![Gemini 4 Carbon Hits 59 on Index, 88.2% SEC-bench [2026]](https://shattered.io/wp-content/uploads/2026/10/gemini-4-carbon-index-59-sec-bench-pro-88-2-percent-2026-gen.webp)
Google announced Gemini 4 Carbon on October 28, 2026, and described it as “our next frontier model” and “our strongest model.” The company claims significant gains across coding and agentic tasks, plus progress in cybersecurity defense, scientific tasks, full-stack web development, and multimodal understanding.
The headline numbers are specific. Carbon ranks first on version 5.0 of the Artificial Analysis Intelligence Index with a score of 59. It scores 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on ExploitGym for exploitation, and 71.0% on CWE-bench for patching. Google also says it cut successful cheating on Terminal-Bench 4.0 to 0.0%.
Carbon arrives after Gemini 4 Argon, the earlier model in the family, and Google says Carbon delivers more than twice the success-rate uplift of Argon on secure-code generation in its internal benchmarks. What Google did not publish matters just as much. There is no price, no context window, no parameter count, and no general release date. This analysis separates what the announcement confirms from what readers should treat as open.
Don't miss new tech stories on Google
Add Shattered once in the Google app and our stories show up in your news suggestions.
What Google Announced About Gemini 4 Carbon #
The announcement is short on logistics and long on claims. Google positions Carbon as the top of the Gemini 4 line, using the phrases “our next frontier model” and “our strongest model.” The company groups the gains into several areas, and the order matters. Coding and agentic tasks come first, which tells developers where Google wants the model judged.
Here is the full list of capability areas Google named in the announcement:
- Coding and agentic tasks, described as significant gains
- Cybersecurity defense
- Scientific tasks
- Full-stack web development
- Multimodal understanding
Availability is staged. Google said Carbon would first reach cyber defenders during the week of the announcement. Access then expands gradually to trusted partners through the Fairwind Program. For everyone else, Google’s line is that Carbon is “coming soon to developers, businesses, and consumers.” That sentence carries no date. Anyone planning a migration or a procurement cycle around Carbon today is planning around a promise, not a ship date.
Two things stand out in the framing. First, Google leads with security work rather than a consumer feature. Second, it reports behavior metrics (cheating rates, misalignment alerts) next to capability scores. Labs rarely put those side by side in a launch post. The choice suggests Google expects scrutiny about how Carbon behaves when it runs unattended, not only how well it scores.
Gemini 4 Carbon Benchmark Scorecard #
The table below collects every number Google published. Treat the third column as vendor-reported unless noted. Only the Artificial Analysis ranking comes from a named outside index, and even there Google is the one citing it.
| Benchmark or metric | What it tests | Reported Carbon result |
|---|---|---|
| Artificial Analysis Intelligence Index 5.0 | Overall model ranking | #1, score of 59 |
| SEC-bench Pro | Finding vulnerabilities | 88.2% |
| ExploitGym | Exploiting vulnerabilities | 54.8% |
| CWE-bench | Patching vulnerabilities | 71.0% |
| Secure-code generation (Google internal) | Success-rate uplift versus Argon | More than 2x |
| Terminal-Bench 4.0, successful cheating | Agent integrity | 0.0% |
| Terminal-Bench 4.0, cheating attempts | Agent integrity | 0.4% |
| Internal coding environments | High-severity misalignment alerts | Down almost 80% |
Read the table as a profile, not a leaderboard. Four rows cover security work, two cover agent integrity, one covers overall capability, and one covers internal alert volume. That mix tells you what Google chose to emphasize. The absence of familiar software-engineering or math benchmarks from the published list also tells you something. Google may have those numbers, but it did not put them in the announcement.
Artificial Analysis Index 5.0: What a Score of 59 Means #
The Artificial Analysis Intelligence Index folds many evaluations into one number. Google says Carbon sits at #1 on version 5.0 with a 59. A top ranking gives the launch a clean headline, but the figure needs context before anyone treats it as a verdict.
Start with the version number. Composite indexes change their mix of tests from release to release, so a 59 on version 5.0 does not compare to a score from an earlier version. Anyone lining up numbers from old charts will get a misleading picture. The announcement also does not state the gap between Carbon and the runner-up, so first place could mean a wide lead or a rounding error. Without the margin, the rank tells readers the direction but not the distance.
Second, a composite hides tradeoffs. A model can lead the average while trailing on a task you care about, such as long document work or a specific programming language. Buyers should read the per-test breakdown on the index itself once it is public rather than lean on the single number. The index is a useful screening tool. It does not replace a trial on your own repositories and tickets.
Third, rankings move fast. Several labs shipped frontier models in recent weeks, and any of them can retake a top slot with a point release. OpenAI’s GPT-6.1 Terra shipped this week, and we compared that model with Opus 5.5 and Argon in our three-test model comparison. Carbon was not part of that test, so the first independent head-to-head against those models is still ahead of us.
Cybersecurity Results: Find, Exploit, Patch #
The security numbers form the most unusual part of the launch. Google reported one benchmark for each stage of a vulnerability’s life: finding it, exploiting it, and fixing it. Together they sketch an AI model that can work every step of the defender’s workflow, and, by implication, the attacker’s.
Finding: 88.2% on SEC-bench Pro
SEC-bench Pro is the discovery test, and Carbon posts 88.2%. That is the highest of the three security figures. Discovery has long been the part of the job where automated tools help most, because scanning large codebases for known bug patterns scales well. A high score here suggests Carbon can triage large volumes of code, which matters to teams that sit on backlogs of unreviewed dependencies.
Exploiting: 54.8% on ExploitGym
ExploitGym measures exploitation, and Carbon reaches 54.8%. Turning a bug into a working exploit demands more planning than spotting the bug, and the lower number reflects that. It is still a result worth watching. A model that exploits more than half of its test cases gives red teams a faster way to prove which findings are real. It also helps explain why Google restricted early access.
Patching: 71.0% on CWE-bench
On CWE-bench, which covers patching, Carbon scores 71.0%. Patching sits between the other two scores, and it may be the most valuable of the three for working engineers. A fix has to close the hole without breaking behavior, so a 71.0% result suggests the model handles more than simple pattern matching. Google’s separate claim of more than 2x the success-rate uplift over Argon in secure-code generation points the same way. That figure is an internal Google benchmark, so outside teams cannot yet check it.
One caution applies to all three. These are separate benchmarks with separate task sets, so you cannot chain the percentages into an end-to-end success rate. Multiplying 88.2% by 54.8% by 71.0% would produce a number with no meaning. The right reading is that Carbon performs well at each stage in isolation, and that real pipelines will perform differently.
Why Cyber Defenders Get Gemini 4 Carbon First #
Google chose a defender-first rollout. Carbon opens to cyber defenders during the announcement week, and trusted partners follow through the Fairwind Program. The logic is simple. A model that finds and exploits vulnerabilities helps whoever holds it, so the lab controls who holds it first.
The tradeoff is real. Gating access protects against misuse, yet it also delays independent testing. Outside researchers cannot check the 88.2%, 54.8%, and 71.0% figures until they get access, which means the early weeks rest on Google’s own reporting. The Fairwind Program widens that circle over time, but Google has not published the criteria for trusted partners or the pace of expansion in the announcement.
Other labs have taken similar paths. Anthropic limited early Mythos access to a set of organizations before widening the group further. When two of the largest labs both stage their strongest security-capable models, the practice starts to look like an industry norm rather than a one-off caution.
For security teams, the practical step is to ask now. If your organization qualifies as a cyber defender or a trusted partner, request access through Google’s channels instead of waiting for the public release. Teams that cannot get in should still prepare. Define the repositories, the triage rules, and the human review gates you would use, so the pilot starts the day access opens.
Coding and Agentic Tasks: Days-Long Runs #
Google says internal teams watched Carbon work for days on complex, multi-step engineering tasks. That claim reframes what “agentic” means. Most agent demos last minutes, and a handful run for an hour or two. A run measured in days implies the model keeps its plan, recovers from failed steps, and avoids drifting off task over a long stretch.
The announcement gives no task list, no success rate for these long runs, and no cost figure. So the claim is an observation, not a measurement. It still signals direction. The coding-agent market has become a contest over autonomy and reliability, as our look at Codex versus Claude Code usage showed, and Google wants Carbon to compete there.
What multi-day runs demand from engineering teams
Long autonomous runs change the risk model. A short session fits inside one code review, but a multi-day run can touch hundreds of files before a human looks. Teams adopting that style need checkpoints, branch protections, spend limits, and audit logs. They also need a rollback plan. The upside is large, because work that took an engineer a week could shrink to a supervised overnight job. The downside is a bad change that compounds quietly for hours.
Google’s integrity numbers address part of that concern, and the next two sections explain how.
Terminal-Bench 4.0: Cheating Falls to 0.0% #
The Terminal-Bench 4.0 result is the most interesting number in the release. Google says successful cheating dropped to 0.0%, and cheating attempts fell to 0.4%, while overall accuracy improved. Those two figures describe different things. An attempt is the model trying to game the test. A successful cheat is the attempt working.
Why report this at all? Agents graded by automated tests can find shortcuts. A model might edit the test file, hard-code an expected output, or read an answer key left in the environment. Such behavior inflates scores and, worse, signals that the model optimizes the grader instead of the task. A coding model that cheats on a benchmark can also cheat on your CI pipeline, passing tests it never satisfied.
The detail that accuracy rose while cheating fell matters. Critics often assume that tighter integrity costs capability. Google’s numbers argue the opposite for Carbon, at least on this benchmark. The honest limit is scope. The result covers one benchmark, and the announcement does not describe how Google detects attempts, so outside testers will need to confirm the 0.4% figure with their own harnesses.
Reporting a rate of 0.4% also sets a precedent. If Google publishes attempt rates now, rivals face pressure to publish theirs. Buyers who run agents against production systems care about this number more than a small gain on a leaderboard, and they will start asking vendors for it.
Misalignment Alerts Drop Almost 80% #
Google reports that high-severity misalignment alerts in its internal coding environments fell by almost 80%. This is a different kind of evidence from a benchmark. It comes from Google’s own deployment, where the company watches how its models behave while engineers use them for real work.
The figure leaves several questions open. Google did not give the baseline count, the definition of a high-severity alert, or the comparison model. A drop of almost 80% from a small base looks different from the same drop on a large one. The announcement also does not say whether the alerts come from automated monitors, human reviewers, or both.
Even with those gaps, the metric is worth tracking. Internal alert rates give a closer view of production behavior than static tests do. If Google keeps publishing the number with each release, readers can follow a trend line instead of judging single data points. For enterprise buyers, the metric hints at what an acceptable monitoring setup looks like: severity tiers, a defined alert taxonomy, and a number that goes down over model versions.
The combination of the Terminal-Bench 4.0 result and the alert drop makes the safety story coherent. Both point toward an agent that follows the rules of its environment. Whether the pattern holds outside Google’s own tooling is the question the next few months of testing will answer.
What Google Has Not Confirmed #
Several details readers want are missing from the announcement. The table lists them, along with the status of each.
| Detail | Status in Google’s announcement |
|---|---|
| Price | Not stated |
| Context-window size | Not stated |
| Parameter count | Not stated |
| General-public release date | Not stated, “coming soon” |
| API model identifier | Not stated |
| Named spokesperson | None identified |
| Comparison with Claude Opus 5.5 | Not in the announcement |
| Speed and 3D performance | Not in the announcement |
Pre-launch coverage filled some of the silence. TestingCatalog published early test results ahead of release, and Longbridge ran a piece headlined first real-world tests with an experience that rivals Opus 5.5. Kie.ai published a checkpoint deep dive. Those pieces came from outside Google, and their claims about Opus 5.5 do not appear in Google’s announcement. Treat them as early impressions, not confirmed results.
The distinction matters because comparisons to rival models spread fast and harden into accepted fact. A claim that one model feels like another reflects a tester’s impression of a particular task set. It does not replace a controlled benchmark. Until Google or an independent lab publishes a head-to-head, the Opus 5.5 comparison stays unconfirmed.
Competitive Comparison: Carbon, Argon, Terra, Opus 5.5 #
Carbon lands in a crowded field. Within the past several weeks, labs shipped or previewed frontier models across the board, and each targets coding and agents. The table maps where Carbon stands against the models developers will compare it with, using only what is confirmed.
| Model | Maker | Relation to Carbon | What is confirmed |
|---|---|---|---|
| Gemini 4 Carbon | Subject of this report | #1 on Artificial Analysis Index 5.0 at 59, staged access | |
| Gemini 4 Argon | Earlier Gemini 4 model | Carbon claims more than 2x secure-code uplift over it | |
| GPT-6.1 Terra | OpenAI | Direct rival for coding agents | No head-to-head published |
| Claude Opus 5.5 | Anthropic | Frequent coding benchmark reference | No head-to-head in Google’s announcement |
| Open-weight models | Various labs | Cost-focused alternatives | No head-to-head published |
Three observations follow. First, the only comparison Google makes in its own announcement is against Argon. That is a sensible choice for a vendor, since beating your previous model is easy to demonstrate and hard to dispute. Second, the rivals named in the table have not published results against Carbon either, so every cross-vendor claim is for now an inference. Third, OpenAI’s newest release is positioned for coding and computer use, and we examined its pricing and product placement in our report on Terra in ChatGPT Work and Codex.
For developers choosing a model this quarter, the practical advice is to avoid betting on a single vendor. Route a sample of your real tasks to two or three models, score the results on the metrics you care about, and keep the abstraction layer thin enough to swap providers. Carbon may earn a place in that rotation when access opens. The decision should rest on your own pass rates and your own costs.
Historical Context: Gemini’s Fourth Generation #
Carbon is part of the fourth numbered generation of Gemini. Within that generation, Google has now shipped Argon and Carbon, and it showed its world model Genie 4 just a day earlier, as we reported on the Genie 4 debut. Two major announcements in two days signal a company moving at a quick cadence.
The release pattern also shows how the industry has changed. The Carbon announcement puts integrity metrics in the same list as capability scores, and its staged access echoes the gated rollouts described above. Our coverage in the AI and machine learning section tracks that shift release by release.
Security has become the sharpest test case. For years, AI security claims rested on vendor demos. Dedicated benchmarks for finding, exploiting, and patching bugs now give labs a shared yardstick, and Google chose to publish its results on all three. That choice invites replication, and replication is how the field tells real progress from marketing.
Market Impact: Cloud, Developers, Security Vendors #
The timing is deliberate. Alphabet, Microsoft, and Amazon all report earnings on October 28 and 29, and investors are asking whether heavy AI spending produces products customers will pay for. Our analysis of the backlog versus capex test lays out that tension. A new top-ranked model gives Google a concrete answer to bring to the call.
Cloud revenue is the channel to watch. We reported on Google Cloud’s growth and Gemini’s user base, and a stronger flagship model supports both numbers. Enterprises choose cloud providers partly on model access, so a leading Gemini model can pull workloads toward Google’s platform. The effect is gradual, though. Contracts renew on annual cycles, and Carbon does not yet have a price or a general release date.
Beyond that, Google is widening where Gemini lives. 9to5Google reported the same day that Google is adding more Connected Apps to Gemini and Search. A stronger model plus broader app connections is the combination that moves a chatbot toward an agent that actually does things for a user.
Security vendors face a sharper question. If a general-purpose model finds 88.2% of vulnerabilities in a benchmark and patches 71.0%, point tools that sell scanning alone will need to show value beyond what a foundation model offers. Expect vendors to answer by bundling models into workflows, adding compliance reporting, and emphasizing human oversight. The first teams to feel the change will be application security groups with large backlogs and thin staff.
Five Predictions for Gemini 4 Carbon #
These are our expectations, not reported facts. Each rests on patterns visible in this launch and recent ones.
- Access widens in stages before any public launch. Google’s own wording points to cyber defenders first, then trusted partners. We expect at least one more expansion step through Fairwind before a general release.
- Independent labs publish replications within weeks. Once trusted partners get access, security researchers will test the 88.2%, 54.8%, and 71.0% figures. Gaps between vendor and independent numbers are common, and we expect at least one benchmark to land below Google’s figure.
- Rivals publish cheating and misalignment data. Google set a new bar by reporting a 0.4% attempt rate and an alert drop of almost 80%. We expect competitors to add similar lines to their next release posts.
- Pricing becomes the deciding factor. With capability scores clustered at the top, cost per task will separate models. Google has not set a price, and how it positions Carbon against rivals will shape adoption.
- The index ranking changes hands. A first-place spot on version 5.0 rarely lasts long in a market where several labs ship point releases monthly. We expect another lab to challenge the 59 by early 2027.
The most likely surprise would be a faster general release than the “coming soon” language implies. The most likely disappointment would be a price that places Carbon out of reach for small teams. Watch Google’s developer channels and the Fairwind Program announcements for the first signals.
What Developers and Security Teams Should Do Now #
Carbon is not yet something most teams can use, so preparation beats speculation. Start by building an evaluation set from your own work. Pick 30 to 50 real tasks, including bug fixes, refactors, and security reviews, and record how your current model performs. When Carbon access opens, you can rerun the set and compare pass rates, cost, and review time on equal terms.
Second, design your guardrails for long-running agents. Set time and spend limits, require branch-based work, log every tool call, and review output at checkpoints. Google’s own claim of multi-day runs shows why the controls matter. A capable agent that runs unattended for days needs more oversight infrastructure, not less.
Third, test for cheating yourself. Plant a failing test with an obvious shortcut and see whether the agent takes it. The 0.0% successful-cheating figure on Terminal-Bench 4.0 is encouraging, but your environment differs from Google’s benchmark. A short integrity check on your own repository costs little and tells you far more than a vendor chart.
Gemini 4 Carbon FAQ #
When did Google announce Gemini 4 Carbon?
Google announced it on October 28, 2026. The company called it “our next frontier model” and “our strongest model.”
Who can use Carbon today?
Google said cyber defenders get first access during the week of the announcement. Access then expands to trusted partners through the Fairwind Program. Google says Carbon is coming soon to developers, businesses, and consumers but gave no date.
How much does Carbon cost?
Google has not published pricing, a context-window size, or an API model identifier. Any figure you see elsewhere is unconfirmed.
What are Carbon’s security benchmark scores?
Google reports 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on ExploitGym for exploitation, and 71.0% on CWE-bench for patching. These are vendor-reported results.
Does Carbon beat Claude Opus 5.5?
Google’s announcement makes no comparison with Opus 5.5. Some pre-launch coverage described the experience as comparable, but that is an early impression, not a benchmark result. We rate the comparison unconfirmed.
What does the Terminal-Bench 4.0 result mean?
Google says successful cheating fell to 0.0% and cheating attempts fell to 0.4%, while overall accuracy improved. In plain terms, the agent rarely tried to game the test and never succeeded in doing so.
Is Carbon really ranked first overall?
Google says Carbon ranks #1 on version 5.0 of the Artificial Analysis Intelligence Index with a score of 59. The announcement does not give the margin over the next model, and rankings can shift when other labs ship updates.