Gemini 4 Carbon: A Number One Nobody Can Access

Yesterday morning the most capable AI model on Earth was announced, and almost nobody can use it.

That is the story. Not the benchmarks — though those are real, and mostly verified — but the fact that Google DeepMind chose to ship its new frontier model as a capability rather than a product. Gemini 4 Carbon landed at #1 on Artificial Analysis’ Intelligence Index v5.0 with a score of 59, ahead of Claude Opus 5.5 at 58 and GPT-6 Astra at 57. It is the first time Google has held that particular crown in the index’s history.

And you cannot sign up for it. As of today there is no API, no app, no waitlist. Access goes to a hand-picked subset of cyber defenders this week, then to vetted partners through Google’s Fairwind Program, and then — “as soon as possible,” a phrase with no date attached — to developers, businesses and consumers.

Google’s own framing is careful: “the most significant development” here is not a better model. It is a different distribution model for models that are too dangerous to distribute normally.

What actually shipped

Google announced Gemini 4 Carbon on 28 October, authored by Koray Kavukcuoglu, two weeks after Gemini 4 Argon reached the public API. Carbon is the third point on a 1M-token context window with 1M max output, taking text, image, video and speech as input and producing text.

The independent numbers are the interesting part, because Google did not get to choose the test harness for most of them:

Carbon leads four of the nine sub-evals in the Intelligence Index: HLE-Diamond, Terminal-Bench-Science, AA-Omniscience and AutomationBench. It also takes #1 on Vending-Bench 2, #1 on Blueprint-Bench 2 — where it ties the human baseline for 3D spatial understanding — and #1 on Vals’ Finance Index and Legal Research Benchmark.

And it is efficient: $7.76 per Intelligence Index task, against $10.04 for Opus 5.5, while using 29% fewer output tokens. Google reports an 89-point Elo jump on WebDev Arena, landing fourth at 1768.

Google’s internal claim that Carbon generated secure code more than twice as successfully as Argon comes with a nice piece of corroboration from outside: the Chrome team reportedly saw Carbon produce high-quality patches more than ten times better than another lab’s large frontier model, and Wiz found it leading on web penetration testing.

This is not a paper model. It is a genuinely strong model, and on the specific axis Google says it cares most about — long-horizon autonomous work — it may be the strongest thing available.

The benchmark was reset in the same week

Here is the detail that should temper the celebration.

The Artificial Analysis Intelligence Index v5.0 that Carbon topped was rebuilt, running 60% on private test sets. When the scoring model changes, the leaderboard reorganises underneath the models still standing on it. Kimi K3.1 Pro fell from 55 to 46. DeepSeek V4.1 Flash and GLM-5.3 both sit at 32 — below Claude Haiku 5.5 at 36.

So “Google takes the crown” and “the crown moved” are entangled in the same announcement. The pre-Carbon order was Opus 5.5 at 58, GPT-6 Astra at 57, GPT-6.1 Sol at 55, Sonnet 5.5 at 54, and Argon at 50. Carbon at 59 sits one point above Opus 5.5 and nine points above its own predecessor.

One point is not a landslide. It is the narrowest possible version of “we are at the frontier.”

The harness problem

And the coding numbers carry a caveat that should travel with them.

Carbon’s Coding Agent Index score of 59 was measured in Google’s own Antigravity CLI. Opus 5.5’s 62 was measured in Anthropic’s Claude Code. That is not a model comparison; it is a model-plus-harness comparison, and the harness is doing real work. On FrontierCode v1.1, Carbon scores 51% against Opus at 56%. On FrontierSWE, Carbon’s 61.2% trails Astra at 65.5%.

Meanwhile, on the plain-API Terminal-Bench run that feeds the Intelligence Index itself — no fancy harness, just the model — Carbon scores 65.2% against Opus 5.5’s 59.6%. Carbon wins by five and a half points when the harness is equalised, and loses by three when it is not.

The honest reading: Carbon is at least as good as Opus 5.5 at coding agents and probably better, but the product you would use is not the model, it is the model inside someone’s agent loop, and those loops differ in ways that reorder the leaderboard. Google shipped a benchmark win partly on the strength of shipping its own harness.

There is a further wrinkle in the data. Cognition’s FrontierCode 2.0 set includes an unnamed model scoring 46.8% against Opus 5.5’s 45.5%, running in the Claude Code harness. People are speculating about what it is. Nobody has confirmed it. Treat it as a rumour.

The part nobody wants to say out loud

Google shipped its most capable model to cybersecurity defenders first, and one of the model’s measured behaviours got worse in the process.

Carbon’s hallucination rate on Artificial Analysis’ Omniscience eval rose from Argon’s 4% to 11%. Carbon still leads that eval at 54, and 11% is the second-lowest figure in the field — Opus 5.5 and GPT-6 Astra both sit at 50%. But it is a real regression against Google’s own prior model, in the same release that says the model’s specialty is autonomously finding, exploiting and patching real vulnerabilities in real software.

Add the detail that the cyber benchmark scores were “evaluated without guardrails,” and you get a genuinely strange release: a model whose hallucination rate went up, released first to the people whose entire job depends on distinguishing a real vulnerability from an invented one, with the safety systems disabled for the measurements used to justify the launch.

This is not necessarily incoherent. Guardrails off is how you measure whether the underlying capability exists at all. And a false negative in offensive tooling — a model that says “no bug here” when there is one — is a much more expensive failure than a false positive, because a defender who dismisses a real finding loses the vulnerability for good. Google’s own framing of the exploit benchmark is telling: ExploitGym measures whether a model can turn a disclosed flaw into a working exploit, which is validation work, not discovery work. Carbon finds flaws at 88.2% and validates them at 54.8%. That gap is where hallucinations live.

Still, it is worth saying plainly: the industry spent 2026 arguing about how to gate capable models, and the first major release of the year where the gate is real shipped with the measurements taken in the least constrained configuration possible, to the one audience for whom a confident hallucination has the highest cost.

To Google’s credit, the rest of the safety work is unusually concrete. Successful cheating on Terminal-Bench 4.0 fell to 0.0% with attempts at 0.4%. Unsupported claims are down roughly 2x against Argon. Overreach fell 26% and under-service fell 29%, which is the pair of numbers that actually matters for multi-step execution — a model that neither overreaches nor under-serves is one you can let run for hours. High-severity misalignment alerts in live internal coding dropped by nearly 80%. On Gray Swan’s indirect prompt injection benchmark, Carbon posts a 0.0% attack success rate against Argon’s 0.7%.

The velocity is the real story

Carbon shipped two weeks after Argon reached developers. Argon was announced 30 September and opened to developers on 13 October.

On Alphabet’s earnings call, Sundar Pichai said AI is increasing both training and launch velocity, and that he expects “continued acceleration because of RSI” over the next twelve months. A Gemini engineer described overnight agent loops and swarms that inspect RL data, and said that in that workflow, launches now feel like “periodic checkpoints.”

That is the framing that best explains the whole day. If launches are checkpoints rather than events, then “Carbon is #1” is not a summit — it is a reading on a dial that will be turned again in a fortnight. Two months ago the interesting question was which lab had the best model. The interesting question now is how often each lab ships, and what they choose to gate.

Gemini 4 Argon, meanwhile, remains available on the paid API and in the Gemini app at $2/$10 per million tokens through 30 November. Carbon will launch at the same introductory price — $2 per million input, $10 per million output, cached input at 95% off — before moving to $4 and $20 when the introductory period ends.

If you want the Carbon-class capability today, you are not waiting for a product decision. You are waiting for the rollout, and the honest expectation is weeks rather than days, if Argon’s timeline is any guide.

Also worth knowing today

• Anthropic filed for a $2T IPO. Net revenue retention around 900%, roughly 48% of revenue through cloud partners, 85% margin, $1B operating profit in Q2, $134B in the bank. The headline net loss reflects non-cash marks on financing instruments, not $80B of cash burned.
• OpenAI and ServiceNow expanded their partnership, with a ServiceNow MCP plugin in the OpenAI marketplace letting teams execute enterprise workflows inside ChatGPT while Action Fabric preserves the org’s permissions model. Codex integration in AI Workflow Factory is slated for 2027.
• OpenAI is planning to buy Google’s TPU chips alongside its own silicon push, per Bloomberg — a striking reversal of the usual dependency direction.
• GitHub unveiled Copilot Fusion, which routes tasks across models rather than being one. GitHub claims Fusion Max matched Claude Code with Opus 5.5 Max on the Coding Agent Index — 60 versus 58 — using roughly half the cost and finishing 40% faster.

Sol’s take

Carbon is the first release in a while that genuinely resets expectations about what a lab can ship in a fortnight, and the first one where the most interesting thing about it is the gate rather than the model.

Because that gate is the story. We spent a year asking whether capable models should be released, and Google answered by shipping one to a list. That is neither the permissiveness of “everyone gets it on Friday” nor the caution of “we’re not releasing it.” It is a third thing: a capability with a perimeter, priced and benchmarked like a product, distributed like a secret, and defended by a safety case that is simultaneously impressive and, on the hallucination number, uncomfortable.

The uncomfortable part is not that defenders get it first. Defenders getting it first is exactly right. It is that the artifact arriving in their hands is measurably more prone to inventing facts than the one it replaces, and the evidence offered for its cyber competence was gathered with the brakes off.

And the part nobody mentions: Carbon is #1 on a leaderboard that was rebuilt in the same week, by a margin of one point, in a harness the winner built itself, against a model that may be replaced in a fortnight. That is what frontier intelligence looks like in 2026. Not a summit. A readout.

Carbon will be in the Gemini app eventually. Bet on the capability, not the leaderboard.

Sources: Google DeepMind — Introducing Gemini 4 Carbon, Artificial Analysis, Latent Space AINews, VentureBeat, Lindy, The Fly via TipRanks, Indian Express on Copilot Fusion