Gemini 4 Carbon leads, but only defenders may use it. What Google's numbers say

TL;DR. On October 28, Google DeepMind introduced Gemini 4 Carbon, two weeks after Gemini 4 Argon. On the Artificial Analysis overall index, Carbon ranks first with 59 points, one point ahead of Claude Opus 5.5. Its greatest strength is cybersecurity: finding, exploiting and fixing vulnerabilities. That is exactly why only selected cyber defenders get it for now; there is no date for developers and companies. We counted which of the numbers Google measured itself. For mid-sized companies this means: don't wait for Carbon, close your vulnerabilities with the models that already exist.

What Google reports

According to Google's announcement, Carbon is built for long tasks. Internally, the model worked on bugs in large codebases for days until the cause and the fix were in place. In the security tests, Google reports three best scores: 88.2% on SEC-bench Pro (finding vulnerabilities), 54.8% on ExploitGym (exploiting them) and 71.0% on CWE-bench (fixing them). In the test for hidden instructions in third-party content, no attack got through; Argon still let 0.7% through.

The launch price matches Argon: $2 per million input tokens and $10 per million output tokens. After the introductory period, $4 and $20 apply.

Google grants access in stages. Since this week, a small group of cyber defenders has been working with Carbon. Partners from the Fairwind Program follow step by step: government agencies, operators of critical infrastructure such as healthcare, telecommunications, energy and financial networks, and large technology platforms. Participants go through a background check, need phishing-resistant sign-in and must log every use. In parallel, Google is having Carbon checked in the US government's voluntary pre-release testing.

The catch

• No access, no date. For developers, companies and consumers, Google only says "as soon as possible". Anthropic has been on the same path for longer: since April 7, only vetted partners get Claude Mythos Preview, and according to its own page Anthropic does not plan to make it generally available.
• The big cyber numbers are in-house runs without safeguards. According to the methodology paper, Google measured ExploitGym and SEC-bench Pro itself, with safety filters switched off. SEC-bench Pro here consists of 183 tasks in JavaScript engines, not business software. The version that later becomes generally available will have safety filters. How much of the capability remains then is open.
• First place is narrow. 59 to 58 points on the overall index. On the Vals Index, Carbon leads in Google's table, but on Vals' own leaderboard it ranks second: Claude Sonnet 5.5 scores 70.85%, Carbon 70.36%. Sonnet is missing from Google's table.
• 0.0% does not mean solved. Claude Opus 5.5 lets 1.0% of attacks through in the same test. The test barely separates the top models anymore. Hidden instructions in emails and web pages are still contained through permissions, not through a test score.

We counted: who measured?

Google's results table has 17 rows. We checked each row against the methodology paper and calculated the gap to the best competitor in the table, that is GPT-6 Astra, Claude Opus 5.5 or Claude Fable 5.1.

• 11 values come from third parties, such as Artificial Analysis, Vals, Zapier or Collinear. There, Carbon leads in 10 cases, by a median of 2.3 points.
• Google measured 6 values for Carbon itself. There, the median is 3.6 points, and that is where the two largest gaps are: 24.4 points when working with very long texts (GraphWalks) and 12.4 points on ExploitGym.
• Twice, Carbon trails even in Google's own table: in coding on FrontierSWE 2, 4.3 points behind GPT-6 Astra, and in computer use on OSWorld, 5.7 points behind Opus 5.5.

The only cyber value that a third party measured the same way for all models is CWE-bench, fixing vulnerabilities: Carbon 71.0%, GPT-6 Astra 68.0%, Opus 5.5 67.0%. Carbon is ahead, but not by much.

What this means for mid-sized companies

For companies with their own software, an online shop or connected products, two sides matter. The attacker side: in Google's chart, the freely downloadable GLM-5.3 exploits 15.0% of the vulnerabilities, Carbon 54.8%. So the tool that is best at turning flaws into attacks is not lying around in the open right now. That gap is a window of time, not a permanent fix.

The defender side: when it comes to fixing, the top models are only a few points apart. Anyone working with Opus 5.5 or GPT-6 Astra today scores 67 to 68% in the independently measured test, Carbon 71%. Waiting does not pay off. On top of that comes the obligation: since September 11, 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities within 24 hours under the Cyber Resilience Act. Whoever finds flaws earlier is surprised less often.

What you should do now

1. Start with the models available today. Have a current model check your own code and the libraries you use for vulnerabilities and suggest fixes. A person reviews every fix before it is deployed.
2. Measure your own patch time. How many days pass between a vulnerability becoming known and the update being installed? That number says more about your risk than any leaderboard.
3. Check whether you qualify for a program. Operators of critical infrastructure can apply to Google's Fairwind Program; Anthropic offers a similar tiered option with its Cyber Verification Program. If you don't qualify, Google points to its CodeMender tool with publicly available models.
4. Don't buy by leaderboard. First place changes weekly, and Carbon's price doubles after the introductory period. Build so that you can swap the model, and measure on your own tasks.

The strongest models now go first to those who close vulnerabilities. That is good news, as long as everyone else uses the time. If you would like to have your code reviewed once with an AI check, we can help set it up.