pricing index (opens in new tab) checked on October 28. Its exact public API identifier, detailed context/output limits, quotas and additional processing-tier tariffs therefore should not be inferred from Argon.

Data treatment also depends on the surface. Under the general paid Gemini API terms (opens in new tab), prompts and responses are not used to improve Google's products by default, with separate exceptions for voluntarily shared or Contributor data. In personal Gemini Apps, Keep Activity is on by default for adults (opens in new tab), and Google's privacy guidance (opens in new tab) says that saved activity can be used for model training. Those are current channel policies, not confirmation that Carbon is available in either surface or that private Fairwind contracts use identical terms.

Carbon's launch is substantial because an independent broad-index lead arrives alongside much stronger cyber and coding results than Argon, without a higher announced introductory token rate. The next test is whether those gains survive real workloads and deployment safeguards when access expands. Selected cyber defenders are first in line. Everyone else should treat the scores as a reason to prepare a comparison, not proof that a new public endpoint is ready to swap into production.