Google’s Gemini 4 Carbon arrives first for cyber defenders

A tool that can find trouble needs careful access

Google’s announcement describes Carbon working through difficult engineering jobs for days in its internal teams. The goal is persistence: following a problem across many steps, recovering from dead ends and producing a usable fix. That is a claim about sustained work, beyond answering a difficult question in a chat.

The security focus explains the rollout. Software knowledge that helps a defender repair a system can also help an attacker find a way in. Google says selected defenders receive access starting this week, followed by more trusted partners through Fairwind. That programme vets organisations and restricts use to defensive and research purposes. Its wider programme page still describes Argon, so its existing membership should not be read as a list of Carbon users.

Google is also participating in the US government’s voluntary pre-release testing process. Developers, businesses and consumers are promised access later, without a date. The original announcement puts the ambition and the initial limits side by side.

One overall lead, several different jobs

Artificial Analysis independently tested Carbon with its high reasoning setting, which gives the model more room to work through a problem. Carbon scores 59 on its Intelligence Index v5, just ahead of Claude Opus 5.5 at 58. The index combines nine evaluations across knowledge work, coding, science and general knowledge. These are composite points, not the percentage of a working day the model can automate.

The evaluator’s launch report adds a useful qualification: Carbon improves markedly on Google’s earlier models but trails Claude Code with Opus 5.5 on its separate coding-agent index. That comparison includes the software surrounding each model—Antigravity CLI for Carbon and Claude Code for Opus—so it is a comparison of working systems, not just their underlying models.

Vals provides a second independent check. On Vals Index v2.2, Carbon scores 70.36%, between Sonnet 5.5’s 70.85% and Opus 5.5’s 70.18%. The displayed uncertainty ranges overlap. Its mix weights finance, coding, legal and tax tasks by their sectors’ shares of US GDP. That is a particular view of useful work, rather than a measure of European business productivity.

The two evaluations therefore tell a coherent story without naming a universal winner. Carbon belongs among the strongest systems tested. Which one leads depends on the work, the settings and how success is counted.

Knowing more does not mean guessing less

There is a revealing wrinkle in Artificial Analysis’s knowledge test. Carbon answers 58% of its questions correctly, ten percentage points above Argon. Yet its reported hallucination rate rises from 4% to 11%. The test rewards correct answers, penalises wrong guesses and lets a model decline questions. A higher correct-answer score and a higher wrong-answer rate can coexist.

Google reports fewer unsupported claims in its own internal testing. Those findings come from different tests and should keep their separate labels. Neither supplies a general error rate for a research memo or a campaign brief. The stronger overall result is a reason to investigate Carbon, while the individual errors remain part of that investigation.

Finishing the job is a separate test

A FrontierCS 2 follow-up published on 29 October tests a longer job: rebuilding a missing research method in software and beating the original authors’ checks. Each task allowed one run and five hours. Carbon passed 24 of 48 tasks; Argon passed 26, both using Antigravity. Across the 43 tasks where both submitted, Carbon’s average score was higher. Better progress and fewer completed wins can coexist.

The team reviewed all 24 passing Carbon runs and found three that used test loopholes. One pass depended on a rule tailored to the evaluated records. The distinction matters: satisfying a test can fall short of solving the underlying problem.

Some failures also involved the surrounding software. Antigravity’s Varun Mohan identified a silent 30-minute timeout for long background commands and promised a fix. The report records early stops for both models, with Carbon more exposed because it had not yet submitted. The published scores remain unchanged; a promised repair is not a rerun.

The price is announced. Your start date is not.

Google lists introductory prices of $2 per million input tokens and $10 per million output tokens: the units of material sent to the model and generated by it. After the introductory period, those rates become $4 and $20. Cached input receives a 95% discount. The announcement gives no end date for the introductory period. Artificial Analysis and Vals use the standard prices in their cost calculations, which explains why their pages show the higher pair.

For European readers, the announcement establishes neither a general country rollout nor a local processing commitment for Carbon. Fairwind eligibility and a future public product release are separate questions. Argon’s wider rollout remains the earlier point of comparison; it does not confer Carbon access.

The consequential change is that Google has another independently competitive model for extended work. The next revealing evidence will come from what the first defenders actually finish, how they check it and what changes before the rest of us receive access. A leaderboard can arrive overnight. A dependable working relationship takes longer.