Evidence at a glance
The New Flagship Arrives With an Access Gate
Google DeepMind released Gemini 4 Carbon on October 28, 2026, positioning it as the new flagship after Argon and targeting cybersecurity and long-running, multi-step engineering work. Carbon is initially available through the Fairwind program to vetted cyber defenders; Google has not announced when access will expand to developers, businesses, or consumers. Potential participants include organizations in critical infrastructure such as government, healthcare, and telecommunications, and use is restricted to authorized cybersecurity work.
That makes Carbon’s launch more than a model refresh. It packages capabilities for finding vulnerabilities, checking whether they can be exploited, and helping patch them with an access gate: Google is publicizing strong results without immediately opening the model to every developer. For technical leaders, the question is not only where it ranks, but whether their organization can establish authorization, constrain execution, and take responsibility for mistakes.
Three Cyber Scores Do Not Add Up to a Security Guarantee
Google reported three cybersecurity results: 88.2% on SEC-bench Pro for vulnerability discovery, 54.8% on ExploitGym for exploitation, and 71.0% on CWE-bench for patching. These scores measure different parts of a workflow and do not establish that the model can independently protect a production system. Exploitation capability is also inherently dual-use, so stronger results increase the importance of controlling who can use the model, against which targets, and in what environment.
The results also differ in provenance and reproducibility. Google calculated the SEC-bench Pro and ExploitGym scores using open evaluation setups. Its methodology says ExploitGym used the Antigravity framework, one attempt per task, and disabled mitigations; some results used the highest thinking setting. The 71% CWE-bench result comes from Collinear’s public leaderboard, but its 120 retained tasks cover 73 weakness types and are not directly available to outside researchers. A third-party leaderboard is therefore not the same as a fully reproducible external experiment.
First Overall Does Not Mean Best at Every Job
Artificial Analysis gave Carbon 59 on its Intelligence Index v5, placing it first, but Carbon leads in only four of the index’s nine evaluations. That is an overall index lead, not a clean sweep. For comparison, Carbon scored 59 on the Coding Agent Index, below the 62 earned by Opus 5.5 at maximum settings with Claude Code. On FrontierSWE, Carbon scored 61.2%, behind GPT-6 Astra at 65.5% and Opus 5.5 at 62.3%.
Benchmarks can also measure a model together with a particular toolchain. Carbon’s coding-agent results were obtained with Antigravity CLI, and its performance in other harnesses has not been tested. On the knowledge-work benchmark AA-Briefcase, Carbon scored 1609 Elo, up 126 points from Argon, but behind Grok 4.7, Muse Wonder, and Kimi K3.1 Pro at 1678. For procurement and platform teams, leaderboards are better used to select pilot tasks than to replace evaluation on the organization’s own code, permissions, and workflows.
Long-Running Work Must Be Judged Alongside Failure Modes
Google says Carbon is designed for agentic workflows lasting hours or even days, including investigating, validating, and patching complex issues in large codebases. But public materials do not disclose its architecture or training recipe, and they do not show that such end-to-end workflows can operate independently in production. Google also says its secure-code generation success rate is more than twice Argon’s, but provides no baseline rate, task count, or confidence interval, making the stability of that improvement difficult to assess.
Reliability indicators have not improved uniformly. Artificial Analysis reports an 11% hallucination rate for Carbon, up from Argon’s 4%, although it remains the second-lowest rate in that evaluation. In vulnerability analysis, this means a model capable of working for longer may still present uncertain judgments as credible findings. Sustained execution should not be mistaken for sustained correctness.
A Pilot Should Test the Workflow, Not Recreate the Leaderboard
Carbon is a candidate for an initial pilot in an explicitly authorized, isolated environment. Break vulnerability screening, exploit validation, and patch recommendations into auditable steps, constrain target scope, and require people to confirm both exploit findings and proposed fixes. Conditions in the evaluations—including single attempts, disabled mitigations, and a specific framework—matter when interpreting the scores and should not silently carry over into production. Teams should also log model calls, tool permissions, and human overrides so they can distinguish failures in the model from failures in the harness or task setup.
Pricing should be reconciled before procurement. Google lists an introductory price of $2 per million input tokens and $10 per million output tokens, rising to $4 and $20 after the introductory period, but does not say when that period ends. Artificial Analysis lists $4 and $20 as standard rates alongside a 50% launch discount with no stated end date. Cached input costs $0.20 per million tokens. For long-running agents, teams should measure actual usage and total cost per task, not just token rates. While access timing, reproducibility, and safeguard behavior remain unsettled, a small authorized pilot is a more defensible decision than treating a first-place ranking as permission to deploy.