Google's Gemini 4 Carbon tops the chart. Only cyber defenders can use it

On Tuesday 28 October 2026 Google announced Gemini 4 Carbon, calling it 'our strongest model with state-of-the-art cybersecurity and long horizon capabilities'. It comes four weeks after Gemini 4 Argon, which we covered on 2 October, and two weeks after Argon opened to developers. The post was timed for the afternoon of Alphabet's third-quarter earnings; as one Hacker News commenter put it, 'this lets them talk about it on their earnings call in a few hours'.

Carbon is not a model you can use. Starting this week Google is giving it to 'a subset of cyber defenders', then to further trusted partners through its programme for vetted security teams, while the US government tests it under its voluntary pre-release scheme. Developers, businesses and consumers come 'as soon as possible', with no date. The announcement also says the model has run for days at a stretch inside Google on multi-step engineering jobs such as finding and patching subtle bugs across large codebases.

The claim that travelled furthest is the ranking. Artificial Analysis, the independent firm whose Intelligence Index is the most quoted single score for AI models, published version 5 of the index on 27 October and the next day listed Carbon at the top with 59. Claude Opus 5.5 from Anthropic scores 58, OpenAI's GPT-6 Astra 57, GPT-6.1 Sol 55, and Google's own Argon 50. The index now draws 60% of its score from private test sets that nobody outside the benchmarking firm can inspect, which was itself a topic of argument on Hacker News this week.

The security numbers, which Google reports itself and labels as run 'without guardrails': 88.2% on SEC-bench Pro, a test of finding real vulnerabilities in real software; 54.8% on ExploitGym, which checks whether a model can prove a vulnerability is actually exploitable; and 71.0% on CWE-bench, a test of writing working fixes. Google calls each of these state of the art. It adds that Carbon is more than twice as likely as Argon to produce secure code on internal tests, that the Chrome browser team found it 'more than 10X better than another lab's large frontier model' at producing good patches, and that Wiz, the cloud security company Google bought, sees it leading on web penetration testing. None of these have been checked by anyone outside Google.

The behaviour numbers are the part developers cared about most. Google says Carbon's successful cheating on Terminal-Bench 4.0 (a test where models complete tasks in a command-line terminal, and where models have been caught gaming the grader) fell to 0.0%, with attempts at 0.4%; that high-severity 'misalignment alerts' in Google's own coding teams fell by almost 80%; that unsupported claims in its output halved against Argon; and that it scored 0.0% attack success on Gray Swan's indirect prompt-injection benchmark, where Argon had 0.7%. On the web-development leaderboard Google cites, Carbon gained 89 Elo points to reach fourth place.

Price and shape. Carbon costs the same as Argon: $2 per million input tokens and $10 per million output tokens during an introductory period, then $4 and $20, with cached input at a 95% discount. It has a one-million-token context window. Several Hacker News readers took the identical price as a sign that Carbon is Argon's successor in the same tier rather than a step up, 'more like Argon 4.1', and complained about the naming: Argon, then Carbon, with no B. Artificial Analysis's cost-per-task figure, which measures how many tokens a model burns to finish its test suite, puts Carbon at $7.76 against $10.04 for Opus 5.5 at its highest setting; one reader noted that Carbon used about 30% fewer tokens than Opus to get there.

The business around it. Alphabet reported revenue of $127.6 billion for the quarter, up 25%, and Google Cloud revenue of $30.7 billion, up 103% on a year earlier, driven by selling AI computing. Shares fell about 8% after the results, with search advertising growing more slowly than the market wanted. Google's announcement does not say which chips Carbon trained on or how big it is.

Imagine a car maker announcing that its new model has won the big magazine comparison test, posting the lap times, and then explaining that for now only police fleets may drive it, with public sales 'as soon as possible'. The lap times may well be real. But a comparison test between a car you can buy and one you cannot is a comparison between a product and a press release, and the magazine's new scoring rules, which keep most of the test course secret, make the gap of one point hard to interpret.

The reason for the police-first rollout is not marketing. A model this good at finding and exploiting software holes is equally useful to attackers, so Google is letting defenders patch first, the same logic that had it release Argon to security teams for two weeks before anyone else.

The staged release is not new; it is now the standard way the biggest models come out. Anthropic did it with Mythos 5.1, a model it still only gives to approved organisations; Google did it with Argon, announced on 30 September and opened to developers on 13 October; and Carbon follows the same two-step. What is new is the cadence. Google has now announced two top-tier models in four weeks, which is the clearest sign yet of how hard it is pushing to stay level with Anthropic and OpenAI after a year in which, by Artificial Analysis's own numbers, Argon landed nine points below the leaders.

Being first on the index is also not the same as being first for users. The Hacker News thread, 757 points at the time of writing, was split between people impressed by the anti-cheating and honesty figures ('an AI company actually just said fabrication instead of hallucination') and people who have stopped clicking on Google launch posts because the model is never available where they are. Several pointed out that Anthropic and OpenAI are expected to ship their next flagships before Carbon reaches the public, at which point the top of the chart moves again. Google's gap to Opus 5.5 is one point on an index whose private tests cannot be re-run by anyone else.

For anyone building software, the numbers to watch are not the ranking but the behaviour ones: a model that does not game its own tests, says when it does not know, and resists instructions smuggled in through the documents it reads is worth more in daily use than one extra index point. If Google's figures hold up outside Google, Carbon is the first frontier model to claim a clean sheet on both cheating and prompt injection, and the others will have to match it.

For the industry, the message is the same one we drew from Argon: the most capable models now come out defenders-first, government-tested, and weeks or months before the public sees them. Expect the chart to be rearranged again before Carbon reaches your account, and treat any 'number one' claim about a model you cannot use as exactly that. The price is the one thing you can already act on: Google is holding the top tier at $2 and $10, which puts pressure on everyone else's.