Google's Gemini 4 Carbon takes #1 on the AI index and goes to cyber defenders first

Only two weeks after Gemini 4 Argon became available to everyone, Google has a new frontier model. On October 28, 2026, Google DeepMind announced Gemini 4 Carbon, which the company calls its strongest model yet, with "state of the art cybersecurity and long horizon capabilities". The announcement was signed by Koray Kavukcuoglu, a senior vice president at Google DeepMind and Google's Chief AI Architect, and it is available on the Google blog.

The headline number is simple: Carbon scores 59 on version 5 of the Artificial Analysis Intelligence Index, one point ahead of Claude Opus 5.5. That makes it the new number one on one of the most watched independent leaderboards in AI. But the bigger story may be where Google points the model first. Carbon is not launching for developers or consumers. It goes to a small group of cyber defenders, because Google says its abilities to find, exploit and fix software vulnerabilities are a significant leap over anything it has shipped before.

Below is what Carbon can do according to Google, how the leaderboard looks now, what the safety claims say and what they do not prove.

A new number one, one day after the scoreboard was reset

The timing matters. On October 27, one day before Carbon was announced, Artificial Analysis released Intelligence Index v5, the biggest overhaul of its composite score since January. For the first time, 60% of the index is based on evaluations with private test sets or held out answers, which makes it harder for model makers to train on the questions. Two new benchmarks joined the mix: FrontierCode 2.0, a private coding test from Cognition that only counts a fix if a real repository maintainer would merge it, and Terminal Bench Science, a set of 70 agentic research tasks that run in a terminal.

At launch, v5 put Claude Opus 5.5 first with 58 points, ahead of GPT-6 Astra with 57 and GPT-6.1 Sol with 55. Anthropic and OpenAI held the top five spots. Google's own Gemini 4 Argon came next at 50. One day later, Google says Carbon sits at 59, which pushes Opus 5.5 to second place. The Verge also reported that the index now shows Carbon ahead of Opus 5.5 and GPT-6 Astra.

A one point lead is not a landslide. On a composite of nine benchmarks, one point is well within the range where a different effort setting or a slightly different task mix could swap the order. What is notable is the jump from Argon to Carbon: nine points in about four weeks, from a model that already looked strong. The same index also shows how far ahead the closed labs now are. The best open weights model, Kimi K3.1 Pro, scores 46, and among models with weights actually released, DeepSeek V4.1 Flash 1017 and GLM-5.3 top out at 32. The gap between the best closed and best open model grew from 3 points to 12 with the new version.

The security numbers: find, exploit, fix

The part of the announcement Google clearly cares about most is cybersecurity. Google describes three steps of what it calls the cyber defense lifecycle, and Carbon reports a top score on a public benchmark for each of them. Google notes that these external results were measured without guardrails, so they show the raw capability of the model, not what a normal user would get through the finished product.

• Finding vulnerabilities: 88.2% on SEC-bench Pro, a benchmark in which the model has to uncover real flaws in real world software on its own.
• Proving they are exploitable: 54.8% on ExploitGym, which tests whether a model can turn a known vulnerability into a working exploit. Defenders use this step to decide which bugs to fix first.
• Patching the root cause: 71.0% on Collinear's CWE-bench, where the model has to turn a validated finding into a working code fix.

Google adds several internal results that are harder to check. On its own benchmarks, Carbon more than doubles Argon's success rate at generating secure code. The Chrome team reportedly found that Carbon was more than ten times better than "another lab's large frontier model" at producing high quality patches, without naming the lab or the model. And Wiz, the cloud security company Google now owns, says Carbon leads its benchmarks for web penetration testing, which Wiz uses for its Scan for Good program.

The middle number is the one that explains Google's caution. A model that finds bugs and writes patches is a gift to defenders. A model that also turns more than half of the vulnerabilities in a test set into working exploits is exactly the kind of system that security officials worry about falling into the wrong hands. Finding and exploiting are two sides of the same skill, and Google is not pretending otherwise.

Why defenders get it first

That is why Carbon follows the same careful path as Argon did in September. Starting this week, it goes to a subset of cyber defenders, and access then widens step by step to more trusted partners through Google's Fairwind Program. Google says it is taking part in the US government's voluntary process for testing models before release, and that it will keep gathering feedback and adjusting guardrails before Carbon reaches developers, businesses and consumers "as soon as possible". There is no date.

The Argon precedent suggests the wait may not be long. Argon was first shown to Fairwind partners on September 30 and became generally available on October 13, thirteen days later. If Carbon follows a similar curve, developers could see it in the Gemini API before the end of November. But Carbon's security scores are clearly higher, and Google may choose to hold it back longer this time.

This staged approach is becoming a pattern across the industry. Labs now treat the strongest cyber capable models less like a product launch and more like a controlled release, with early access for defenders who can patch systems before attackers get the same tools. Whether that head start is meaningful depends on how long the gap lasts and how many critical projects actually get scanned in that window.

Long tasks: a model that keeps going for days

The second focus is what Google calls long horizon work. Carbon is built for agentic workflows that run for a long time without a human steering every step. Internally, Google says its teams have seen Carbon run "for days" and push through dead ends on complex engineering tasks, such as tracing subtle bugs to their root cause across large codebases and low level systems and then patching them.

Google also reports gains in coding, scientific tasks, multimodal understanding and full stack web development. On WebDev Arena, a public ranking based on human votes for generated web apps, Carbon gains 89 Elo points over its predecessor and lands at number four with 1768. So even by Google's own account, Carbon is not the best at everything. On web development, three other models are still ahead of it in that ranking.

Safety claims: fewer shortcuts, fewer made up claims

Google spends a large part of the announcement on alignment, which fits a model that is meant to run for days on its own. The claims, all based on Google's own testing, are:

• Cheating: On Terminal Bench 4.0, successful cheating dropped to 0.0%, and attempts to cheat fell to 0.4%, while accuracy improved.
• Misalignment alerts: In live coding environments with Google's internal teams, high severity misalignment alerts dropped by almost 80%.
• Honesty: Carbon makes about half as many unsupported claims as Argon. Instead of inventing results, it is supposed to put caveats into the deliverable or list exactly what is still missing.
• Staying in scope: Overreach went down by 26% and under service, meaning doing less than the task requires, by 29%.
• Prompt injection: On Gray Swan's Indirect Prompt Injection benchmark, Argon already had a low attack success rate of 0.7%. Carbon reaches 0.0%, resisting every attack attempt that was evaluated.

These are encouraging numbers, especially the prompt injection result, because prompt injection is the main way attackers hijack AI agents that read web pages, emails or files. But "every evaluated attack" is not the same as "every possible attack". A benchmark covers a fixed set of known techniques, and attackers adapt. The same is true for the cheating and misalignment numbers: they come from Google's environments and Google's monitoring, and nobody outside Google can check them yet. The recent misalignment reports from OpenAI, where internal coding agents quietly weakened their own safety monitoring, show why independent testing of these claims matters.

What it will cost

Carbon will launch at the same introductory price as Argon: 2 dollars per million input tokens and 10 dollars per million output tokens, with cached input 95% cheaper. After the introductory period, the price goes up to 4 dollars and 20 dollars. For Argon, Google set that introductory period to end on November 30, 2026. For Carbon, Google has not yet given an end date, and since the model is not on sale to developers yet, the price is mostly a signal for now.

That signal is strong, though. If Carbon reaches the API at 2 and 10 dollars with the top score on the Artificial Analysis index, it would be one of the cheapest ways to buy frontier level intelligence per token. Artificial Analysis also shows how much the real cost depends on effort settings: Claude Opus 5.5 at maximum effort costs about 10 dollars per index task, GPT-6.1 Sol about 1.27 dollars. How many tokens Carbon burns per task, especially on multi day agentic runs, will decide whether the low token price really makes it cheap.

What we do not know yet

There are clear gaps in the announcement. The announcement does not include a full table comparing Carbon with rival models, and all the security and safety results come from Google's own report. The competitor comparison on the cyber benchmarks is thin: The Verge reports that Carbon beat GPT-6 Astra on SEC-bench Pro, but Google's post gives Carbon's scores without full numbers for every rival. The effort setting behind the 59 points on the Artificial Analysis index is not stated in Google's post either. And the claim that Carbon can run for days is an internal observation, not a published test.

Until developers and independent red teams get access, the fair summary is this: Carbon is the highest scoring model on the newest Artificial Analysis index, it comes with strong vendor reported security numbers, and Google is treating it as a model that is too capable in offense to hand out freely on day one.

Dany's take

The race at the top has become a race measured in weeks. Two weeks ago Argon was Google's best model, one day ago Opus 5.5 led the new index, and today Carbon is ahead by a single point. Anyone choosing a model for a real product should treat these rankings as a snapshot, not a verdict, and test on their own tasks.

The more interesting shift is in what labs are proud of. Google leads this announcement with exploitation and patching scores, and then immediately limits who can use the model. That is a sign of how serious AI driven security work has become. For maintainers of open source projects and small companies, the practical takeaway is that tools like this will find bugs in their code, either through defenders or, eventually, attackers. Getting on a scanning program early, or at least running the available AI security tools on your own code now, is a better bet than waiting for the public launch.

Sources: Google blog, Introducing Gemini 4 Carbon, October 28, 2026, Artificial Analysis, Intelligence Index v5, October 27, 2026 and The Verge, October 28, 2026.