Google announced Gemini 4 Carbon, "our strongest model with state-of-the-art cybersecurity and long horizon capabilities." Sundar Pichai introduced it as the next frontier model, two weeks after Gemini 4 Argon: "Carbon shows the pace at which we're pushing the frontier." It ranks first on the recently updated v5.0 of the Artificial Analysis Intelligence Index, at 59.
Access and price
Carbon is not generally available. Starting this week it goes to a subset of cyber defenders, and Google will phase in more trusted partners through its Fairwind Program before making it available to developers, businesses and consumers "as soon as possible." Google says it is taking part in the U.S. government's voluntary process for pre-release model testing. The introductory price matches Argon's: $2 per million input tokens and $10 per million output tokens, with cached input tokens 95% cheaper.
The benchmark table
Google's comparison table for Gemini 4 Carbon, from the announcement.
In Google's table Carbon scores highest on 15 of 17 rows. The two it does not lead are FrontierSWE 2, where GPT-6 Astra scores 65.5% against Carbon's 61.2%, and OSWorld 2.1 on the offline subset, where Claude Opus 5.5 scores 87.2% against 81.5%.
- Index scores: Carbon 59 on the AA Index v5.0, against 50 for Argon, 57 for GPT-6 Astra, 58 for Opus 5.5 and 49 for Claude Fable 5.1. On the Vals Index v2.2 it scores 70.4%, narrowly above Opus 5.5 at 70.2% and Argon at 69.2%.
- Agentic coding: Terminal-Bench 4.0 (AA) 65.2% against 59.6% for Opus 5.5 and 59.1% for Astra, and SWE-sweep 9.6% against 4.3% for Argon and 9.5% for Astra.
- Computer use and knowledge work: Agents' Last Exam v1.1 at 77.4% against Astra's 73.1%, AutomationBench at 53.9% against 42.5% for Opus 5.5, and Vending-Bench 2 with a bank balance of $16,484 against $15,515 for Astra and $9,235 for Opus 5.5.
- Long context and science: GraphWalks (256K to 1M tokens, BFS F1) at 96.2%, against 84.2% for Argon and 71.8% for Astra. RiemannBench at 80.0% against 76.0% for Argon, and Terminal-Bench-Science 0.1 at 64.8% against 52.9% for Argon.
- Multimodal: Chartography at 72.5% and Blueprint-Bench 2 at 58.6%, ahead of the others on both.
Against Argon, Carbon gains 9 points on the AA Index, 12 on GraphWalks, 12 on Terminal-Bench-Science and about 13 on ExploitGym. On WebDev Arena, Google says Carbon jumps 89 Elo points to fourth place at 1769.
Cybersecurity
SEC-bench Pro, pass@1, from Google's announcement.
Google reports state-of-the-art results across the defense lifecycle, evaluated without guardrails:
- Finding vulnerabilities: 88.2% on SEC-bench Pro, ahead of GPT-6 Astra at 85.4%, Argon at 83.4% and GPT-6.1 Terra at 83.3%.
- Exploiting them: 54.8% on ExploitGym, against 42.0% for Argon, 42.4% for Astra and 34.5% for Opus 5.5.
- Patching: 71.0% on Collinear's CWE-bench, against 68.0% for both Argon and Astra and 67.0% for Opus 5.5.
Google also gives results from its own teams and partners. On internal benchmarks Carbon more than doubles Argon's success rate at generating secure code, the Chrome team reports it performed more than 10 times better than another lab's large frontier model at generating high-quality patches, and Wiz says Carbon leads on web penetration testing benchmarks. These are Google's reports and have not been independently checked.
Safety and alignment
Carbon uses the same safety stack as Argon (model training, real-time misuse defenses, prompt-injection resilience and chain-of-thought monitoring), with further training on high-pressure tasks. Google reports:
- Cheating: successful cheating on Terminal-Bench 4.0 down to 0.0%, with attempts at 0.4%, while accuracy rose.
- Misalignment: high-severity misalignment alerts down almost 80% in live coding with Google's internal teams.
- Honesty: unsupported claims cut by about 2x compared with Argon.
- Scope: overreach down 26% and under-service down 29%.
Gray Swan indirect prompt injection (IPI), attack success rate at 15 attempts, lower is better, from Google's announcement.
On Gray Swan's indirect prompt injection benchmark, Carbon's attack success rate at 15 attempts is 0.0%, "resisting every evaluated attack attempt," down from Argon's 0.7%, which previously led the benchmark. Claude Opus 5.5 and Claude Fable 5.1 are both at 1.0%, GPT-6 Astra at 8.5%, and the open models run from 15.9% for Muse Spark 1.3 to 52.7% for Kimi K3.
All benchmark figures here are Google's own. For another lab's gated cyber rollout, see OpenAI's pacing of GPT-6 Astra.