Two months after Gemini 4 Argon, Google has shipped another Gemini 4. On October 28, Koray Kavukcuoglu, Google's SVP of DeepMind and Chief AI Architect, announced in the official announcement that Gemini 4 Carbon is "our strongest model," aimed not at general chat but at cybersecurity defense and long-horizon engineering tasks. The name Carbon points at carbon fiber composites, the hardest structural form of the element.

What makes this announcement unusual is that it works as two documents at once: a scorecard and a limited-availability notice. And the most interesting part of the scorecard is who did the scoring.

The top spot is real, and it is not self-awarded

The hardest single number is a score of 59 on version 5.0 of the Artificial Analysis Intelligence Index, which puts Carbon in first place. Google's announcement says so, and so does the third-party evaluator's own leaderboard page, where Carbon is followed by Claude Opus 5.5 at 58 and GPT-6 Astra at 57. MarkTechPost's comparison table records the same three figures: Carbon 59, Opus 5.5 58, Astra 57.

On this one dimension, at least, nobody is marking their own homework.

Three cybersecurity wins, measured by the family

Carbon's story is a complete defense lifecycle: find the vulnerability, validate whether it is exploitable, then fix the root cause. The three numbers are 88.2% on SEC-bench Pro, 54.8% on ExploitGym, and 71.0% on CWE-bench, all of which Google calls state of the art.

The comparison figures come from that same published table: on ExploitGym, GPT-6 Astra scores 42.4%, Claude Opus 5.5 scores 34.5%, and Argon scores 42.0%; on SEC-bench Pro, Astra scores 85.4% and Argon 83.4%.

But there is a discount to apply here. MarkTechPost states plainly that the SEC-bench Pro and ExploitGym scores were computed by Google using its own Antigravity test harness, that ExploitGym ran with mitigations switched off, and that most rival numbers are self-reported by each provider. This is an official self-run table, not third-party replication, and no independent replication exists yet.

Google does offer two corroborating notes of its own: the Chrome team reports that Carbon produced high-quality patches more than 10x better than a large frontier model from "another lab" (notice it declines to name them), and cloud security platform Wiz says Carbon leads its web penetration testing benchmarks.

Long tasks are the home turf, general computer use is not

Carbon targets agentic workflows that can run for days at a stretch: root-causing and patching subtle bugs across large codebases, working through low-level systems.

The widest gap shows up on GraphWalks, where Carbon scores 96.2% against GPT-6 Astra's 71.8%. On Terminal-Bench 4.0, Carbon reaches 65.2% versus Opus 5.5 at 59.6%.

It is not a clean sweep everywhere. On OSWorld-2.1, Carbon's 81.5% trails Claude Opus 5.5 at 87.2%, and on FrontierSWE, Carbon's 61.2% is beaten by GPT-6 Astra at 65.5%. By MarkTechPost's count, Carbon leads 15 of 17 published benchmarks.

Parameter count and context window both remain undisclosed. There are no open weights, no self-hosting path, and no quantized variants, only Google's hosted service.

The safety numbers get put on the table this time

This generation's safety figures are unusually prominent: successful cheating on Terminal-Bench 4.0 drops to 0.0%, with attempts to cheat falling to 0.4%; attack success on Gray Swan's indirect prompt injection benchmark reaches 0.0%, against 0.7% for Argon; high-severity misalignment alerts in live internal coding environments fall by almost 80%; unsupported claims drop roughly 2x versus Argon; overreach falls 26% and under-service falls 29%.

Google's framing is that rather than hedging or fabricating around missing evidence, the model should put methodological caveats directly into the deliverable, or withhold the blocked action with a clear list of what is still required.

The same discount applies. These are internal or self-run figures, and Google itself notes that independent replication is not yet available.

The price is cheap, the channel is narrow

Pricing matches Argon's introductory rate: $2 per million input tokens and $10 per million output tokens, with cached input priced at 95% off the input rate; after the introductory period, those rise to $4 and $20.

The real constraint is the rollout. A subset of cyber defenders gets access this week, with more trusted partners phased in through the Fairwind Program, which prioritizes governments, critical infrastructure operators, and core technology platforms. Google gave no date for developers, businesses, and consumers. The company also says it is participating in the U.S. government's voluntary pre-release model testing process.

One easily missed detail: the Gemini 4 model you can call on the Gemini API today is still Argon, not Carbon.

So what

Taken on its own, Carbon looks like a targeted bet on capability rather than a general push for a bigger model. Google is not betting on "larger and stronger" but on slotting the model into cybersecurity defense, a high-value and regulation-friendly vertical, and running it in limited release first.

What is notable is that this generation publishes the alignment and safety numbers on the same scorecard as the capability numbers. For a model whose abilities are rapidly approaching offensive use, that transparency may itself be part of the strategy: hand it to defenders first, draw the usage boundary, then talk about opening it up.

That leaves a question. When the strongest tier of capability is open only to part of the population, how wide does the gap grow between the model at the top of the leaderboard and the model in everyone's hands? If that distance keeps widening, benchmark rankings slowly stop being a useful reference point.

Two Gemini 4 models in two months, with a cyber-only variant slotted in between. Google's release cadence on this line increasingly looks like software version bumps rather than model launches, which raises the obvious question: how long until the next Carbon-class update?