Google released a frontier model on Wednesday that almost nobody can touch. Gemini 4 Carbon sits at #1 on the Artificial Analysis Intelligence Index v5.0 with a score of 59, ahead of Claude Opus 5.5 and GPT-6 Astra. This week it is available only to a subset of cyber defenders. Everyone else waits for Google’s Fairwind Program to widen, then for a developer and consumer release that the company dates only as “as soon as possible.”
I think that’s correct, and the benchmark sitting in the middle of Google’s list is the reason.
The exploitation number
Carbon’s headline cyber scores are 88.2% on SEC-bench Pro, which measures finding vulnerabilities, and 71.0% on CWE-bench, which measures patching them. Those are the defender-friendly numbers. The one between them is ExploitGym, where Carbon scores 54.8% and sets a new state of the art for exploiting bugs.
Google frames exploitation as triage. Defenders need to know which holes are real before deciding what to fix first. Fair enough. But a model that finds nearly nine in ten real vulnerabilities and can exploit more than half of a standard exploitation suite is an offensive tool no matter whose hands it’s in. Google also says its internal teams have watched Carbon run for days, working through dead ends on multi-step engineering problems. That is a model that can grind on a target far longer than a human red team will stay awake.
Putting that straight into a public API would be reckless. Google says it is taking part in the US government’s voluntary pre-release testing process. For a model with this profile, I’d treat that as the minimum.
What developers get, eventually
For everyone outside the defender list, the useful facts are price and behavior. Carbon will launch at Argon’s introductory rate: $2 per million input tokens and $10 per million output tokens, with cached input 95% off. That is aggressive for the top model on the index. It matters most for the long agent loops Google is pitching, where the same codebase context gets re-read thousands of times.
I’d test the behavioral claims first. Google says Carbon cuts unsupported claims in half compared with Argon, resists prompt injection better, and shows lower fabrication rates in live coding with its own teams. For anything running unattended for days, fabrication rate matters more than leaderboard position. A model that confidently invents a function signature 30 hours into a run is worse than a weaker one that stops and asks.
On web development, Carbon gained 89 Elo points on WebDev Arena to reach 1768. That puts it at #4, not first, in an announcement otherwise built around firsts.
The pace problem
Argon launched two weeks ago. Carbon now beats it on paper, but Argon is still the Gemini 4 model most people can actually call. That split will get awkward. Google is advertising one model’s capabilities while customers build on another, and much of the gap between them comes from internal benchmarks outsiders can’t reproduce, such as the claimed 2x improvement over Argon in generating secure code.
Some comparisons deserve more scrutiny. The Chrome team reportedly found Carbon “more than 10X better” at generating high-quality patches than “another lab’s large frontier model.” Google doesn’t say which lab, which model, or how the test was measured.
So the scorecard is impressive and mostly unverifiable for now. For most readers, the model that matters is the one that ships at $2 and $10, and Google hasn’t given it a date.