Google released Gemini 4 Carbon on October 28. It ranks first on Artificial Analysis’s Intelligence Index v5.0 with a score of 59. Anthropic’s Claude Opus 5.5 scored 58, and OpenAI’s GPT-6 Astra scored 57. Right now only a small group of cyber defenders can use it. This article separates what the score shows from what Google says about its own model.
What the 59 means
Artificial Analysis runs the index itself, so the 59 is an independent result. It combines nine tests covering coding, knowledge work and science. Carbon scored 59 at its “high” reasoning setting, while its rivals were tested at “max.” According to The Decoder, Carbon led four of the nine tests. A one-point lead is small.
Be careful with old scores. Version 5.0 came out on October 27, a day before Carbon. Scores from earlier versions can’t be compared. TechTimes notes that GPT-6 Astra scored 53 on an earlier version but 57 on v5. Carbon also doesn’t win everywhere. On Artificial Analysis’s separate Coding Agent Index, BetaNews reports it scored 59, behind Claude Code with Opus 5.5 at 62.
Price and access
Google lists $2 per million input tokens and $10 per million output tokens, the same as Gemini 4 Argon. That is an introductory price. After it ends, Google says the rates become $4 and $20. For now you can’t buy it. Google is giving it first to a subset of cyber defenders through its Fairwind Program, and says it is taking part in the U.S. government’s voluntary pre-release testing. It has given no public release date.
Google’s security numbers
Google reports 88.2% on SEC-bench Pro, which tests finding vulnerabilities, 71.0% on CWE-bench for patching them, and 54.8% on ExploitGym for exploiting them. The benchmarks come from outside groups, but Google reports the results and says it ran them without guardrails. I found no independent replication yet. The shipped product may behave differently.
Google’s own claims
Google says the Chrome team found Carbon more than 10 times better than another lab’s model at writing high-quality patches. It doesn’t name the rival or explain the method. On Gray Swan’s prompt-injection benchmark, Carbon had a 0.0% attack success rate, down from 0.7% for Argon. That benchmark is external, but iClarified notes it doesn’t prove immunity to attacks outside the test. Google also says high-severity misalignment alerts fell by almost 80% in its internal coding work. That figure is not independently checked.
Why it matters, and what could come next
The top spot is tight, so one release can change the ranking. The staged rollout hints at a bigger issue. A model that is good at finding and exploiting software flaws helps defenders and attackers alike. Near term, Google says wider access will follow “as soon as possible,” which would let outsiders test its claims. Whether defenders gain more than attackers is still speculation.
