![Gemini 4 Carbon Tops AA Index at 59, $2 Input [2026]](https://shattered.io/wp-content/uploads/2026/11/gemini-4-carbon-artificial-analysis-59-claude-opus-5-5-2026-photo.webp)
Google has put a name on its newest frontier model, and the name is Gemini 4 Carbon. According to Google’s official blog, Carbon sits at the top of the updated v5.0 Artificial Analysis Intelligence Index with a score of 59, and Google pitches it at cybersecurity work and long-horizon tasks. Headlines across Tom’s Hardware, TestingCatalog AI News, The Cryptonomist and Gadgets 360 go a step further. They say it narrowly beats Claude Opus 5.5 and hallucinates less than any rival.
Those two extra claims deserve a closer look. Google’s own page does not publish a head-to-head table against Anthropic’s flagship, and it does not crown Carbon as the least hallucination-prone model overall. This analysis separates what the announcement confirms from what the coverage adds, then walks through pricing, access, and the competitive picture. For context on how the last Google release stacked up against Anthropic, see our Argon vs Opus 5.5 DeepSWE comparison.
Don't miss new tech stories on Google
Add Shattered once in the Google app and our stories show up in your news suggestions.
Gemini 4 Carbon Arrives With a Cybersecurity Pitch #
Most frontier launches lead with a general-purpose pitch. Carbon leads with defense. Google describes it as a frontier model focused on cybersecurity and long-horizon capabilities, which means tasks that run across many steps and many tool calls rather than a single prompt and reply. That framing tells you who Google wants to reach first: security teams that triage vulnerabilities, write patches, and test whether a flaw is exploitable.
The positioning also explains the benchmark list in the announcement. Instead of the usual spread of math and general knowledge tests, Google highlights SEC-bench Pro, ExploitGym and CWE-bench. Each one measures a different slice of the vulnerability lifecycle. A model that scores well across all three can, in theory, find a bug, prove it matters, and fix it.
Access is deliberately narrow at the start. Google says the first users will be a subset of cyber defenders, with more trusted partners joining later through its Fairwind Program. That staged rollout matters for every claim in this piece, because independent testers cannot fully reproduce numbers on a model most developers cannot yet call.
What Google Confirmed About Gemini 4 Carbon #
Start with the hard facts, because they are few and they are clear. Google’s official blog names the product Gemini 4 Carbon. It reports a score of 59 and the number one rank on the updated v5.0 Artificial Analysis Intelligence Index. It also reports 88.2% on SEC-bench Pro, 54.8% on ExploitGym, and 71.0% on CWE-bench.
On price, Google says Carbon will cost $2 per million input tokens and $10 per million output tokens. Cached input tokens carry a 95% discount against the input price. On access, the company names a first wave of cyber defenders and a later wave through Fairwind.
That is the full confirmed list. Nothing in it names a single competitor score, and nothing in it quotes a named executive or researcher. When a story says Carbon beat a rival, that comparison comes from the index leaderboard or from the outlet doing the writing, not from a Google statement. Readers should hold that distinction in mind through the rest of this article.
The Artificial Analysis Score of 59 Explained #
The Artificial Analysis Intelligence Index bundles several evaluations into one number, which makes it a handy shorthand for comparing frontier models. Version 5.0 is an update, and Google says Carbon ranks first on it with 59. A single-digit gap on a composite index usually reflects small differences spread across many tests rather than a clear win in one area.
That is why the phrase narrowly beating matters. A lead of a point or two on a composite score sits inside the range where prompt wording, tool settings, and reasoning effort can reorder the table. Index operators typically publish the exact configuration behind each entry, and the same model can appear several times at different effort levels. Anyone comparing Carbon to Claude Opus 5.5 should check which configuration of each model the index lists, since a high-effort run and a default run can differ by more than the headline margin.
A second caution applies to any version change. When an index moves to v5.0, scores from older versions do not carry over cleanly. A 59 on v5.0 is not directly comparable with a number from an earlier edition, so cross-generation charts need care. For Carbon, the safe reading is simple: Google reports first place on the current edition, and the current edition is the only fair place to compare it.
Does Carbon Really Beat Claude Opus 5.5? #
Reports say yes, by a thin margin. Our verification of the official material, however, leaves the head-to-head result unconfirmed, because the official pages cited do not publish comparative scores. Both statements can hold at once. A third-party leaderboard can show Carbon ahead while Google’s own announcement stays silent on Anthropic.
Claude Opus 5.5 carries a strong résumé of its own. Anthropic lists an official release date of September 22, 2026, a one-million-token context window, and a 128,000-token maximum output. Anthropic also states that the model is available through the Claude platform and through Amazon Web Services, Google Cloud and Microsoft Azure. Our own coverage of the Veracode AI code security tie showed Opus 5.5 holding its own on a security-flavored test, so a narrow Carbon edge on a composite index does not make Anthropic’s model obsolete.
The honest summary: Carbon looks ahead on the index Google chose to cite, and independent verification of the margin will take weeks of third-party runs. A one-point lead can vanish the moment a tester changes the harness. Treat the narrow win as a starting hypothesis, not a settled ranking.
The Hallucination Claim, Checked #
The headline most readers will remember says Carbon is the least likely frontier model to hallucinate. The official material does not support that as stated. Google’s page mentions reduced fabrication rates in internal testing, but internal testing on Google’s own model is a long way from an overall ranking against every rival.
Hallucination is also hard to score with one number. A model can invent fewer facts on a closed-book quiz and still fabricate citations in a long agentic run. Benchmarks that reward abstaining when unsure measure a different behavior than benchmarks that reward answering correctly. Reports in the coverage cycle point to a factual-reliability evaluation inside the Artificial Analysis suite where Carbon scores ahead of Opus 5.5, yet those reports also acknowledge there is no single overall hallucination percentage to quote.
For buyers, the practical move is to run a private test. Feed the model twenty documents from your own domain, ask for sourced summaries, and count the invented references. A lower fabrication rate in Google’s lab matters less than a lower rate on your data. Until independent groups publish repeatable results, the least-likely-to-hallucinate label stays a benchmark claim, which is exactly how the original coverage framed it.
SEC-bench Pro, ExploitGym and CWE-bench Results #
The three cybersecurity numbers are the most concrete evidence in the announcement. Together they sketch a model tuned for the full defensive loop. The table below lays out the scores Google reports and what each test generally measures, based on how the benchmarks are described in the coverage.
| Benchmark | Gemini 4 Carbon score | What it generally tests |
|---|---|---|
| SEC-bench Pro | 88.2% | Vulnerability discovery |
| ExploitGym | 54.8% | Exploiting or proving a flaw |
| CWE-bench | 71.0% | Patching known weakness classes |
| Artificial Analysis Intelligence Index v5.0 | 59 (rank #1) | Composite across many evaluations |
Finding Bugs: 88.2% on SEC-bench Pro
The 88.2% figure is the headline cyber result. Discovery tests ask a model to locate a real weakness in code or a described system. A high score suggests Carbon reads code and configuration closely, which fits the long-horizon pitch. It does not tell you how many false positives the model raises in a messy production repo.
Exploiting Bugs: 54.8% on ExploitGym
The lowest of the three scores also carries the most weight for defenders. Proving a flaw is exploitable separates a theoretical bug from an urgent one. At 54.8%, Carbon succeeds on a bit more than half the tasks Google reports. That same capability cuts both ways, which is one reason Google restricts early access to vetted defenders.
Fixing Bugs: 71.0% on CWE-bench
Patching is where security teams feel the labor savings. A 71.0% result implies Carbon fixes a majority of the weakness cases in the test. Real codebases add dependencies, legacy quirks and review requirements, so expect the production success rate to land below the lab figure, as it does for most coding agents.
Pricing: $2 and $10 Against Claude’s $4 and $20 #
Price is where Carbon makes its sharpest argument. Google lists $2 per million input tokens and $10 per million output tokens. Anthropic lists $4 and $20 for Claude Opus 5.5. On list price alone, Carbon costs half as much on both sides of the meter. Our earlier look at Gemini 4 Argon at $2 on Google Cloud shows Google has used that input price point before.
| Item | Gemini 4 Carbon | Claude Opus 5.5 |
|---|---|---|
| Input price per 1M tokens | $2 | $4 |
| Output price per 1M tokens | $10 | $20 |
| Cached input discount | 95% off input price | Not stated in the announcement |
| Context window | Not stated in the announcement | 1 million tokens |
| Maximum output | Not stated in the announcement | 128,000 tokens |
| Release or access | Cyber defenders first, then Fairwind partners | Released September 22, 2026 |
Here is what that means in a workload. Say a security pipeline sends 10 million input tokens and receives 2 million output tokens in a day. At list price, Carbon costs $40 ($20 for input plus $20 for output) while Opus 5.5 costs $80. Now cache 8 million of those input tokens on Carbon. The cached portion drops to $0.10 per million, so the day costs $0.80 for cached input, $4 for the 2 million fresh input tokens, and $20 for output, or $24.80 in total.
Caching rewards agent loops that resend the same system prompt, tool definitions and repository context on every turn. That is the shape of most long-horizon security tasks, so the 95% cache discount may matter more than the headline rate. One caution: some coverage expects Carbon pricing to rise later to match Claude’s rates. Google’s announcement does not say so, so treat the $2 and $10 figures as the confirmed numbers today.
Claude Opus 5.5: Where Anthropic Still Holds Ground #
A cheaper rival does not erase Anthropic’s advantages. Opus 5.5 offers a one-million-token context window and room for 128,000 tokens of output, which suits long document analysis and large code generation. Anthropic also sells it through three major clouds, so enterprises can buy it under an existing AWS, Google Cloud or Azure agreement.
Distribution counts for as much as raw scores. A bank that already routes spend through one cloud vendor can add a model without a new procurement cycle. Carbon, by contrast, starts in a gated program, so most teams cannot even evaluate it this month. That gap gives Anthropic a window where its model is the one buyers can actually deploy.
The other piece of the story involves Anthropic’s own safety work. Our report on Anthropic models breaching three organizations in capture-the-flag tests shows the cyber-capable frontier is not Google’s alone. Both labs now sell models strong enough at offensive tasks that access controls have become a product feature.
The Fairwind Program and Who Gets Access First #
Google says initial access goes to a subset of cyber defenders, followed by additional trusted partners through the Fairwind Program. The company has not published, in the material we reviewed, how many organizations qualify, how it vets applicants, or when general availability arrives. Those gaps are normal at this stage, but they limit what outsiders can verify.
A gated rollout does three things for Google. It limits misuse risk for a model strong at exploitation tasks. It builds a pool of friendly testers who will publish favorable case studies. And it lets Google tune capacity before demand floods in. The cost is slower independent scrutiny, since academics and journalists without access cannot rerun the headline numbers.
If you run a security team and want in, expect to demonstrate a defensive use case and accept usage terms. Prepare a short brief that lists your codebase size, your current vulnerability backlog, and your review process for AI-written patches. Programs like this tend to favor applicants who show they can absorb findings, not just generate them.
The Competitive Field: Argon, Astra and Opus #
Carbon does not arrive alone. Google already ships Gemini 4 Argon, and our Gemini Drops roundup covers how Argon features reached users last month. OpenAI is teasing its next move, as our note on GPT-6.1 Astra and the clone claims explains. Reports in the Carbon coverage also place an OpenAI Astra variant close behind on the Artificial Analysis index.
That crowding is the real story of this quarter. Three labs trade the top spot by a point or two, and each wins in a different lane. Google leans on price and cyber specialization. Anthropic leans on context length, output size and cloud reach. OpenAI leans on its installed base and a steady release cadence.
For a developer choosing a model today, the decision rarely hinges on a one-point index gap. It hinges on latency, tool-use reliability, data residency, and the price of the tokens your agents burn at scale. A model that tops a leaderboard but sits behind a waitlist loses to a slightly weaker model you can call this afternoon.
Historical Context: Leaderboards Flip in Weeks #
Anthropic released Opus 5.5 on September 22, 2026. Roughly six weeks later, a Google model is taking the index lead. That pace is typical for the current cycle, where each frontier release holds the top spot for a month or two before a rival leapfrogs it. No lab has kept a durable lead through 2026.
The pattern changes how buyers should read announcements. Locking into one vendor on the strength of a single index win has proven risky, because the ranking can reverse before a contract finishes procurement. Teams that build a thin abstraction layer over model calls can switch providers in days. Teams that hard-code one vendor’s tool format pay a migration tax each time the lead changes.
Price has followed a similar path. Google’s earlier Gemini releases leaned on low token prices to win developers, and our look at the Gemini 3.1 Pro $2/$12 pricing shows the same playbook. Carbon extends it with a $10 output rate and a steep cache discount.
Market Impact for Developers and Security Teams #
The immediate winners are security vendors and internal red teams with access to the first wave. A model that scores 88.2% on discovery and 71.0% on patching can compress triage queues that currently take engineers days. Even if production results land below the lab numbers, a partial gain on a backlog of thousands of findings adds up quickly.
The pressure falls on rivals’ pricing. With Carbon listed at half of Opus 5.5’s token rates, Anthropic and OpenAI face questions from customers at the next renewal. Neither company has announced a price move in response, and we will not guess at one. Price cuts, if they come, will show up on public rate cards, so watch those pages.
Defenders also inherit new risk. A model good at exploiting flaws will eventually reach people with worse intentions, whether through leaks, copycat models or stolen credentials. Google’s staged access acknowledges that. Security leaders should assume attackers will soon run comparable tools and should tighten patch cadence now. For wider reading on this beat, browse our AI and machine learning coverage.
What Stays Unconfirmed #
A ledger helps here, since the coverage mixes confirmed facts with reported claims. The table sorts each major statement by how well the available official material supports it.
| Claim | Status | Basis |
|---|---|---|
| Product is named Gemini 4 Carbon | Confirmed | Google official blog |
| Scores 59, ranks #1 on Artificial Analysis v5.0 | Confirmed (reported by Google) | Google official blog |
| 88.2% SEC-bench Pro, 54.8% ExploitGym, 71.0% CWE-bench | Confirmed (reported by Google) | Google official blog |
| $2 input, $10 output, 95% off cached input | Confirmed | Google announcement |
| Access via cyber defenders, then Fairwind | Confirmed | Google announcement |
| Narrowly beats Claude Opus 5.5 | Unconfirmed | No comparative scores on cited official pages |
| Least likely frontier model to hallucinate | Unconfirmed | Google cites reduced fabrication rates in internal tests only |
| Named-person endorsement | Unconfirmed | No on-record quote in official material |
Notice the pattern. Everything Google controls, such as names, its own scores and prices, is confirmed. Everything that requires a comparison with another company’s product rests on third-party reporting. That is a normal split for a launch day, and it will narrow as independent testers publish.
Five Predictions for Carbon and the Frontier Race #
These are forecasts, not reported facts. Each one flows from the confirmed details above, and each could miss.
- The index lead will shrink or flip within two months. A one-point margin on a composite score rarely survives the next release from a rival lab.
- Independent cyber benchmarks will land below Google’s figures. Vendor-run numbers tend to exceed third-party reruns, especially on exploitation tasks.
- Rivals will respond on cached-token pricing before list price. A 95% cache discount is the easiest feature to match and the hardest to ignore for agent builders.
- Fairwind will widen in stages. Expect additional partner cohorts before any general release, with usage terms tied to defensive work.
- Security vendors will announce Carbon integrations first. Teams already inside the early-access group have the strongest incentive to publish case studies.
How to Evaluate Carbon Before You Commit #
Skip the leaderboard and build a small, honest bake-off. Pick 50 real tasks from your own backlog. Include a mix of vulnerability triage, patch drafting, and long agent runs with tool calls. Run each task against Carbon when you gain access, against Opus 5.5, and against whatever model you use now.
Record four numbers per model: success rate, cost per completed task, wall-clock time, and the count of fabricated references or invented function names. Cost per completed task matters more than price per token, because a cheaper model that needs two retries can cost more than an expensive one that succeeds the first time. Have a human reviewer grade outputs blind, so brand bias stays out of the results.
Finally, test the cache. Resend the same long context across thirty turns and compare the bill to the uncached estimate. If Carbon’s cache discount behaves as announced, the savings on agent loops could exceed the headline halving versus Claude. If it does not, you will know before you sign anything.
Frequently Asked Questions #
What is Gemini 4 Carbon? It is Google’s newest frontier model, described on its official blog as focused on cybersecurity and long-horizon capabilities. Google reports a score of 59 and the number one rank on the updated v5.0 Artificial Analysis Intelligence Index.
Does Gemini 4 Carbon beat Claude Opus 5.5? Reports from outlets including Tom’s Hardware say it does, by a narrow margin. Google’s official pages do not publish a head-to-head result, so the comparison stays unconfirmed by the company.
Is Carbon the model least likely to hallucinate? That is a benchmark claim in the coverage. Google’s page mentions reduced fabrication rates in internal testing but does not establish that Carbon is the least hallucination-prone model overall.
How much does Gemini 4 Carbon cost? Google says $2 per million input tokens and $10 per million output tokens. Cached input tokens are priced at 95% off the input price, which works out to $0.10 per million.
How does that compare with Claude Opus 5.5 pricing? Anthropic lists $4 per million input tokens and $20 per million output tokens for Opus 5.5. At list price, Carbon costs half as much on both input and output.
Who can use Carbon right now? Google says initial access goes to a subset of cyber defenders, followed by additional trusted partners through its Fairwind Program. General availability has no confirmed date in the official material.
What cybersecurity scores did Google report? Google reports 88.2% on SEC-bench Pro, 54.8% on ExploitGym, and 71.0% on CWE-bench. These are vendor-reported figures that independent testers have yet to reproduce.
When did Claude Opus 5.5 launch, and what are its specs? An official Anthropic listing gives September 22, 2026. Anthropic lists a one-million-token context window and a 128,000-token maximum output, and says the model runs on the Claude platform, Amazon Web Services, Google Cloud and Microsoft Azure.