Google has introduced Gemini 4 Carbon, a new artificial intelligence model that it says now sits atop the independent Artificial Analysis ranking with 59 points. The company is not releasing it broadly: only a small group of cybersecurity specialists will get access for now, and developers, businesses and the general public have been given no confirmed timeline.
- Key Point: Carbon scored 59 on Artificial Analysis version 5.0, ahead of Anthropic’s Claude Opus 5.5 at 58 and OpenAI’s GPT-6 Astra at 57, while Google’s previous Argon model reached 50.
- Key Point: Google says Carbon leads three public security benchmarks, with 88.2% on SEC-bench Pro, 54.8% on ExploitGym and 71.0% on CWE-bench.
- Key Point: Access will expand in stages through the Fairwind program, which counts more than 650 partners, requires background checks and bars sharing or reselling access.
- Key Point: When it reaches developers, introductory pricing will be USD 2 per million input tokens and USD 10 per million output tokens, later rising to USD 4 and USD 20.
Security benchmarks and a crowded leaderboard
Koray Kavukcuoglu, senior vice president at Google DeepMind and the company’s chief AI architect, announced the model and highlighted its security-testing results. The three public benchmarks Google cites measure different things: finding flaws in real programs, determining whether a flaw can actually be exploited, and whether the model can repair it. Carbon’s 88.2% on SEC-bench Pro, 54.8% on ExploitGym and 71.0% on CWE-bench are the figures behind Google’s claim of leadership in offensive and defensive security work.
On Google’s own comparison table, Carbon wins 15 of 17 tests. The Artificial Analysis placement puts it one point above Claude Opus 5.5 and two above GPT-6 Astra. The model follows Argon, which was unveiled on September 30 for cybersecurity partners and opened more widely on October 13; Carbon arrives 15 days after that expansion. Google has not published a technical report or disclosed the model’s parameter count.
Gated rollout through Fairwind
Google said it will grant access this week to what it describes as a subset of cyber defenders, then widen availability in phases to additional trusted partners under the Fairwind program. That initiative requires background verification and prohibits members from sharing or reselling access. Everyone else is left without a date: the company said it will offer Carbon to developers, enterprises and consumers as soon as possible, after collecting feedback and adjusting the model’s safeguards. Google is also taking part in the U.S. government’s voluntary process for pre-release model testing.
Pricing has been set for the eventual developer release, with an introductory rate of USD 2 per million input tokens and USD 10 per million output tokens, before moving to USD 4 and USD 20. Google did not say when the introductory period ends; Argon’s equivalent window closes on November 30.
Carbon can work for days to find and fix subtle bugs in large codebases.
That description comes from observations by Google’s internal teams, which also reported that the Chrome team found Carbon produced higher-quality fixes with more than a 10-fold advantage over a model from another lab. Google did not identify the rival or publish the underlying comparison data.
Mixed results beneath the headline numbers
The picture is less uniform than the top-line ranking suggests. Independent testing showed Carbon improving markedly over Argon in coding and knowledge work, but trailing several competitors on professional tasks, and producing more hallucinations than Argon on a factual-data test. OpenAI retains an edge on a software-engineering benchmark and Anthropic on one measuring computer use.
Google also reported behavioral gains: severe misalignment alerts fell by almost 80% across its internal teams, and in a prompt-injection test bed, where attackers hide instructions inside content the model reads, the attack success rate was 0.0%. Those are the company’s own measurements. Google further noted that its external cybersecurity evaluations were run without safeguards in place, which means the published scores do not establish that customers will see the same results once commercial restrictions are applied.
The staged release reflects a calculation now common at the frontier: models with strong offensive-security capabilities are being treated as controlled instruments rather than products. Carbon’s benchmark lead gives Google a marketing win, but the absence of a technical report, a parameter count and a public date leaves the most consequential questions open. What matters next is whether the safeguards Google is still tuning preserve the performance it is advertising, and whether Fairwind partners validate the security claims outside Google’s own test harness.