Gemini 4 Carbon: #1 on the index, but you can't use it yet

Gemini 4 Argon had been open to developers for two weeks when Google announced the next one. On October 28, an announcement signed by Google DeepMind SVP Koray Kavukcuoglu introduced Gemini 4 Carbon, calling it Google’s “strongest model,” with cybersecurity and long-horizon tasks as its strengths.

On the newly revised Intelligence Index from Artificial Analysis, an independent evaluator, Carbon scores 59 and ranks first, one point ahead of Claude Opus 5.5.

But you can’t use it. It isn’t on the Gemini API model list, and the announcement says developers, businesses and consumers will all have to wait. It is following Argon’s path: a small group of cyber defenders gets it first.

I went through every row of the eval table in Google’s announcement, then checked it against Artificial Analysis’s model pages, the public CWE-bench leaderboard, the Fairwind Program page and the Gemini API docs. The short version: Carbon’s lead is real, but it is very uneven. On one long-context test it leads by 24 points and on two others by more than 10, yet on the composite indexes it wins by 0.2 to 1 point, and on two rows of Google’s own table it loses.

Who can get Carbon right now?

Figure 1: The rollout paragraph in the announcement (source: Google Blog)

Here is what the announcement says. Google is taking a “deliberate” approach to rollout and is engaged in the U.S. government’s voluntary process for pre-release model testing. Starting the week of the announcement, Carbon goes to “a subset” of cyber defenders, and access will then be phased in for more trusted partners through the Fairwind Program. Developers, businesses and consumers come after Google gathers feedback and iterates on guardrails, “as soon as possible,” with no date.

So the first wave isn’t necessarily all of Fairwind. It is “a subset” of defenders.

What is Fairwind? I opened the official Fairwind Program page. It says Google currently works with more than 650 partners worldwide and prioritizes governments and national cyber authorities, critical infrastructure operators (healthcare, telecoms, energy, finance) and core technology platforms. It also accepts applications from academic labs focused on defensive benchmarking. To apply, you contact your Google Cloud account team.

The conditions are fairly specific. Google runs background checks on applicants. Participating organizations may give access only to internal cybersecurity, incident-response or penetration-testing teams, and must track employee access and use. They need user-level authentication and phishing-resistant MFA. They may not share, redistribute or sell access. The permitted dual-use work is authorized threat simulation, reverse engineering and malware analysis; creating malware is not allowed.

One thing doesn’t line up. The page as I read it on October 31 mentions only Gemini 4 Argon. It says some partners get exclusive access to Argon, and Carbon isn’t mentioned at all. The announcement says access starts “this week,” but the program page hasn’t caught up. That doesn’t mean Google got something wrong; more likely the page just hasn’t been updated. But if you’re an organization thinking of applying, Argon is the only model whose terms you can currently read in official documentation.

Google’s own scorecard: it loses 2 of 17

The announcement text mentions only a few numbers. The full comparison is in an image, which I captured. It is the most informative part of the whole announcement.

Figure 2: The eval table from Google’s announcement. Blue cells are rows where Carbon is best, grey cells are rows where another model is best (source: Google Blog)

The table has 17 benchmarks in eight groups: general capabilities, agentic coding, computer use, knowledge work, multimodal understanding, long context, science and math, and cybersecurity. There are four comparison models: Google’s own Argon, OpenAI’s GPT-6 Astra, and Anthropic’s Claude Opus 5.5 and Claude Fable 5.1.

Carbon is best on 15. On the other 2, Google shades someone else’s top score in grey:

• FrontierSWE 2: GPT-6 Astra 65.5%, Opus 5.5 62.3%, Carbon 61.2%. Carbon is third.
• OSWorld-2.1 offline subset: Opus 5.5 87.2%, Carbon 81.5%, Astra 80.9%.

A company marking its own losses in its launch post earns some credit from me. Both rows happen to be about letting an agent do the work itself: Google files FrontierSWE 2 under agentic coding and OSWorld under computer use. If you mainly run coding agents, those two rows deserve more of your attention than the AA index.

Under the word “first,” the size of the lead varies a lot. I compared Carbon with the strongest non-Google model in each row, worked out the gap, and lined up 10 rows.

Figure 3: Carbon versus the strongest non-Google model on each benchmark. Scores from Google’s eval table; gaps computed for this article

A few leads are large. GraphWalks is graph traversal over 256K to 1M tokens of context; Carbon scores 96.2%, the best non-Google model is Astra at 71.8%, and even Google’s own Argon gets only 84.2%. ExploitGym measures actually exploiting vulnerabilities: Carbon 54.8%, Astra 42.4%, Opus 5.5 34.5%. AutomationBench, Zapier’s knowledge-work test, has Carbon at 53.9% against Opus 5.5 at 42.5%. RiemannBench and Blueprint-Bench 2 add leads of 8.0 and 7.4 points.

A few are close to a tie. AA Intelligence Index 59 to 58, Vals Index 70.4% to 70.2%, SWE-sweep 9.6% to 9.5%. Chartography and Terminal-Bench-Science are only 1.5 points apart. Gaps like these can flip with a different harness or a different sample.

I also checked one small detail in the table. It lists Opus 5.5 at 42.5% on AutomationBench. When this site wrote the Argon piece, the figure from Anthropic’s own announcement was 40.0%, and Astra was 41.4% in both. Two companies publish numbers for the same model on the same test that differ by 2.5 points, and I couldn’t find out why. Below the table is a link to the evaluation methodology, which is a PDF; I wasn’t able to read its contents this time, so I can’t confirm how thinking levels were set or whether rival scores are self-reported or run by Google. The announcement text does say one thing: the external benchmarks were evaluated “without guardrails.”

First place at 59, on a freshly rebuilt index

Carbon’s “#1” claim rests on the Artificial Analysis Intelligence Index, the most widely cited third-party composite score right now. I opened its Carbon model page.

Figure 4: Summary of the Carbon page on Artificial Analysis (source: Artificial Analysis)

The page lists Gemini 4 Carbon (High) with an Intelligence Index of 59, ranked 1st of 57 models. On the index page, the top three are Carbon 59, Opus 5.5 (Max) 58 and Opus 5.5 (Xhigh) 57. Google’s table also lists GPT-6 Astra at 57 and Claude Fable 5.1 at 49; I read those two from Google’s table, not from the text of the index page.

One thing needs flagging: the index has changed. The page labels it v5.0, made up of nine evaluations in four categories (knowledge work, coding, science, general), each weighted 25%. WinBuzzer reported that the rebuild happened the day before Carbon’s announcement and leans mostly on private tests. I couldn’t find the revision date on the index page, so treat that as their report.

Argon shows the effect most clearly. When this site wrote about Argon arriving in Antigravity on October 14, Artificial Analysis had Argon at 53 and Opus 5.5 at 58. On v5.0, Argon is at 50 and Opus 5.5 is still 58. Argon didn’t get worse; the ruler changed. So Carbon’s 59 can’t be compared with any AA score you saw before. It only compares with other models on the same version.

Artificial Analysis also measures cost and speed. I put the three model pages side by side.

Figure 5: Cost and speed for three models on Artificial Analysis (data: the Carbon, Argon and Opus 5.5 model pages, checked October 31)

Three things to keep in mind when reading it.

First, Artificial Analysis prices Carbon at $4 per million input tokens and $20 per million output, which is the post-introductory price, not the $2 and $10 in the announcement.

Second, Carbon is verbose. It produced 200M output tokens running the index, against a class median of 71M and 110M for Argon. Oddly, Carbon used nearly twice Argon’s tokens at the same unit price, yet its cost per task is only 8 cents higher. I can’t explain that gap from the public pages. It may have to do with input tokens or caching, but the page doesn’t break it down, and I’d rather not guess.

Third, Carbon’s time to first token is 103.5 seconds, against 49.1 for Argon. If you use it interactively, that is a long wait before it starts talking.

As an aside, the page notes the speed figures are “based on Google’s API,” with only one API provider available. My inference is that Artificial Analysis got test access before the announcement, which fits the pre-release testing the announcement describes, but the page doesn’t say so.

One more number pulls against Google’s framing. The announcement says that in internal testing, Carbon makes roughly half as many unsupported claims as Argon. Yet on Artificial Analysis’s AA-Omniscience knowledge test, Carbon’s hallucination rate is 11% versus 4% for Argon. The two don’t measure the same thing: AA’s hallucination rate is how often a model answers wrongly when it should have said it didn’t know, while Google’s figure is unsupported statements in internal testing. And 11% is still the second-lowest rate on that board; Carbon’s Omniscience Index of 54 is the top score. I don’t read this as a contradiction, but it’s a reminder that “makes fewer things up than Argon” comes with conditions.

The three security tests: the biggest lead is in exploitation

The announcement highlights three security benchmarks: SEC-bench Pro for finding vulnerabilities at 88.2%, ExploitGym for exploiting them at 54.8%, and CWE-bench for patching them at 71.0%. Carbon is top on all three.

CWE-bench has a public leaderboard, maintained by Collinear, so I could check it myself.

Figure 6: CWE-bench v1 leaderboard, top 10, updated October 28 (source: CWE-bench)

The leaderboard says it uses 120 held-out tasks covering 73 CWE weakness types. Each model gets four rollouts per task at high reasoning, with a one-hour limit per rollout. The table is sorted by pass@1, the single-attempt success rate.

Carbon’s pass@1 is 71%. Second place is a three-way tie at 68%: Grok 4.7, Argon and GPT-6 Astra. Opus 5.5 is at 67%. That matches Google’s announcement.

Look at pass@4, though, meaning at least one success in four tries, and Carbon is at 81%, Grok 4.7 is also at 81%, and Opus 5.5 is at 79%. Once retries are allowed, the lead mostly disappears. On judge-panel pass@4 it’s Carbon 83%, Grok 4.7 82%, Opus 5.5 81%.

The cost column is more interesting. Carbon’s is blank; the leaderboard says it has no cost figure yet. Argon costs $6.63 per rollout, while Opus 5.5 in Claude Code costs $0.79. If Carbon’s cost is close to Argon’s, then four Opus 5.5 runs cost less than half of one Carbon run, and the pass@4 gap is only 2 points. That is my own estimate, and it assumes Carbon costs about what Argon does; we’ll know when the leaderboard fills in the number.

Also remember each model runs in a different harness: Carbon and Argon in Antigravity, Opus 5.5 in Claude Code, Grok in opencode. What’s being measured is model plus tooling.

Honestly, of the three, ExploitGym is the one I care about most. On finding and patching vulnerabilities, Carbon leads by only about 3 points. On actually exploiting them, it’s 12.4 points ahead of Astra and 20.3 ahead of Opus 5.5. That is exactly the capability an attacker wants most, and it explains why Google isn’t putting this on the API straight away.

The other safety numbers in the announcement come from Google’s internal testing. Here they are as stated:

• More than 2x the success rate of Argon at generating secure code. The Chrome team reported it performed more than 10x better than “another lab’s large frontier model” at producing high-quality patches, without naming the lab.
• On Terminal-Bench 4.0, successful cheating dropped to 0.0%, with attempts to cheat at 0.4%.
• In live coding environments with Google’s own teams, high-severity misalignment alerts dropped by almost 80%.
• Overreach down 26%, under-service down 29%.
• On Gray Swan’s indirect prompt injection benchmark, Argon’s attack success rate was 0.7%; Carbon’s is 0.0%.

The safety stack is the same as Argon’s: model training, real-time misuse defenses, prompt-injection resilience and chain-of-thought monitoring. The announcement doesn’t attach a separate safety report for Carbon; it points to Argon’s.

Pricing: the announcement quotes the introductory rate

Figure 7: The pricing paragraph in the announcement; the superscript 1 after “introductory price” links to a footnote (source: Google Blog)

Carbon launches at the same price as Argon: $2 per million input tokens and $10 per million output, with cached input 95% cheaper. The footnote gives the price after the introductory period: $4 input and $20 output, again the same as Argon.

The question is how long the introductory period lasts. For Argon, the answer is on the Gemini API pricing page: $2 and $10 through November 30, doubling from December 1, with caching going from $0.10 to $0.20, and no free tier. For Carbon, neither the announcement nor the pricing page gives a date.

That leaves a question I can’t answer. If Carbon’s introductory period is tied to Argon’s and Carbon only opens up after November 30, ordinary developers may never see the introductory price at all. If it gets its own introductory period counted from launch day, that’s a different story. Until Google clarifies, I’d budget at $4 and $20.

How does it compare with Opus 5.5? On Artificial Analysis’s cost per task, even at the post-introductory price, Carbon’s $7.76 is cheaper than Opus 5.5’s $10.04. AA measured that on the same set of tasks, which makes it more reliable than comparing unit prices alone.

When will developers get it?

Google hasn’t given a date. The only reference point is Argon.

Figure 8: Timeline compiled for this article (data: Google Blog, Gemini API changelog, pricing page; Fairwind launch date from this site’s Argon piece)

Argon was announced on September 30 and reached the Gemini API on October 13, a gap of 13 days. The announcement says Carbon builds “on Gemini 4 Argon, which was launched two weeks ago.” That “two weeks ago” most likely refers to the October 13 general availability rather than the September 30 announcement, since September 30 to October 28 is four weeks.

Will Carbon take about two weeks too? I don’t know. When Argon was announced, Google also said it would gather feedback and adjust guardrails before opening up “as soon as possible,” and that turned out to be 13 days. Carbon’s wording is nearly the same; the difference is that the first recipients are only “a subset” of defenders.

On October 31 I opened the Gemini API models page. The Gemini 4 section has one row.

Figure 9: The Gemini 4 section of the Gemini API models page; I was served the Traditional Chinese interface, checked October 31 (source: Gemini API docs)

The newest changelog entry is Computer Use reaching general availability on October 30, which has nothing to do with Carbon. On the night of the announcement, Nerd’s Chalk called the model list API itself and got the same result: of 60 models, the only Gemini 4 entry was models/gemini-4-argon.

So Carbon doesn’t even have a published model ID yet.

My take

I think Carbon really is stronger than Argon, and much stronger in a few areas: long context, exploiting and patching vulnerabilities, and Zapier-style knowledge work. Google’s own table, Artificial Analysis and CWE-bench all point the same way, which is more convincing than one vendor’s claims.

But whether it’s “the strongest model” depends on what you use it for. It wins the composite index by 1 point. On FrontierSWE 2 and OSWorld, the rows most relevant to coding agents, it loses on Google’s own table. On CWE-bench it ties Grok 4.7 once retries are allowed. If you’re running coding agents on Opus 5.5 or Astra today, I don’t see a reason to switch tools for Carbon, and you couldn’t switch anyway.

What interests me more is the release cadence. Google announced two frontier models in four weeks, and both went to cyber defenders first. Carbon’s biggest security lead happens to be in exploitation, so I think the restricted rollout makes more sense this time than it did for Argon.

There isn’t much you can do right now, but what there is, is concrete:

• Developers on the API: Argon is available now, at the introductory price through November 30. Don’t put Carbon in this quarter’s plans, and budget at $4 and $20.
• Organizations eligible for Fairwind: contact your Google Cloud account team, but expect the background checks and usage restrictions to be firm requirements.
• Regular Gemini users: nothing to do but wait for Google’s announcement.

What would change my mind? If Carbon shows up on the API models page with an introductory period counted from its own launch, it becomes one of the best-value top-tier models available to developers. If Google’s methodology document shows rival scores were run under less favorable settings, I’d discount those narrow leads further. If CWE-bench fills in a cost for Carbon close to Opus 5.5’s, I’ll take back the cost estimate above.