Google unveils Gemini 4 Carbon, retaking the world's no. 1 spot on updated, harder benchmarks — but access is limited

Google announced its latest and most intelligent frontier AI model today: Gemini 4 Carbon promises improvements in cybersecurity and complex software engineering at the same introductory token prices as its previous flagship, Argon. It also claims the top spot in the world on most common enterprise benchmarks according to both Google's and outsiders' tests.

However, Google is initially granting access only to selected cybersecurity defenders in its curated "Fairwind Program," leaving most developers and businesses waiting for a broader release. Google says that broad release will come "as soon as possible" after "gather[ing] feedback and iterat[ing] on guardrails."

Independent evaluator Artificial Analysis places Carbon, using high reasoning, first on its Intelligence Index v5.0 with 59 points, ahead of Claude Opus 5.5 at 58, GPT-6 Astra at 57 and Argon at 50.

Separately, Carbon posts the highest result in 15 of the 17 benchmark rows in Google’s announcement, although OpenAI retains an advantage on one software engineering test and Anthropic leads on one computer-use evaluation.

Google says Carbon will launch at $2 per million input tokens and $10 per million output tokens, with a 95% discount for cached inputs.

Those rates are temporary: a footnote specifies subsequent prices of $4 and $20, respectively. Google hasn't specified in its release blog post when Carbon’s introductory period will end.

Independent testing also reveals tradeoffs: Carbon improves substantially over Argon in coding and knowledge work, but trails several rivals on professional tasks and records a higher hallucination rate than Argon on a factual-knowledge test.

For businesses, the announcement presents a stronger model on Google’s published tests without an increase in its advertised per-token rates relative to Argon. It does not yet provide a generally available replacement. Argon, which Google opened more broadly on October 13, remains the model customers can evaluate through its existing public offering.

Carbon follows Argon’s release path, with a different emphasis

The timing requires distinguishing Argon’s announcement from its public launch. Google introduced Argon on September 30, initially giving approved cybersecurity partners access through Fairwind. Its wider October 13 rollout followed. Carbon arrives 15 days after that expansion.

Argon already targeted demanding engineering, professional research and security assignments. Google described agents assisting with memory optimization and C/C++ migrations to Rust, with sensitive code changes undergoing testing and human review. Cybersecurity was also central: Argon was designed to discover flaws, validate their significance and produce fixes.

The big distinction between Carbon and Argon is, then, Google's reported improvement on these existing domains, particularly sustained engineering work, exploitation testing and agent reliability. Google didn't release a technical report yet, nor say if Gemini 4 Argon offers a new model architecture. Nor did it disclose a parameter count.

“Internally, our teams have seen Carbon run for days,” Google wrote in the announcement, authored by Koray Kavukcuoglu, Google DeepMind SVP and Google’s chief AI architect. The company describes the model continuing through unsuccessful approaches while diagnosing bugs and developing patches in substantial codebases.

Argon’s model documentation already specifies a shared context capacity of more than 1 million tokens, covering input and output, with extended generation available beyond the default 65,536-token output limit

It accepts text, images, video, audio and PDFs, while generating text. It also supports function calling, code execution, structured responses and computer interaction in preview.

Those specifications establish what Argon offers developers today. Carbon’s announcement doesn't provide an equivalent API specification, so it does not establish whether those limits and supported features carry over unchanged.

Meanwhile, Google’s October 13 announcement made Argon available through its API and brought it to paid consumer products. Its separate developer launch notice also identified access through AI Studio and Android Studio. Carbon’s announcement commits to a controlled expansion, without identifying a comparable public endpoint or a product-by-product schedule.

Former Windsurf CEO turned Google Anitgravity head Varun Mohan, posting as @_mohansolo on X, also pointed to internal use through Antigravity: "...people have really enjoyed using it internally on Antigravity to solve their hardest tasks,” he wrote.

He said access would expand through Fairwind ahead of wider Antigravity availability, citing Carbon’s capabilities in vulnerability discovery and patching. His post supplies a product destination, but no release date.

The prices match, but the deadlines and total costs remain different

For now, Carbon’s proposed pricing mirrors Argon’s introductory and subsequent rates:

The distinction in the last row matters. Google’s Argon developer guide explicitly puts its higher rates into effect December 1. Carbon has no definitive deadline at present.

For an illustrative workload using 10 million uncached input tokens and 1 million billed output tokens, the announced introductory rates produce a $30 token bill. The subsequent rates produce $60. That calculation excludes other charges and assumes unchanged token consumption.

Identical unit prices do not establish identical costs for completing an assignment. Carbon’s release materials do not provide the token consumption, retries or execution time needed to compare its cost per successful task against Argon.

Argon’s documentation makes the distinction concrete: its output charges include reasoning tokens, and its low, medium and high reasoning settings affect consumption and response time. Google also bills tokens associated with internal tool instructions and function definitions when grounding is used, with Google Search grounding carrying separate query charges.

Carbon’s 95% cached-input discount is substantial, but the announcement does not specify its caching mechanics. Argon’s guide describes automatic caching and says explicitly created caches are unsupported. Developers cannot yet assume Carbon’s implementation will be identical.

The available evidence supports a narrow pricing conclusion: Google is advertising improved benchmark performance at matching token rates. It has not published enough operating data to establish lower spending on completed engineering or security work.

Benchmark gains are broad, but the size of the advantage varies

Google’s comparison shows Carbon improving on Argon in all 17 reported rows. Several of the largest percentage-point gains concern prolonged reasoning, security testing and scientific work.

The table below reproduces selected scores from Google’s release graphic. Differences are percentage points except for the AA Index, where they are index points.

GraphWalks, which Google reports for contexts spanning 256,000 to 1 million tokens, shows a particularly large separation from the named competitors: Carbon reaches 96.2%, compared with Astra’s 71.8% and Opus’s 66.8%. That result measures performance on the specified evaluation; it does not independently establish Carbon’s production API limits.

The software engineering results are less uniform. Carbon more than doubles Argon’s SWE-sweep score, but its 9.6% result exceeds Astra’s 9.5% by only a tenth of a percentage point. On FrontierSWE 2, Carbon’s 61.2% trails Astra at 65.5% and Opus at 62.3%.

Computer use also produces a split result. Carbon leads the displayed Agents’ Last Exam scores, but Opus reaches 87.2% on the OSWorld offline subset, ahead of Carbon’s 81.5%.

For business workflows, AutomationBench shows a smaller improvement over Argon, from 51.3% to 53.9%, while preserving a larger advantage over the displayed Astra and Opus results. Vals Index is closer still: Carbon’s 70.4% is just above Opus’s 70.2%.

Other reported gains include chart interpretation, blueprint similarity and mathematics. Carbon also finishes with a $16,484 bank balance on Vending-Bench 2, compared with Argon’s $13,718 and Astra’s $15,515. That is a benchmark outcome, not evidence of revenue generated for a customer.

Autonomous organizational startup Andon Labs says the result returns Google to first place on Vending-Bench 2 after a year. Its chart tracks balances over roughly a simulated year, with Carbon finishing ahead of Astra, Argon and Opus. The evaluator also attributed this line to Carbon: “My priority is to maximize my profits and obliterate my competition.”

Artificial Analysis describes its index as a composite of nine independently conducted evaluations. Its newly published chart confirms Carbon’s first-place score and marks the model as lacking a publicly available API.

That lead comes on a revised test suite intended to reduce saturation and exposure to public questions. Artificial Analysis says 60% of v5 uses private tests or withheld answers. It adds FrontierCode 2.0 and Terminal-Bench-Science, replaces HLE with HLE-Diamond and revises AA-Omniscience and CritPt. The Omniscience update removes saturated and public-set questions, adds replacements and corrects problematic items. Carbon’s lead and its comparison with Argon are on this revised version; they should not be mixed with older index scores.

Google’s graphic also supplies no uncertainty estimates. Its narrowest margins cannot establish a decisive advantage for a company’s particular workload, even as the broader comparison shows substantial progress over Argon.

Independent tests separate coding progress from knowledge-work limits

Artificial Analysis reports a separate score of 59 for Carbon running through Antigravity CLI on its Coding Agent Index, six points above Argon’s 53. Claude Code with Opus 5.5 leads at 62. The displayed chart also gives 59 to Claude Code with Sonnet 5.5 and Muse Code with Muse Wonder Full, so Carbon is not alone at that rounded score.

This agent index evaluates a model operating inside a coding tool, rather than measuring the same collection of capabilities as the general Intelligence Index. Its three components are FrontierCode v1.1, Terminal-Bench 4.0 and SWE-Atlas-QnA-AA.

Artificial Analysis places Carbon second on the first two, with 51% and 64%, respectively. Its SWE-Atlas-QnA-AA result is 64%, behind Muse Code with Muse Wonder Full at 69%. The 64% Terminal-Bench result belongs to the Antigravity CLI evaluation; Google’s separate model comparison reports 65.2%. The results should retain their evaluation context.

Knowledge work presents a more qualified picture. Carbon reaches 1,609 Elo on AA-Briefcase, gaining 126 points over Argon at high reasoning. It remains below Grok 4.7 at xhigh reasoning (1,638), Muse Wonder at max (1,659) and Kimi K3.1 Pro (1,678), according to the evaluator.

Presentation quality accounts for the largest reported improvement: Carbon gains 293 Elo to reach 1,598. Analytical quality advances 120 Elo to 1,671. These results show improvement over Argon without establishing leadership in the professional work covered by that evaluation.

Cybersecurity supplies the clearest focus—and an evaluation caveat

Google organizes Carbon’s security results around three stages: discovering a vulnerability, checking whether it can be exploited and producing a corrective patch.

The largest gain over Argon among those evaluations appears on ExploitGym, where Carbon rises from 42.0% to 54.8%. On SEC-bench Pro, the reported result advances from 83.4% to 88.2%. CWE-bench increases from 68.0% to 71.0%.

The distinctions matter operationally. Finding suspicious code does not by itself establish an exploitable defect, and demonstrating an exploit does not establish that a proposed repair works. Google presents Carbon’s results as evidence across those separate steps.

There is an important condition attached: Google says the external cybersecurity evaluations were conducted “without guardrails.” The announcement therefore does not establish that customers will obtain the same scores under whatever restrictions accompany their deployment.

Google adds internal evidence, reporting more than twice Argon’s success rate when generating secure code. It also says the Chrome team observed a greater-than-tenfold advantage in producing quality patches against a competing laboratory’s model. The rival is unnamed, and the announcement does not supply the underlying results needed to assess that comparison independently.

These claims extend work Google was already emphasizing with Argon. The earlier model’s launch materials described vulnerability discovery and remediation alongside its engineering uses. Carbon’s stronger reported results sharpen that existing focus; they do not establish that cybersecurity capability began with this release.

Reliability improvements accompany a restricted rollout

Google’s other major comparison with Argon concerns how the model behaves while completing work.

The company reports that Carbon roughly halves unsupported assertions in internal testing. It says severe alignment alerts fell almost 80% in its internal coding environments, while measures of exceeding the assignment and failing to provide enough assistance declined 26% and 29%, respectively.

Independent factual-knowledge testing complicates that reliability story. Artificial Analysis gives Carbon the highest AA-Omniscience score, 54, six points above Opus 5.5 at max reasoning. Carbon correctly answers 58% of questions, compared with Argon’s 48%, but its reported hallucination rate rises from 4% to 11%. The evaluator reports 50% for both Opus 5.5 and Astra at max reasoning.

The benchmark’s methodology defines hallucination rate as incorrect responses divided by the combined total of incorrect, partially correct and unanswered responses. Thus, 11% does not mean 11% of all answers are fabricated. The overall index rewards correct responses, penalizes incorrect ones and allows abstention without a penalty.

Carbon consequently leads this combined measure while doing worse than Argon on its hallucination component. That finding comes from a different evaluation than Google’s internal measure of unsupported assertions; the two results do not establish a uniform improvement or regression in factual reliability across tasks.

On Terminal-Bench 4.0, Google reports that successful cheating reached 0.0%, with attempted cheating at 0.4%. These are relevant distinctions for an agent expected to satisfy the actual task rather than exploit the test or misrepresent completion.

Google also reports a 0.0% attack success rate on Gray Swan’s indirect prompt-injection evaluation, versus 0.7% for Argon. That result applies to the attacks evaluated; it does not establish immunity to malicious instructions encountered in every repository, document or webpage.

Carbon uses the same broad safety approach as Argon, according to Google, combining training, defenses against misuse, resistance to injected instructions and monitoring of the model’s reasoning. The company says additional work targeted behavior under complicated or demanding assignments.

Those improvements remain company-reported measurements. The release does not establish how frequently an external customer would encounter the same failures or reproduce the reductions.

Google says it is participating in the U.S. government’s voluntary prerelease testing process while gathering feedback and refining protections. It plans to expand Carbon access through Fairwind before bringing it to a wider audience.

That leaves enterprises with a practical distinction between the two flagships. Argon has documented public access, API behavior and a dated pricing transition. Carbon has stronger reported results across Google’s comparison, matching advertised token rates and a narrower initial audience. Its broader release date, detailed API specifications and promotional-price deadline remain unannounced.