Gemini 4 Carbon Tops the Charts but Remains Restricted to Cybersecurity Experts

Google has reclaimed the top spot in the AI race, but almost no one is allowed to use the model that got it there. It's called Gemini 4 Carbon, officially launched roughly three hours before Alphabet's quarterly earnings call, and it quickly shot to the top of the Artificial Analysis Intelligence Index, ahead of Claude Opus 5.5 and GPT-6 Astra. However, only a small group of cybersecurity defense organizations currently has access to it.

Topping the Charts: Leading Across Multiple Benchmarks

On version 5.0 of the Artificial Analysis Index, Carbon scores 59, Claude Opus 5.5 scores 58, GPT-6 Astra scores 57, and Argon, released just two weeks earlier, scores only 50. That means Carbon gained 9 points in two weeks, while typical models on that chart score around 42. The index is composed of nine different tests, and Carbon wins in four: difficult reasoning, scientific research, knowledge Q&A, and automated tasks.

In Google's own table of 14 core benchmarks, Carbon ranks first in 12; across a broader set of 17 tests, it wins 15. On another independent ranking, the Vowels Index, it takes first place at 70.4%. On Arena's blind text leaderboard, Carbon reaches 1,528 points, ranking first globally.

Such a large and rapid improvement has reignited discussion about recursive self-improvement (RSI). In the official announcement, Google DeepMind's Senior Vice President and Chief AI Architect wrote that researchers and models are "accelerating capability improvements hand in hand." The sentence itself is short, but it's enough to spark speculation.

Artificial Analysis Intelligence Index is a comprehensive model capability leaderboard that aggregates results from multiple independent benchmarks to give different large language models a unified, comparable score. The index is designed to reduce bias from any single test, typically covering dimensions such as reasoning, knowledge, coding, and mathematics, and is updated periodically to reflect the latest testing methods and model performance. A higher index score means stronger overall capability. When interpreting Carbon's score of 59, readers should note that this is a result under version 5.0 of the index; scores across different versions are not directly comparable. Additionally, the index is not an official standard but one of the third-party evaluation tools widely referenced by the community.

Outstanding Long Context and Agentic Capabilities

One of Carbon's most notable upgrades is long memory. It can accept approximately one million tokens at once—equivalent to about 1,500 pages of printed content—and can read text, images, audio, and video. In a test involving hidden connections spanning a million tokens that the model had to track, Carbon scored 96.2%, compared with 84.2% for Argon, 71.8% for GPT-6 Astra, and 66.8% for Claude Opus 5.5.

On Riemann Bench, a science and math test, Carbon scores 80%, a significant lead. On the HLE Diamond comprehensive exam, it ranks first at 69%, one point ahead of Opus 5.5. In tests that have AI perform real scientific research work on a computer, it leads again at about 65%.

Coding has long been a weakness for Google. On Terminal Bench 4.0, Carbon improved from Argon's 57.1% to 65.2%, which Google ranks as first. In Artificial Analysis's Coding Agent ranking, Carbon scores 59, second only to Opus 5.5's 62—Google's closest result in this category yet. However, Claude and GPT still win on hardcore software engineering tests like Frontier SWE2 and OS World.

On tasks requiring long periods of autonomous operation, Carbon's advantage is clear. In Vending Bench 2, which simulates running a business, Carbon's score is 1.8 times that of Claude Opus 5.5. On the Arena agent leaderboard, it jumps to second globally, behind only Opus 5.5 Max. Each agent task costs about $1.80, 72% less than Opus 5.5 Max. Google says Carbon has worked continuously for days inside internal massive codebases and low-level systems, switching approaches when it hits a dead end until it finds and fixes hidden bugs.

Agentic capability refers to an AI model's ability to autonomously plan, execute multi-step tasks, and invoke tools (such as browsers, code execution environments, and APIs) without continuous human intervention. Unlike traditional single-turn Q&A, agentic tasks require the model to possess long-term memory, goal decomposition, error recovery, and environment interaction skills. For example, in Vending Bench 2, the model must simulate running a business, involving multiple rounds of operations such as inventory management, pricing decisions, and customer communication. Evaluation of agentic capability typically focuses on task completion rate, resource consumption, and degree of autonomy, and is one of the key areas of competition among current frontier models. Carbon's performance on the agent leaderboard and its low-cost advantage are a direct reflection of this capability.

Speed and Hallucination: A Clear Trade-off

The biggest complaint is speed. Testers say Carbon is two to four times slower than Argon depending on the task, and it thinks for longer. Artificial Analysis found that it actually writes faster, at about 100 tokens per second, but it's verbose: completing the tests produced 200 million tokens in total, versus just 64 million for a typical model, with each task taking about 21 minutes on average. On finance and tax tasks, it takes more than twice as long as Argon, while financial accuracy actually declined slightly, from 67.66% to 67.16%. It wins on legal research tests, but each task takes nearly 52 minutes on average, about 20 minutes more than Argon.

Hallucination is also controversial. On Artificial Analysis's knowledge test, Carbon's accuracy rose from 48% to 58%, but its hallucination rate rose from 4% to 11%. This means that among questions it answers incorrectly, a higher proportion involve fabricating answers rather than admitting it doesn't know. Still, 11% is the lowest on that chart, with Claude Opus 5.5 and GPT-6 Astra both around 50%. In a composite score that rewards correct answers and penalizes fabricated ones, Carbon leads Opus 54 to 48. Google's own tests say Carbon's unsupported claims are about half those of Argon; the two use different testing methods, so both may hold true.

Security Restrictions: Why It's Locked in a Room

The core reason Carbon's access is restricted is its cybersecurity capability. Defense software requires three things: finding vulnerabilities, determining whether a vulnerability is exploitable, and writing fixes. Carbon sets new records in all three: 88.2% on finding vulnerabilities in real software, 54.8% on proving exploitability, and 71% on writing actual fixes. Google says these are raw model capabilities measured without guardrails. The Chrome team says Carbon's ability to write high-quality security patches is more than 10 times stronger than large frontier models from other labs.

A model that can both find and exploit vulnerabilities is equally useful to attackers. So this week Google first opened it to a small group of cyber defense organizations, then plans to gradually provide it to trusted partners through the Fairwind program, and later to developers, enterprises, and general users—but no specific dates were given.

Google has also done extensive work on behavior. In prompt injection tests where attackers had 15 attempts, Carbon's success rate was zero. Argon was 0.7%, Opus 5.5 was 1%, and GPT-6 Astra was 8.5%. Google calls Carbon an "honest model": on Terminal Bench 4.0, its successful cheating rate dropped to 0% and its attempt rate to 0.4%. When working with Google's internal coding team, severe misconduct alerts fell by nearly 80%, unauthorized actions by 26%, and under-delivery by 29%.

Prompt injection is a security attack targeting AI models in which an attacker uses carefully crafted input (such as hidden instructions or malicious text) to try to induce the model to deviate from its original task, perform unauthorized actions, or leak sensitive information. In agentic scenarios, the harm of prompt injection is greater because the model may invoke external tools or access system resources. Defending against prompt injection is an important part of model safety alignment, and common methods include input filtering, instruction hierarchy design, and behavior monitoring. Google says Carbon successfully resisted all prompt injection attacks across 15 attempts, a result that reflects its investment in safety training, though continuous evaluation is still needed in real-world deployment.

Pricing and Market Reaction

Carbon launches at Argon's introductory price: $2 per million input tokens and $10 per million output tokens, with a 95% discount on cached content. After the promotion ends, prices will rise to $4 and $20, the same as Claude Opus 5.5's pricing; Google did not say when the adjustment will occur. At full price, Artificial Analysis says Carbon costs about $7.76 per task, roughly on par with Argon's $7.68 but with a 9-point higher score; about 23% cheaper than Opus 5.5's $10.04; while GPT-6 Astra is about $6.24, roughly 20% cheaper than Carbon. Because of its verbose output, Artificial Analysis still considers it expensive, ranking 45th out of 51 models on cost.

Developers on Hacker News are unhappy that Google always rushes to announce models but never gives a public date—by the time Carbon opens up, OpenAI and Anthropic may have already released their next-generation models. Some compare Google to a guy who keeps bragging about his girlfriend but never lets anyone meet her. Whether Google is truly back may depend on when that door opens.

"Introductory pricing" is a common promotional pricing strategy in cloud services and large model APIs, referring to offering a product at a lower price in the early launch period to attract developers to try it, before reverting to standard pricing after a period. This strategy helps quickly accumulate user feedback and ecosystem stickiness, but it can also lead developers to reassess costs after the price adjustment. For Carbon, the introductory price of $2 per million input tokens and $10 per million output tokens matches Argon, while the full price will double to $4 and $20, the same as Claude Opus 5.5. When planning long-term applications, developers need to consider cost changes after the promotion ends and comprehensively estimate actual spending in light of the model's verbosity (Carbon generates far more tokens than typical models).

One-line Summary

Google releases Gemini 4 Carbon, which tops multiple benchmarks but is restricted to defense organizations due to its cybersecurity capabilities.

Paragraph Summary

Google released Gemini 4 Carbon ahead of its earnings call, and the model tops the Artificial Analysis Intelligence Index with a score of 59, ahead of Claude Opus 5.5 and GPT-6 Astra. Carbon excels in long context (one million tokens), scientific reasoning, and agentic tasks, with agent task costs 72% lower than Opus 5.5 Max. But it is noticeably slower, and its hallucination rate rose from Argon's 4% to 11%. Its cybersecurity capabilities (vulnerability discovery, exploit verification, and fix writing) set new records, so Google is only opening it to a few defense organizations, with no public date announced. Pricing initially matches Argon; at full price it matches Opus 5.5, but GPT-6 Astra is cheaper. Developers are unhappy that Google is slow to open access.