Google DeepMind launched Gemini 4 Carbon two weeks after Argon, positioning it as state of the art for cybersecurity and long-horizon tasks. The model tops the Artificial Analysis Intelligence Index v5 with a score of 59 and leads Text Arena at 1528 Elo. Initial access goes only to trusted cyber defenders through the Fairwind Program, with wider developer access promised as soon as possible. For business, this creates a split launch where capability claims are public but hands-on testing remains restricted.
Benchmark scores and staged access terms
Google reports 88.2% on SEC-bench Pro for vulnerability finding, 54.8% on ExploitGym for exploitation and 71.0% on CWE-bench for patching. Artificial Analysis credits Carbon with leads in four of nine index evaluations: HLE-Diamond, TB-Science, AA-Omniscience and AutomationBench. The model offers a 1M-token context window with 1M maximum output, accepting text, image, video and speech and returning text. Pricing is listed at $4/$20 per million input and output tokens, with a 50% launch discount without a stated end date and cached input at $0.20.
Carbon was measured at $7.76 per index task, compared with $10.04 for Opus 5.5 and $6.25 for GPT-6 Astra, using 123k output tokens per task, 29% fewer than Opus. On knowledge work it reached 1609 Elo on AA-Briefcase, up 126 points from Argon, while still trailing Grok 4.7, Muse Wonder and Kimi K3.1 Pro at 1678. It ranks second on the Vals Index and first on the Finance Index and Legal Research Benchmark, producing 64% more output tokens than Argon, mostly on finance, tax and legal tasks. In arenas it holds second place in Agent Arena at $1.80 median cost per task and fourth in Code Arena WebDev at 1768.
Coding results place Carbon at 59 on the Coding Agent Index when run in Antigravity CLI, against 62 for Claude Code with Opus 5.5. It scores 51% on FrontierCode v1.1 versus 56% for Opus, and 61.2% on FrontierSWE behind GPT-6 Astra at 65.5, Opus 5.5 at 62.3 and Sonnet 5.5 at 61.9. At the same time it sets a narrow lead of 9.6% on SWE-sweep and ranks first on Vending-Bench 2 and Blueprint-Bench 2, tying the human baseline for 3D spatial understanding on the latter. Google also reports cheating on Terminal-Bench 4.0 falling to 0.0%, attempts down to 0.4%, unsupported claims down about two times versus Argon, overreach down 26% and under-service down 29%.
What staged release means for enterprise AI
For security teams, Carbon promises a specialized tool covering finding, exploitation testing and patching in one model, backed by measurable scores rather than general claims. Organizations already working with Google on defense programs can test detection and remediation workflows earlier, while others must wait for broader developer availability. Small firms without trusted-defender status face a delay in direct evaluation, whereas large enterprises with existing security partnerships can start scoping pilot tasks. The practical difference is timing of access, not absence of alternatives.
Several limits require verification before procurement decisions. The hallucination rate rose from 4% for Argon to 11%, still second lowest measured and ahead of Opus 5.5 and Astra at 50%, but users have raised concern about hallucination in cyber use. Coding-agent scores were obtained in Antigravity CLI, so performance in other harnesses remains untested. Cost comparisons also need care, since list prices omit factors such as long-context surcharges and token volume differences. Buyers should ask which harness, discount terms and evaluation setup sit behind any vendor comparison.
The marker to watch is the date when Fairwind-only access converts into general developer availability and whether independent scores hold outside Google-selected tasks. A second signal is placement against Opus 5.5 and GPT-6 Astra on coding and agent benchmarks once Carbon runs in third-party harnesses. If both access widens and results persist, security automation vendors will face pressure to integrate the model.
