Gemini 4 Carbon tops AA Index, goes to cyber defenders first

Google on October 28 announced Gemini 4 Carbon, which takes first place on the Artificial Analysis Intelligence Index v5.0 with a score of 59. Starting this week, it goes only to a subset of cyber defenders. Developers, businesses and consumers get it later, at a rate already set to match Gemini 4 Argon’s introductory $2 per million input tokens and $10 per million output tokens, so moving a workload from Argon to Carbon will not change the per-token price while that introductory rate lasts.

Cached input tokens are 95% off the input price, the same discount Argon gets, according to Google’s announcement. The word “introductory” matters here. Google set Argon’s identical rate to run through November 30, with the price rising after that, and it is unclear whether Carbon’s introductory window ends on the same date.

Who gets it first

Starting this week, Carbon goes to a subset of cyber defenders, and Google will gradually let in more trusted partners through its Fairwind Program. Google also says it is taking part in the U.S. government’s voluntary process for pre-release model testing. For everyone else, the company says it is “continuing to gather feedback and iterate on guardrails before making Carbon available to developers, businesses, and consumers via our product surfaces as soon as possible.”

Argon went the same way. Google announced it on September 30 and rolled it out first to trusted cyber defenders through Fairwind. It opened to the public on October 13, 13 days later, and the Gemini API model page now lists it as stable under gemini-4-argon.

Which scores are whose

Testing Catalog, in a post on Threads, puts Gemini 4 Carbon (High) first on Text Arena with 1528 points. The same post has Carbon second on Agent Arena, behind Opus 5.5, and fourth on WebDev Arena, behind Claude Opus 5.5, GPT-6 Astra and Sonnet 5.5. It also places Carbon on “a new Pareto Frontier on Agent Arena”. Google reports the same fourth place on WebDev Arena, with 1,768 points after an 89-point Elo jump.

SEC-bench Pro, ExploitGym and Collinear’s CWE-bench are external benchmarks, and Google claims the lead on all three, with scores evaluated without guardrails: 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on ExploitGym for exploitation, which defenders use to check whether a flaw can actually be attacked, and 71.0% on CWE-bench for patching. Those are the same guardrails Google says it is still tuning before developers get access.

The rest is Google’s own testing. On internal benchmarks, Carbon more than doubles Argon’s success rate at generating secure code. The Chrome team reported that Carbon did more than 10X better at producing high-quality patches than what Google calls “another lab’s large frontier model”. Wiz, which Google describes as its leading Cloud security platform, sees Carbon leading on benchmarks for web penetration testing. And Google’s teams have watched Carbon run for days on multi-step engineering work such as root-causing and patching subtle bugs across large codebases and low-level systems.

Fewer shortcuts, by Google’s count

On Terminal-Bench 4.0, Carbon’s successful cheating fell to 0.0% and its attempts to cheat to 0.4%, while overall accuracy improved. In live coding with Google’s internal teams, high-severity misalignment alerts dropped by almost 80%. Compared with Argon, Carbon makes roughly half as many unsupported claims in Google’s internal testing, and the company says it cut overreach by 26% and under-service, where the model does less than the task called for, by 29%.

Argon already led Gray Swan’s Indirect Prompt Injection benchmark, with a 0.7% attack success rate. Carbon scored 0.0%, “resisting every evaluated attack attempt,” Google says.