Google has introduced Gemini 4 Carbon, a new frontier AI model that improves on its two-week-old predecessor in coding, autonomous engineering and cybersecurity tests. Access is initially limited to selected cybersecurity specialists, with a broader release planned after further testing and feedback.
The model leads version 5.0 of the Artificial Analysis Intelligence Index with a score of 59, compared with 50 for Gemini 4 Argon. Its strongest results include complex reasoning, knowledge retrieval and scientific tasks. But the launch centers on its security capabilities, which Google says warrant a staged rollout rather than immediate public availability.
Carbon covers several stages of software defense: identifying vulnerabilities, checking whether they are exploitable and developing fixes. It scored 88.2 percent on SEC-bench Pro, an evaluation of autonomous vulnerability discovery in real-world software, and 54.8 percent on ExploitGym, which tests the ability to turn vulnerabilities into working exploits. It ranked first on both benchmarks and also led CWE-Bench, which evaluates security fixes.
Those results require some qualification. Google ran several security evaluations without safety guardrails, so the scores do not necessarily describe how the model will behave in its released configuration. The ability to produce exploits also illustrates the dual-use nature of cybersecurity models: capabilities useful for validating a defensive fix can also help develop an attack.
Google reports additional improvements from internal testing, including a higher success rate in generating secure code. Those findings have not been independently verified. The company says its engineering teams have also used Carbon for tasks lasting multiple days, including root-cause analysis and difficult bug fixes in large codebases and low-level software.
Resistance to indirect prompt injection improved in a Gray Swan evaluation. Google reported that the attack success rate fell from 0.7 percent with Argon to zero with Carbon across the tested attempts. Such attacks seek to redirect an AI system through malicious instructions embedded in material it encounters, such as documents or tool results. Blocking every attempt in one evaluation does not establish protection against all possible attacks.
Independent evaluations show a more mixed picture outside the headline rankings. Carbon improved its agentic coding score on Antigravity from 53 to 59, but remained three points behind Claude Code with Opus 5.5. It also reached fourth place in WebDev Arena, gaining 89 Elo points over Argon.
Reliability findings vary by test. Google says Carbon produces fewer unsupported claims than Argon in its evaluations. Artificial Analysis, however, measured an increase in both answer accuracy and hallucination rate: accuracy rose from 48 to 58 percent, while the hallucination rate increased from 4 to 11 percent. These separate measurements should not be treated as interchangeable assessments of reliability.
More capable reasoning can also mean longer waits. In Vals AI's Finance and Tax Agent benchmark, Carbon took more than twice as long as Argon, while legal research tasks averaged over 50 minutes. Across that evaluation platform's measurements, it generated 2.3 times as many reasoning tokens and 64 percent more output tokens than its predecessor.
Google is participating in the U.S. government's voluntary pre-release testing process and plans to expand access through its Fairwind Program before opening Carbon more broadly to developers, businesses and consumers. No firm date for general availability has been announced. Introductory API pricing matches Argon at $2 per million input tokens and $10 per million output tokens; Google has not specified when Carbon's introductory pricing will end.
Sources: The Verge (AI), The Decoder, Ars Technica (AI)