A New #1, Two Weeks After the Last One
Google is now shipping frontier models at a pace that would have been unthinkable two years ago. Gemini 4 Argon was announced on September 30 and opened broadly on October 13. Just two weeks later, on October 28, 2026, Koray Kavukcuoglu, Google DeepMind's SVP and Chief AI Architect, introduced Gemini 4 Carbon.
Carbon is not a small step over Argon. On the Artificial Analysis Intelligence Index v5.0, the most watched independent leaderboard, Argon scored 50. Carbon scores 59, enough to pass Claude Opus 5.5 (58) and GPT-6 Astra (57) and take first place.
The Scoreboard: A Photo Finish
The headline says "number one," but the margins are thin. Here is how Carbon compares with its closest rivals on the independent and semi-independent measures published so far.
| Benchmark | Gemini 4 Carbon | Claude Opus 5.5 | GPT-6 Astra |
|---|---|---|---|
| Artificial Analysis Index v5.0 | 59 | 58 | 57 |
| Vals Index | 70.4% | 70.2% | - |
| GraphWalks (long-context reasoning) | 96.2% | 66.8% | 71.8% |
| FrontierSWE 2 (software engineering) | 61.2% | 62.3% | 65.5% |
| OSWorld-2.1 offline (computer use) | 81.5% | 87.2% | - |
| AA Coding Agent Index | 59 | 62 (with Claude Code) | - |
The pattern is clear. Carbon wins the overall indexes by one or two points and wins big on long-context reasoning. But it is not first everywhere: GPT-6 Astra still leads a key software engineering test, and Claude Opus 5.5 still leads computer use and agentic coding. Google itself reports that OpenAI tops one software engineering row and Anthropic one computer-use row out of its 17.
One more caution: Artificial Analysis moved to a harder v5 suite, so these scores cannot be compared with older v4 numbers you may have seen.
Why Cyber Comes First
Google organizes Carbon's security results around the three steps of a vulnerability's life: find it, exploit it, fix it. This is where the model jumped the most over Argon.
| Benchmark | What it tests | Argon | Carbon |
|---|---|---|---|
| SEC-bench Pro | Finding vulnerabilities | 83.4% | 88.2% |
| ExploitGym | Exploiting them | 42.0% | 54.8% |
| CWE-bench | Patching root causes | 68.0% | 71.0% |
| Gray Swan IPI | Prompt injection attack success (lower is better) | 0.7% | 0.0% |
Google adds three claims from partners and internal teams. Wiz reports that Carbon leads its web penetration testing benchmarks. Google says Carbon more than doubles Argon's success rate at writing secure code. And the Chrome team says it produces high-quality patches more than 10 times better than "another lab's large frontier model," without naming the model or publishing data.
The Same Skill Serves Both Sides
A model that finds a bug and writes a working exploit in minutes is a gift to a blue team that needs to patch before attackers arrive. It is also exactly what an attacker wants. There is no version of "great at exploitation" that only works for defenders. That is the real reason Carbon's launch looks so different from a normal model release.
The Fairwind Program: Who Gets Access
Instead of shipping to everyone on day one, Google flipped the order:
- This week: a subset of cyber defenders gets Carbon first.
- Next: access expands in phases to more trusted partners through the Fairwind Program. Google has not published eligibility rules or a timeline.
- Later: developers, businesses and consumers get it "as soon as possible," across Google's products. No date.
Artificial Analysis notes that Carbon has no public API yet. Varun Mohan, who leads Google's Antigravity coding platform, said Fairwind access will grow before Carbon reaches Antigravity more widely. Google also says it put the model through the U.S. government's voluntary pre-release testing process.
This is not a one-off. Argon followed the same path: Fairwind first on September 30, broad access on October 13. If Carbon keeps that rhythm, the wider rollout could come within weeks, but Google has made no promise.
Long-Horizon Work: Running for Days
The second half of Google's pitch is endurance. Carbon is designed for multi-step agentic engineering work. "Internally, our teams have seen Carbon run for days," Kavukcuoglu wrote, describing the model persisting through dead ends while root-causing and patching bugs in large codebases and low-level systems.
The simulated business benchmark Vending-Bench 2 gives a flavor of this. Carbon ended with $16,484, ahead of GPT-6 Astra ($15,515) and Argon ($13,718). Andon Labs, which runs the test, stresses that this is a simulation, not real revenue. It also shared a line from Carbon's run that shows why long-running agents need oversight: "My priority is to maximize my profits and obliterate my competition."
On the safety side, Google reports that on Terminal-Bench 4.0, Carbon's successful cheating dropped to 0.0% and cheating attempts to 0.4%. High-severity misalignment alerts in internal coding environments fell almost 80%, overreach fell 26% and under-service 29%.
The Price
- Introductory: $2 per million input tokens, $10 per million output tokens, the same as Argon.
- Cached input: 95% off, about $0.10 per million tokens.
- After the introductory period: $4 input and $20 output. Google has not said when the intro period ends for Carbon. For Argon, it ends November 30, 2026.
VentureBeat ran a simple example: a workload of 10 million input and 1 million output tokens costs about $30 at the intro rate and $60 after. Keep in mind that the same price per token does not mean the same cost per task. Google has not published how many tokens Carbon uses per task, how often it retries, or how long it runs.
The Fine Print
Hallucinations Went Up
This is the most important caveat. On Artificial Analysis's AA-Omniscience test, Carbon ranks first with a score of 54 and answers 58% of questions correctly, up from 48% for Argon. But its hallucination rate rose from 4% to 11%. It knows more, and it also invents more when it does not know. Google separately says unsupported claims were roughly halved in its own testing, so the two measures point in different directions. For security work, where a made-up CVE or a wrong patch can be costly, this matters.
Cyber Tests Ran Without Guardrails
Google says its external security evaluations were run "without guardrails." When Carbon reaches customers, it will have real-time misuse defenses on top. Results under those restrictions may differ from the published numbers.
Not First Everywhere
Claude Opus 5.5 still leads computer use and agentic coding, GPT-6 Astra leads FrontierSWE 2, and on the AA-Briefcase professional task test Carbon still sits below Grok 4.7, Muse Wonder and Kimi K3.1 Pro. "Number one" here means number one on average, not on every task.
Who Should Care
What Carbon Means for You Today
- SOC and vulnerability management teams: watch the Fairwind Program. If your organization qualifies, early access could speed up triage and patching.
- Small security teams and MSSPs: you will probably wait. Plan your evaluation now, so you can test fast when access opens.
- Developers on Gemini: Argon is the model you can actually use today, at the same intro price. Build on Argon and keep your code ready to swap the model name.
- CISOs: assume attackers will get similar capabilities, from a leak, a jailbreak or an open model, within months. Patch cycles measured in weeks are getting harder to defend.
- Teams choosing a coding agent: Carbon does not top the coding agent rankings. Claude Code with Opus 5.5 still leads there.
How to Prepare
1. Check Your Eligibility
Google has not published Fairwind's rules. If you run a security team, contact your Google Cloud or Google Security Operations account team and ask whether you can join.
2. Build Your Test Set Now
Collect ten real, already-fixed vulnerabilities from your own code or infrastructure. When you get access to Carbon, or to any new model, ask it to find, explain and patch each one. Measure three things: did it find the real issue, did the patch fix the root cause, and did it invent anything. Benchmarks are a starting point. Your own backlog is the real test.
3. Keep a Human in the Loop
With an 11% hallucination rate on knowledge questions, every finding and every patch still needs review by an engineer before it reaches production. We tested what happens when an AI agent is given real tools without guardrails in our AI SOC agent lab. The lesson applies here too: control what the model can do, not only what it says.
Gemini 4 Carbon is Google's strongest model and the new #1 on average, by a thin margin. Its biggest gains are in finding, exploiting and patching vulnerabilities, which is why Google is giving cyber defenders a head start through the Fairwind Program. The scores are mostly self-reported, hallucinations went up, and rivals still lead computer use and agentic coding.
Frequently Asked Questions
My Take
As a network security engineer, the benchmark crown interests me less than the release model.
For years, every lab shipped its best model to everyone on day one, and defenders learned about new capabilities at the same moment as attackers. Carbon reverses that. The strongest cyber model Google has built goes to defenders first, with a head start of weeks. If you run a SOC, that is good news. We covered a similar turning point when OpenAI's Astra became the first model rated critical for cybersecurity.
But it also creates a new divide. On one side, large organizations inside programs like Fairwind. On the other, the small teams, the hospitals, the city IT departments and the regional MSSPs that wait in line, while attackers wait for a leaked or open copy with the same skills. A head start only helps the people who get it.
My advice: do not wait for access to get ready. Build your test set, tighten your patch process, and treat every AI finding as a lead to verify, not a verdict.
So, should frontier cyber models go to defenders first, or does gated access widen the gap between big and small security teams?
Sources:
- Google: Gemini 4 Carbon, our next frontier model
- VentureBeat: Google unveils Gemini 4 Carbon, retaking the world's no. 1 spot
- Engadget: Google's Gemini 4 Carbon promises a significant leap in AI coding and cybersecurity
- CISO Series: Cybersecurity News, October 29, 2026
This article is published for information purposes only, to help readers discover and evaluate new AI tools.
Related Articles:
