# Google’s Gemini 4 Carbon tops the AI leaderboard, but only cyber defenders get it first > Source: > Published: 2026-10-28 18:00:00+00:00 Google DeepMind’s launch artwork for Gemini 4 Carbon. Image: Google DeepMind Google DeepMind has [unveiled Gemini 4 Carbon](https://deepmind.google/blog/gemini-4-carbon-our-next-frontier-model/), the model it calls its strongest yet, and says it has taken first place on the Artificial Analysis Intelligence Index, a leaderboard Anthropic’s Claude Opus 5.5 has been leading. Most people can’t try it, though: like [Gemini 4 Argon a month ago](https://madrobot.blog/2026/09/30/google-gemini-4-argon-launch-cyber-defenders-price-1m-output-tokens/), it goes first only to a small group of cyber defenders. Google describes Carbon as its model “with state-of-the-art cybersecurity and long horizon capabilities”. It builds on Argon, which [reached paying Gemini subscribers and the API](https://madrobot.blog/2026/10/13/google-gemini-4-argon-available-ai-pro-ultra-api-robotics/) only two weeks ago, and makes it two Gemini 4 models in a month, after DeepMind boss Koray Kavukcuoglu promised in September that Gemini 4 would come [“much earlier” than expected](https://madrobot.blog/2026/09/25/gemini-4-coming-much-earlier-deepmind-kavukcuoglu/). ## First place, by one point Google says Carbon scores **59** on version 5.0 of the Artificial Analysis index, which was updated recently. Artificial Analysis gives [Claude Opus 5.5](https://madrobot.blog/2026/09/23/claude-is-so-back-opus-5-5/) 58 at its maximum effort setting, and Argon 53 on its high setting, so if the figure holds, Carbon has moved Google from well behind to just ahead. Artificial Analysis hadn’t yet listed Carbon in its public comparison tables at the time of writing, so for now the score is Google’s claim. Carbon also climbed 89 Elo points on WebDev Arena, the public leaderboard where people vote on websites and apps built by rival models, to fourth place with 1,769. The bigger claim is about stamina. Google says its own teams have watched Carbon “run for days to persist through dead ends” on hard engineering jobs, such as tracking down and patching subtle bugs across large codebases and low-level systems. ## Built to find bugs, exploit them and fix them Cybersecurity is where Google pushes hardest. It reports Carbon’s scores with its guardrails switched off on three outside benchmarks covering each step of a defender’s job: - **Finding flaws:** 88.2% on SEC-bench Pro, which tests whether a model can uncover real vulnerabilities in real software. - **Exploiting them:** 54.8% on ExploitGym, which checks whether a model can prove a flaw is exploitable, so teams know what to fix first. - **Patching them:** 71.0% on Collinear’s CWE-bench, which measures whether its fixes actually work. Google says all three are state of the art. On its own tests, Carbon is more than twice as successful as Argon at writing secure code, and Google’s Chrome team found it more than 10 times better at producing high-quality patches than “another lab’s large frontier model”, which Google didn’t name. Wiz, the cloud security company Google now owns, says Carbon leads its web penetration testing benchmarks. None of the internal figures have been checked independently. ## Fewer cheats, fewer made-up claims Google also says Carbon behaves better than Argon. On Terminal-Bench 4.0, a coding test, it cut successful cheating to 0.0%, with attempts down to 0.4%, while scoring higher overall. In live coding work with Google’s own teams, high-severity misalignment alerts fell by almost 80%. It makes about half as many unsupported claims as Argon, according to Google, and is more likely to flag what it couldn’t do than to cover the gap. Overreach, where a model does more than asked, fell by 26%, and under-delivering by 29%. On Gray Swan’s benchmark for indirect prompt injection, the hidden instructions attackers plant in web pages and files, no attack succeeded, against 0.7% for Argon. ## Who can use Gemini 4 Carbon, and what it costs Google calls the rollout “deliberate”. Carbon is going through the US government’s voluntary pre-release testing, and starting this week a subset of cyber defenders gets access. More trusted partners follow in stages through Google’s [Fairwind Program](https://deepmind.google/fairwind-program/), while Google gathers feedback and adjusts guardrails. Developers, businesses and consumers come after that, “as soon as possible”. Google gave no date and hasn’t said which countries the wider release will cover. The price is already set, at the same introductory rate as Argon: $2 per million input tokens and $10 per million output tokens, with cached input 95% cheaper. Argon’s introductory price runs until November 30 and then doubles; Google hasn’t said whether Carbon’s will follow the same schedule. Holding a top model back for defenders is becoming the norm for the biggest labs: Anthropic did the same with [its Mythos Preview model through Project Glasswing](https://madrobot.blog/2026/09/29/anthropic-glm-5-3-zai-cyber-exploits-safeguards-open-weight/), and security firms such as [Palo Alto Networks](https://madrobot.blog/2026/09/22/palo-alto-networks-mythos-gpt-5-6-cyber-continuous-frontier-ai-defense/) now sell around-the-clock defence built on those restricted models. ## Why it matters Google can now claim the top spot on the most watched independent ranking, only two weeks after Argon reached customers. But a model good enough at hacking that Google won’t release it widely yet is also a sign of where the risks are heading, and the wait for everyone else has no end date. *Sources: [Google DeepMind](https://deepmind.google/blog/gemini-4-carbon-our-next-frontier-model/), [Fairwind Program](https://deepmind.google/fairwind-program/), [Artificial Analysis](https://artificialanalysis.ai/models/comparisons/gemini-4-argon-vs-claude-opus-5-5)*