Google has a new strongest model, and almost nobody can use it yet. Gemini 4 Carbon, announced October 28, tops the Artificial Analysis Intelligence Index and posts the best scores yet on three public cybersecurity benchmarks. For now, though, it is going only to a subset of cyber defenders through Google’s Fairwind Program, with no date given for wider developer or consumer access.
That gated rollout is the story, not just the scores. Google is releasing its most capable security model into a world where the same skills that find and fix vulnerabilities can also exploit them, and it is doing so two weeks after launching Gemini 4 Argon, the previous model in the family. The company says it is still iterating on guardrails and is taking part in the US government’s voluntary pre-release model testing process.
The cybersecurity scores, benchmark by benchmark
| Benchmark | What it measures | Carbon’s score |
|---|---|---|
| SEC-bench Pro | Finding vulnerabilities | 88.2% |
| ExploitGym | Exploiting flaws | 54.8% |
| CWE-bench | Patching root causes | 71.0% |
Google says the ExploitGym and SEC-bench Pro results are new state-of-the-art marks, and that the CWE-bench score leads the field: Gemini 4 Argon, OpenAI’s GPT-6 Astra, and xAI’s Grok 4.7 all sit at 68%, with Anthropic’s Claude Opus 5.5 at 67%. CWE-bench gives no partial credit. The exploit must stop working and every existing test must still pass, across 120 held-out tasks in real open-source repositories.
One caveat matters for anyone reading these numbers. Google says it ran the external security evaluations without guardrails, meaning without the protections active in production. Scores measured that way are a ceiling, not what a customer using a restricted version will necessarily see. Google’s internal evidence points the same direction, though: secure code generation more than doubled versus Argon, high-severity misalignment alerts in live coding environments fell by almost 80%, and the Chrome team reported Carbon producing high-quality patches more than 10 times better than another lab’s large frontier model.
What Carbon costs, and when the price doubles
Carbon launches at the same introductory pricing as Argon: $2 per million input tokens and $10 per million output tokens, with cached input tokens at 95% off. After the introductory period, the standard price is $4 per million input and $20 per million output tokens. That doubling matters for budgeting, because Argon’s own introductory window closes November 30, as we covered when Argon went generally available.
On cost efficiency, Artificial Analysis puts Carbon at $7.76 per Intelligence Index task, about 23% less than Claude Opus 5.5 at $10.04 but roughly 20% more than GPT-6 Astra at $6.25. Carbon uses about 123,000 output tokens per task, 29% fewer than Claude Opus 5.5. The index itself now ranks Carbon first with a score of 59, ahead of both Claude Opus 5.5 and GPT-6 Astra, and Carbon climbed 89 Elo points to fourth place on WebDev Arena at 1769.
Why Google is holding Carbon back
The Fairwind Program is Google’s answer to a dual-use problem. A model that scores 54.8% on exploiting real vulnerabilities is a powerful defensive tool in the hands of a security team, and a dangerous one in the hands of an attacker. By starting with vetted cyber defenders and adding trusted partners gradually, Google buys time to test safeguards and gather feedback before the model reaches general developers.
There is also a competitive clock running. Anthropic’s Claude Fable 5.5 is expected to challenge for the top spot soon, and OpenAI just cut prices aggressively on its own coding models. We tracked that discount war in our GPT-6.1 Terra coverage, and our October token price list shows how fast the whole market is repricing. Carbon’s headline scores will not stay unchallenged for long, which makes the gated rollout a bet that safety process matters more than being first to everyone’s API key.
What this means for builders and security teams
If you are a security team, the practical move is to apply for Fairwind access and test Carbon against your own repositories, because vendor benchmarks, however strong, are not your codebase. If you are a developer, Argon remains the model you can actually use today, and its pricing and behavior are the better planning baseline until Google names a date for Carbon’s broader release.
The broader signal is that cybersecurity has become a flagship benchmark category, not a side quest. When Google, OpenAI, and Anthropic all fight over who finds, exploits, and patches flaws best, the winner is not just a leaderboard position. It is whoever security teams trust with their code first. Carbon’s scores earn Google that conversation. The gated rollout decides whether it keeps it.
Sources: Reuters, The Verge, Google DeepMind announcement, Artificial Analysis, WinBuzzer.
