Google ships Gemini 4 Carbon with a top Artificial Analysis score of 59 and 88.2% on vulnerability discovery, but only a first group of cyber defenders gets access

The source. The primary material is Google's own blog post, Gemini 4 Carbon: our next frontier model, published on blog.google on October 28, 2026 and credited to Koray Kavukcuoglu, SVP of Google DeepMind and Chief AI Architect at Google. Every score, price, percentage and benchmark name below is taken from that page. No figures come from secondary coverage, and nothing the page does not state has been filled in. Independent replication, regional availability, API rate limits, SLAs and data-retention terms are not on the page and are therefore absent here.

What it is. Google defines Carbon as its strongest model, built around cybersecurity and long-horizon capability. It ranks first on the freshly updated Artificial Analysis Intelligence Index v5.0 with a score of 59. Artificial Analysis is a third-party evaluator, but this post only gives the rank and the headline number, not the category breakdown, so 59 works better as a horizontal coordinate than as a capability spec sheet. It follows Gemini 4 Argon, released two weeks earlier; Google's own phrasing is that Carbon shows the pace at which it is pushing the frontier forward. Two frontier models in two months is the real signal here: the cadence of iteration has itself become a competitive weapon.

The cybersecurity section is the centre of gravity. Three external benchmarks, all of which Google states were evaluated without guardrails: SEC-bench Pro for finding real vulnerabilities comes in at 88.2%, which the company calls state-of-the-art; ExploitGym, used to judge which findings are actually exploitable and therefore worth fixing first, comes in at 54.8%; and Collinear's CWE-bench, which turns a validated finding into a working code fix, reaches 71.0%. The three numbers map onto discovery, validation and remediation, the three stages of the defence lifecycle, rather than collapsing into one vague security score. That decomposition is more useful than a total, because it tells you which stage still needs people. Google adds two results that are not on public benchmarks: the success rate for generating secure code is more than double Argon's, and the Chrome team reports that Carbon performed more than ten times better than another lab's large frontier model when generating high-quality patches. Cloud security vendor Wiz says Carbon leads on web penetration-testing benchmarks, a core capability for its Scan for Good initiative.

Long-horizon work. Google says internal teams have watched Carbon run for days, persisting through dead ends to tackle tasks like root-causing and patching subtle bugs across large codebases and low-level systems. That claim cannot be verified from outside, but it is consistent with the positioning: not a question-and-answer tool, but something that treats a multistep engineering problem as a project worth tens of hours. The full-stack web side has a comparable number. On WebDev Arena, Carbon jumps 89 elo points to land at number four with 1768. Number four, not number one, and Google does not hide it. That is arguably more informative than a perfect score, because it shows that on a leaderboard driven by human preference votes, the strongest coding capability is not the same thing as the most likeable output.

Pricing. Carbon opens at Argon's introductory rates: $2 per million input tokens, $10 per million output tokens, and cached input billed at 95% off the input price. A footnote is explicit that after the introductory period the price becomes $4 per million input tokens and $20 per million output tokens. That two-stage structure deserves its own paragraph. It is a low-price entry that reverts to a standard rate, which is not the same shape as the long-term pricing OpenAI set on October 26, when it put GPT-6.1 Terra's input price at $1 and cached input at $0.05. Anyone who models unit economics on the introductory number and treats it as permanent will find out in six months that the spreadsheet was wrong, and wrong in the optimistic direction.

The most interesting part of the launch is not a number, it is what the company did not do. Carbon is not generally available. This week a subset of cyber defenders gets it, access then widens gradually to additional trusted partners through the Fairwind Program, and Google says it will keep gathering feedback and iterating on guardrails before bringing Carbon to developers, businesses and consumers through its product surfaces. Google also says it is actively engaged in the US government's voluntary pre-release model testing process. Read those two sentences together and the picture is clear: a model with state-of-the-art cybersecurity results is being handed to defenders first rather than packaged into an API anyone can call. That differs from selling your strongest model on day one, and it rests on one judgement: the diffusion rate of offensive and defensive capability is more dangerous than the capability itself.

Alignment and honesty. This is the most concrete self-disclosure in the post. Carbon builds on Argon's layered security stack: model training, real-time misuse defences, prompt-injection resilience and chain-of-thought monitoring. Four quantified outcomes: on Terminal-Bench 4.0, successful cheating drops to 0.0% with attempts down to 0.4%, while overall accuracy improves; in live internal coding environments, high-severity misalignment alerts fall by almost 80%; unsupported claims drop by roughly half compared with Argon; and overreach falls 26% while under-service falls 29%. On Gray Swan's indirect prompt-injection benchmark, Argon's attack success rate was 0.7% and Carbon's is 0.0%, which Google describes as resisting every evaluated attack attempt. One caveat is in order: 0.0% is a result on one benchmark against one set of attack samples, and it is not immunity to prompt injection. Designing a system on the assumption that 0.0% is a safety guarantee would be a misreading.

How to read the numbers. First, Google states that the external benchmarks were run without guardrails, which measures ceiling capability rather than what you will see when you call an API. Second, Artificial Analysis is third-party but only the rank and headline score are published here, with no category breakdown, so cross-vendor comparisons still deserve care. Third, the Chrome tenfold figure and the Wiz lead are customer-side statements with no published test method or sample, which makes them directional evidence at best. Fourth and most practical: the model is not open, so nobody outside can reproduce any of these numbers. That leaves exactly one useful thing to do today, which is to write the published pricing and benchmarks into your plan with a clear note that they are vendor-reported, then test it against your own messiest real tasks the day access actually opens. Setting expectations at maximum while a model is still closed is the most reliable way to be disappointed three months later.