Gemini 4 Carbon Claims No. 1 on AI Index With Security-First Rollout, No Public API Yet

Google DeepMind on Wednesday released Gemini 4 Carbon, a new frontier model that claims the top spot on the Artificial Analysis Intelligence Index v5 while arriving through a restricted-access program for vetted cybersecurity organizations rather than a public API rollout.

Carbon scores 59 on the Artificial Analysis Intelligence Index v5, placing it ahead of Anthropic's Claude Opus 5.5 at 58 and OpenAI's GPT-6 Astra at 57. The gap against its own predecessor is more telling: Gemini 4 Argon, which became broadly available just two weeks ago on October 13, scored 50 on the same metric.

The release comes through the Fairwind Program — Google's vetted-partner access channel for governments, critical infrastructure operators, and established cybersecurity platforms — making Carbon unavailable for general developer or enterprise API use at launch. No timeline for a public API has been announced.

Carbon's Cybersecurity Benchmark Leads Are Real, With Important Guardrails Caveats

The security benchmark numbers are substantial. On SEC-bench Pro, which tests autonomous vulnerability discovery across real software environments, Carbon scores 88.2%, compared with GPT-6 Astra at 85.4% and Argon at 83.4%. On ExploitGym, a benchmark designed to evaluate how far a model can proceed through end-to-end exploitation pipelines, Carbon reaches 54.8% — more than twelve percentage points ahead of GPT-6 Astra at 42.4% and Argon at 42.0%. On CWE-bench, Collinear AI's patch-generation benchmark, Carbon reaches 71.0%, edging Argon, Astra, and Opus 5.5 at 67–68%.

Gray Swan's independent IPI benchmark found Carbon at 0.0% attack success versus Argon's 0.7%. Indirect prompt injection — where malicious instructions are embedded in web pages, documents, or tool outputs the model reads during an agentic task — is a direct threat to long-horizon deployments, making Carbon's result particularly significant for the security-focused use cases Google is targeting.

A mandatory caveat applies to all cybersecurity benchmark results: Google states scores were obtained without safety guardrails enabled. Production deployments with Google's standard restrictions active will produce different and generally more constrained behavior. The practical defensive benefit of Carbon's ExploitGym score in a guardrailed enterprise deployment is not established by the published numbers.

How Carbon Is Built for Long-Horizon Agentic Work

Google DeepMind describes Carbon as specifically optimized for tasks that "run for days" — extended autonomous sessions involving large-scale codebase debugging, patch generation across many files, and multi-step engineering pipelines. Varun Mohan, former CEO of Windsurf and now head of Google Antigravity, confirmed that his team is already using Carbon internally for this class of work.

Carbon shares Argon's multi-layered safety architecture: training-time alignment, real-time misuse defenses, and chain-of-thought monitoring. The interaction between that stack and Carbon's security benchmark gains remains unexplored in Google's announcement; those benchmarks were all run with guardrails disabled.

On AutomationBench, which evaluates multi-step tool-use sequences, Carbon scores 53.9% against Argon's 51.3%, with Opus 5.5 at 42.5% and Astra at 41.4% per Google's announcement. On GraphWalks, which stresses long-context coherence across 256,000 to 1 million token windows, Carbon reaches 96.2%, against Astra's 71.8% and Opus's 66.8% — a domain where Carbon's advantage is decisive. WebDev Arena places Carbon 89 Elo points above the prior Gemini release, at 1,769 Elo and fourth overall.

One disclosure is absent: Google has not released a dedicated Carbon safety report. The linked safety documentation in the Carbon announcement carries the title "Gemini 4 Argon."

Where Carbon Falls Short of the Competition

Not every benchmark favors Carbon. FrontierSWE 2, a complex software engineering evaluation run against production repositories, shows Carbon at 61.2%, below GPT-6 Astra at 65.5% and Claude Opus 5.5 at 62.3%. On OSWorld 2.1, which tests autonomous computer use across offline desktop tasks, Carbon scores 81.5% while Opus leads at 87.2%. SWE-sweep, a benchmark measuring autonomous pull-request resolution in open repositories, places Carbon at 9.6% and GPT-6 Astra at 9.5% — effectively a tie — while Argon's 4.3% score indicates how substantial the two-week generational improvement was.

An independent evaluation using AA-Omniscience surfaces a subtler problem: although Carbon answers more factual questions correctly than Argon, its hallucination rate has increased from 4% to 11%. This regression means Carbon generates confident, incorrect responses more frequently than the model it replaced. For long-horizon agentic tasks — Carbon's primary marketed use case — unchecked hallucinations propagate through subsequent steps in extended pipelines, accumulating errors that may be invisible until the final output. The Google announcement does not acknowledge this tradeoff.

Pricing and Access Structure

Carbon launches at $2 per million input tokens and $10 per million output tokens as an introductory rate, with cached input priced at $0.10 per million — a 95% reduction from the standard input token price. Post-introductory pricing rises to $4 and $20 per million respectively. Google has not announced an end date for Carbon's introductory period; Argon's introductory pricing is scheduled to end November 30, 2026.

Access at launch is limited to Fairwind Program participants. The program, which launched September 2 with Gemini 3.8 Flash Cyber, provides staged rollout to vetted government agencies, critical infrastructure operators, and major security platforms before general API availability — a structure Google has used for each successive high-capability Gemini release.

The Competitive Position Behind the Benchmark Number

The Artificial Analysis Intelligence Index v5 uses a composite structure across nine independently conducted evaluations, with 60% of test sets held private and withheld to reduce saturation effects — making the index substantially harder to game through benchmark contamination than earlier composites. Carbon's one-point lead over Opus 5.5 (59 vs 58) on this harder structure is the narrowest margin the index can meaningfully resolve; the practical capability difference between those scores is unlikely to be perceivable in most workflows.

What the single composite number obscures is where the differences actually lie: Carbon's genuine lead is concentrated in cybersecurity, long-context coherence, and multi-step agentic tasks, while Opus 5.5 retains advantages in computer use and complex software engineering, and GPT-6 Astra leads on FrontierSWE 2. For an organization selecting a model to work autonomously across a large production codebase, Astra's 4.3-point FrontierSWE 2 advantage may matter more than Carbon's 2-point AI Index lead. For one deploying an AI system that must read and act on untrusted external content, Carbon's 0.0% IPI score will carry more weight than any composite number.

The milestones that determine Carbon's practical market reach are two: when Fairwind access expands to general enterprise API availability, and whether the 11% hallucination rate identified in AA-Omniscience narrows in subsequent post-training iterations. Google's compressed release cadence — two weeks between Argon's availability and Carbon's announcement — suggests the competitive landscape will continue moving quickly regardless.