Gemini 4 Carbon: Why Google Handed the Keys to the Locksmiths First

Two weeks. That's how long Gemini 4 Argon had to enjoy being Google's best model before Gemini 4 Carbon turned up on 28 October and took the title. Google calls it "our next frontier model", which, at the current rate of release, feels less like a milestone and more like a weather report.

Back in June I wrote about Google's long game in AI, and Carbon looks very much like that game being played out. But the thing that caught my attention wasn't the benchmark chart. It was the guest list. You and I can't use Carbon yet. The first people through the door are cyber defenders, and I think that tells us more about where this industry is heading than any leaderboard does.

Top of the Table, Just

Let's get the headline out of the way, because for once it's independently verified. Artificial Analysis puts Carbon at 59 on its Intelligence Index v5, which makes it number one. Claude Opus 5.5 sits on 58, GPT-6 Astra on 57, and Argon trails at around 50.

One point. That's the lead.

Dig a little and the picture gets more interesting. On the Coding Agent Index, Carbon scores 59 in the Antigravity CLI, while Claude Code with Opus 5.5 scores 62. It comes second on Terminal-Bench 4.0 at 64%, and second again on FrontierCode v1.1, with 51% to Opus's 56%. On knowledge work it makes a big jump over Argon, then still finishes behind Grok 4.7, Muse Wonder and Kimi K3.1 Pro.

So yes, Carbon is top of the table. It just isn't top of everything, and if you're picking a model to do real work, that's the part that matters.

The Locksmith Problem

Google spends a lot of its launch post on security, and the numbers are eye-catching. It reports 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on ExploitGym for exploiting them, and 71.0% on Collinear's CWE-bench for patching them, all evaluated without guardrails. Internally, Google says Carbon is more than twice as good as Argon at writing secure code. Its own Chrome team reckons it's more than 10x better than "another lab's large frontier model" at producing patches, and Wiz says it leads on web penetration testing.

Here's the uncomfortable bit. A model that's brilliant at finding holes in software is brilliant at finding them for whoever is asking. The skill is identical; only the intent changes. Every locksmith knows this. It's why they don't hand out lock picks at the door.

I'd also keep a pinch of salt handy. These cyber scores are Google's own, and as far as I can find, nobody has independently reproduced them yet. The Chrome comparison doesn't name the model it beat. Wiz hasn't published any numbers. And NeuralTrust reports one reviewer's point that the ExploitGym headline used a 10-hour time cap against 6 hours for Opus 5.5; at 6 hours, Carbon scores 53.5%. Still very good. Just not quite as good as the slide.

Defenders First, the Rest of Us Later

This is the part of the launch I keep coming back to. Carbon is going to a subset of cyber defenders first, then gradually to more trusted partners through Google's Fairwind Program. For developers, businesses and the rest of us, the official word is "coming soon". No date. Google also says it's taking part in the US government's voluntary pre-release testing.

Is that responsible deployment, or very clever marketing? I think it's both, and I don't think that's a bad thing. If attackers are going to get this kind of capability eventually, from somewhere, then giving the defenders a head start is a sensible use of a lead. It also happens to produce a press release that more or less writes itself. Argon went down exactly the same road and is now in the Gemini app and AI Mode in Search, so there is precedent for the doors opening.

Under the Bonnet

Some of the less glamorous details are worth knowing before you get excited.

Pricing starts at an introductory $2 per million input tokens and $10 per million output, the same as Argon. After that it doubles to $4 and $20, with cached input at 95% off. Nobody has said when the introductory period ends, which is the commercial equivalent of a sale sign that's been in the window since March.

At standard pricing, Artificial Analysis puts the cost of an Intelligence Index task at $7.76. That's about 23% cheaper than Opus 5.5 at $10.04, and about 1.2x GPT-6 Astra at $6.25. Carbon used around 123k output tokens per task, 29% fewer than Opus. You get a 1M-token context window, with text, image, video and speech in, and text out.

Then there's honesty, where things get a little more human. Google says Carbon makes about half as many unsupported claims as Argon, oversteps 26% less often, and triggers almost 80% fewer high-severity misalignment alerts in its internal coding environments. Yet on Artificial Analysis's AA-Omniscience test, its hallucination rate went up, from Argon's 4% to 11%. It knows more, and it's also more willing to have a guess when it doesn't. To be fair, 11% is still the second-lowest rate they measured; Opus 5.5 and GPT-6 Astra both sit at 50%. Different tests, measuring different things. But it's the kind of detail that never makes the keynote.

So What Do We Actually Do?

For now, nowt, because we can't use it. When we can, my advice is fairly unglamorous.

Test it against your own work. A one-point lead on someone else's index says very little about your codebase, your stack or your agent harness. Budget at $4 and $20, not $2 and $10, because introductory prices have a habit of ending; and treat the security claims as a strong direction of travel rather than a settled verdict, at least until someone outside Google has had a proper look.

What I find most interesting isn't Carbon itself. It's that frontier models are now good enough at offensive security that their makers are choosing who gets them first. That's a real shift in how this technology reaches us, and I doubt Carbon will be the last model to arrive this way.

The real story isn't that Carbon came first; it's who Google let in first.