Google Releases Gemini 4 Carbon: Its Strongest Model Yet, Debuting with a Cybersecurity Focus

Google has just released Gemini 4 Carbon, which it calls its strongest model to date. It comes only two weeks after the previous model, Argon—a pace that is itself a signal: the LLM race has reached a fever pitch, and Google has chosen a different path from before, delivering its strongest capabilities first to cybersecurity defenders.

Ranked First, but by a Slim Margin

In the Artificial Analysis composite ranking compiled by the third-party firm, Gemini 4 Carbon scored 59 to take first place. That's a result worth acknowledging, but the gap isn't large: second-place Cloud Opus 5.5 scored 58, and GPT-6 Astra scored 57. The spread among the top models is only one or two points, which shows that the composite leaderboard alone can no longer reveal a generational gap—the real differentiation has to come down to specific use cases.

This time, Gemini 4 Carbon's differentiator is cybersecurity. Google's self-reported data shows the model scores 88% on finding vulnerabilities, 55% on verifying whether a vulnerability can be exploited, and 70% on patching. These three capabilities map to the full chain of security work: discovering problems, judging whether a threat is real, and providing a fix. The gap between the first two scores also shows that verifying exploitability is far harder than simply finding a vulnerability.

Running for Days to Hunt Deeply Hidden Bugs: Capability Demo or Real Need?

Google mentions that internally it has seen the model run continuously for several days to track down deeply hidden bugs in large codebases. That description is worth pondering. Traditional security audits are limited by manpower and struggle to conduct long, sustained deep scans of very large codebases. If a model can run stably for days while keeping its context coherent, that does correspond to a class of work that was previously hard to automate.

Of course, such cases come from Google's internal observations—a single-source capability claim that has yet to be independently reproduced externally. Its real value will only be confirmed once security teams actually put it to use.

Long-horizon autonomous operation refers to a model executing tasks continuously over a long period without sustained human intervention while maintaining consistency of goals, context, and intermediate state. The key difference from ordinary conversational calls is that it must resist context drift, error accumulation, and the ossification of early judgments, and it must also be capable of self-checking and backtracking. In code security auditing, this means the model can repeatedly trace call chains and rule out hypotheses one by one, rather than offering a one-shot speculative conclusion. This kind of capability places high demands on memory management, tool-call stability, and cost control, and it is also a dimension that current evaluation systems rarely cover—which is why it's hard for outsiders to judge its true level from leaderboard scores alone.

Not Available Yet: The Logic of Staged Rollout

At present, ordinary users and developers cannot yet use Gemini 4 Carbon. This week it is being opened only to a subset of cybersecurity defenders, after which it will gradually be released to trusted partners, developers, and ordinary users. Google says only "as soon as possible" and gives no specific date.

Giving the strongest model to defenders first is a deliberate strategic choice. The offense-defense asymmetry in security is extreme: an attacker needs only one entry point, while a defender must cover every surface. Letting defenders get stronger detection and remediation capabilities first holds up both ethically and in the public-safety narrative. But from a product perspective, this "visible but out of reach" state is bound to feel like a tease to developers and ordinary users. Between prudence and frustration, Google has clearly chosen the former.

Staged rollout is a delivery approach that LLM vendors have commonly used in recent years: first open the model to trusted users in specific high-risk or high-value scenarios, collect abuse patterns, failure cases, and security incidents in real environments, and then expand the scope step by step. This is especially true for dual-use capabilities like cybersecurity—the same set of vulnerability discovery and exploit-verification capabilities can be used for defense and also for attack. As a result, vendors often need to pair this with identity verification, usage monitoring, and abuse detection mechanisms. This pace lengthens developers' waiting periods, but it is also a direct reflection of the fact that the stronger the capability, the higher the governance cost.

Pricing Holds Steady, Two Sets of Claims on Hallucinations

On price, Gemini 4 Carbon's launch pricing is the same as Argon's: $2 per million input tokens and $10 per million output tokens. Keeping the price unchanged while improving capability is a friendly signal for enterprise customers preparing to integrate it.

Around the hallucination issue, two sets of test conclusions have emerged that are not entirely consistent. Google's own testing shows that the model produces half as many unsupported claims as Argon—a clear improvement. But third-party testing offers another angle: the proportion of cases in which the model fabricates an answer to a question it cannot handle rose from 4% to 11%. Even so, that ratio is still the second lowest among all models.

The two data sets are not contradictory; they simply measure different things: one looks at the reduction in overall unsupported statements, while the other looks at the proportion of a specific behavior—fabricating rather than admitting ignorance. For actual users, the latter is more directly informative—whether a model is honest beyond the boundaries of its capabilities often affects trust more than the average hallucination rate. The ratio rose but remains low, indicating that the issue is within a controllable range and not something that can be ignored.

Differences in how hallucination rates are measured are the easiest trap to fall into when interpreting this kind of data. The overall proportion of unsupported statements measures the share of all model outputs that are factually incorrect or lack a basis. The "fabricating rather than admitting ignorance" ratio focuses only on the rate at which the model, when encountering a question beyond its knowledge or capability boundaries, chooses to make something up rather than acknowledge uncertainty. The former is significantly affected by task difficulty and the distribution of questions, while the latter is closer to a behavioral-tendency indicator. The two can simultaneously produce a combination of "overall improvement, worse boundary behavior," so reading self-reported and third-party results side by side reflects a model's credibility in real use better than citing either number alone.

Three Judgments Worth Noting

First, the composite score gap among top models has narrowed to one or two points, so the reference value of leaderboard rankings is declining—scenario-specific capability will be the focus of competition going forward. Second, a security-first release strategy means that the stronger the model, the more likely its delivery pace will be constrained by trust and compliance, and developers need to get used to this kind of tiered rollout. Third, interpretations of hallucination metrics need to clarify the measurement basis; self-reported and third-party test conclusions should be read side by side, since a single number can easily mislead.

Whether Gemini 4 Carbon can live up to the "strongest" label will ultimately depend on real-world feedback from security teams and on how it performs once it is opened up to developers.