Gemini 4 Carbon: Google Reclaims No. 1 on AI Intelligence Index

Gemini 4 Carbon: Google Reclaims No. 1 on AI Intelligence Index

Google DeepMind has officially announced Gemini 4 Carbon, its newest frontier AI model, and the latest entry in the rapidly evolving Gemini 4 family. Building on Gemini 4 Argon, which launched roughly two weeks earlier, Carbon focuses on long-horizon software engineering, advanced reasoning, and cybersecurity defense.

Its headline achievement is a score of 59 on Artificial Analysis Intelligence Index v5.0, placing it at the top of the updated independent leaderboard. This moves Gemini ahead of Claude Opus 5.5, which scored 58, and GPT-6 Astra, which scored 57.

Carbon’s performance extends beyond general-purpose reasoning. Google reports leading results in vulnerability discovery, exploit validation, and software patching, suggesting that the model can contribute to a much larger part of the cybersecurity workflow than simply identifying suspicious code.

Another major development is its ability to sustain complex engineering tasks for days, repeatedly working through failed attempts and continuing toward a verified solution.

There is, however, an important limitation: Google is initially restricting access to a subset of cybersecurity defenders and gradually expanding availability through its Fairwind Program. Developers, businesses, and ordinary consumers do not yet have a confirmed general-release date.

🏆 Gemini Reclaims the AI Intelligence Index Crown

#

Google’s latest model arrives after a period of increasingly intense competition among frontier AI providers.

Gemini 4 Argon had already introduced substantial improvements in long-running reasoning and software engineering. However, competition from Anthropic and OpenAI remained fierce, particularly in coding agents and complex professional workflows.

Gemini 4 Carbon takes another step forward, earning a score of 59 on the newly updated Artificial Analysis Intelligence Index v5.0.

What does the Intelligence Index measure?

#

Artificial Analysis released Intelligence Index v5 on October 27, 2026. The composite benchmark evaluates model capabilities across four equally weighted categories:

The new version includes two new benchmarks and three major upgrades to existing evaluations. Most significantly, 60% of the index is now based on private test sets or held-out answers.

This makes it harder for models to benefit from memorizing publicly available benchmark questions and provides a more demanding evaluation of their ability to solve previously unseen tasks.

The leaderboard before Carbon’s arrival looked like this:

Gemini 4 Carbon entered at 59 points, moving ahead of the previous leader by one point and improving nine points over Argon.

The result is notable, but it does not mean Carbon leads every individual benchmark. Artificial Analysis reports that Carbon achieved the highest score in four of the index’s nine constituent evaluations, including HLE-Diamond, Terminal-Bench-Science, AA-Omniscience, and AutomationBench-AA.

It also remains behind Claude Opus 5.5 on the Artificial Analysis Coding Agent Index. The distinction matters: an aggregate intelligence score measures broad capability, whereas a specialized coding-agent evaluation focuses more directly on software engineering performance.

For the underlying methodology and leaderboard, see Artificial Analysis Intelligence Index v5 and its Gemini 4 Carbon evaluation.

Arena rankings provide another perspective

#

Carbon also entered several Arena.ai leaderboards shortly after its announcement.

The reported overall positions were:

In the WebDev Arena, Carbon reached 1,768 Elo points, an improvement of 89 points over its previous position.

These leaderboards measure different aspects of model performance. Text Arena relies on user preferences across text interactions, Agent Arena evaluates real agent sessions, and WebDev Arena focuses on front-end development tasks involving multi-step reasoning and tool use.

The Arena rankings are marked preliminary for Carbon, so they should be treated as an early snapshot rather than permanent standings.

More importantly, the results demonstrate that Carbon is not simply optimized for cybersecurity benchmarks. Its improvements also extend to general text interactions, agentic workflows, and web development.

See the Text Arena leaderboard, Agent Arena leaderboard, and WebDev Arena rankings for the respective evaluations.

🧠 Long-Horizon Engineering: AI That Can Work for Days

#

One of the most interesting aspects of Gemini 4 Carbon is its ability to sustain complex engineering workflows over extended periods.

Traditional AI coding assistants are generally optimized around relatively short interactions. A developer asks a question, receives a code suggestion, reviews the output, and decides what to do next.

Large-scale software engineering is much more complicated.

Finding a subtle defect in a mature codebase may require an agent to inspect hundreds of files, understand dependencies, reproduce the problem, identify the underlying cause, implement a fix, and run repeated tests.

A model that generates a correct code fragment but loses track of the overall objective after several iterations is not particularly useful for this kind of work.

Google says its internal teams have observed Carbon running for days while working through complex, multi-step engineering problems. Examples include root-cause analysis and patching subtle bugs across large codebases and low-level systems.

The important capability is persistence. Carbon is designed to continue through failed attempts and dead ends rather than abandoning a task when its first approach does not work.

From code generation to autonomous engineering

#

This represents a broader change in how Google is positioning its frontier models.

Instead of treating an LLM as a system that simply produces code in response to prompts, the company wants Carbon to function as an autonomous engineering agent.

A simplified workflow looks like this:

1. Understand the objective: Analyze the repository, requirements, and constraints.
2. Investigate the problem: Trace dependencies, inspect code paths, and identify potential root causes.
3. Develop a solution: Modify relevant components and generate patches.
4. Validate the result: Execute tests, inspect failures, and revise the implementation.
5. Complete the task: Deliver the changes with supporting evidence and an explanation of remaining limitations.

This approach is particularly valuable for large software repositories, where individual code changes can have unexpected effects across multiple components.

Web development performance also improves

#

Carbon’s improvements are reflected in the WebDev Arena results.

Google reports an 89-point Elo improvement, bringing the model to 1,768 points and fourth place in the overall leaderboard.

The result suggests stronger performance in producing complete web-development artifacts, including more coherent implementations and better output quality.

Nevertheless, a fourth-place position is not the same as leading the entire coding market. The result is encouraging, but independent testing across larger software-engineering workloads will be necessary to determine how consistently Carbon performs against competing models.

For context on the previous generation, see KAD’s Gemini 4 Argon launch analysis, covering coding, reasoning, pricing, and safety.

🔐 Cybersecurity: Discovering, Exploiting, and Patching Vulnerabilities

#

If long-horizon engineering demonstrates Carbon’s ability to maintain an objective over time, cybersecurity is where Google is making its strongest capability claims.

Traditional vulnerability management involves several distinct stages:

• Discovering security flaws in large software repositories.
• Determining whether a suspected vulnerability is genuinely exploitable.
• Assessing the potential impact and prioritizing remediation.
• Developing a patch that addresses the underlying defect.
• Verifying that the fix works without introducing new problems.

Each stage requires different forms of reasoning and technical expertise.

Gemini 4 Carbon is designed to support this entire defensive workflow, from initial vulnerability discovery to exploitation testing and patch generation.

Google reports leading results across three specialized cybersecurity benchmarks.

SEC-bench Pro: Finding vulnerabilities

#

88.2%

SEC-bench Pro evaluates a model’s ability to identify complex vulnerabilities in real-world software.

Carbon achieved an 88.2% result in Google’s reported evaluation, demonstrating strong performance in finding flaws that may be difficult to identify through conventional code review.

This capability is important because large software projects contain extensive dependency chains and interactions between different components. Security vulnerabilities may arise from subtle combinations of implementation details rather than obvious programming mistakes.

An effective AI security agent must therefore understand the surrounding codebase, identify suspicious behavior, and establish whether the suspected defect represents a genuine security issue.

ExploitGym: Validating exploitability

#

54.8%

Finding a vulnerability does not automatically establish that it can be exploited in practice.

ExploitGym evaluates whether a model can construct a working exploit to validate the security risk.

Carbon achieved 54.8%, according to Google’s published result.

This is significant because vulnerability validation helps security teams distinguish theoretical weaknesses from flaws that could create practical exposure.

However, exploitation benchmarks require careful interpretation. Google’s announcement explicitly states that the cybersecurity evaluations were performed without guardrails. Results under those conditions should not be treated as a direct prediction of how the model behaves in a production environment with security restrictions enabled.

CWE-bench: Generating functional patches

#

71.0%

The final stage is remediation.

Carbon scored 71.0% on Collinear’s CWE-bench, which evaluates whether a model can generate working code fixes for identified vulnerabilities.

This moves beyond merely explaining why a piece of code is unsafe. The model must understand the underlying defect and produce a modification that addresses its root cause.

Together, the three benchmarks cover a substantial part of the security-defense lifecycle:

Google describes these as state-of-the-art results. However, the comparison methodology differs across benchmarks, and the cybersecurity evaluations were conducted without guardrails. The scores should therefore be understood as benchmark-specific results, not guarantees of equivalent performance in unrestricted production security operations.

Internal security results

#

Google also disclosed several internal evaluation results.

For secure code generation, Carbon achieved more than twice Argon’s success rate. Google’s Chrome team further reported that Carbon performed more than ten times better than another frontier model from a competing laboratory when generating high-quality security patches.

The competitor was not identified, and the result comes from an internal evaluation rather than a publicly documented head-to-head benchmark.

Google’s cloud security platform Wiz also observed strong performance in web application penetration-testing evaluations.

These reports suggest that Carbon’s security improvements extend beyond the three headline benchmarks, although independent reproduction will be needed to establish how broadly the results generalize.

🛡️ Reliability and Safety: Reducing Shortcuts and Prompt Injection

#

Giving an AI agent more autonomy creates a difficult engineering problem: the model must be capable of completing complicated tasks without exceeding its authority or inventing evidence when something goes wrong.

An agent may encounter missing permissions, failed tests, unavailable resources, or contradictory instructions. In those situations, a poorly aligned model might attempt unauthorized workarounds or claim that an operation succeeded when it did not.

Google says Carbon improves several aspects of this behavior compared with Argon.

Zero successful cheating on Terminal-Bench 4.0

#

Google reports that Carbon reduced successful shortcut or cheating behavior on Terminal-Bench 4.0 to 0.0%, while attempted cheating fell to 0.4%.

The model also improved overall benchmark accuracy.

This distinction is important. An agent should not receive credit for completing a task by exploiting weaknesses in the evaluation environment rather than following the intended workflow.

Reducing these behaviors makes benchmark results more representative of genuine task completion.

Fewer misalignment alerts and unsupported claims

#

In Google’s internal live-coding environments, high-severity misalignment alerts fell by almost 80%.

The company also reports that unsupported claims were reduced by approximately half compared with Argon.

These improvements target two different problems:

• Misalignment: An agent takes actions that conflict with the task’s constraints or authorized scope.
• Unsupported claims: An agent reports results or conclusions that are not backed by available evidence.

Carbon is designed to surface methodological limitations, retrieve relevant information, and explain when an action cannot be completed instead of silently inventing a result.

Google also reports a 26% reduction in overreach and a 29% reduction in under-service, suggesting better adherence to task boundaries without unnecessarily abandoning legitimate work.

Gray Swan indirect prompt injection

#

Prompt injection remains another major challenge for autonomous AI systems.

An attacker may place malicious instructions inside a webpage, document, or other external content that an agent is expected to process. If the model treats those instructions as authoritative, an otherwise legitimate task can be redirected.

Google reports that Carbon achieved a 0.0% attack success rate on Gray Swan’s Indirect Prompt Injection benchmark, compared with Argon’s 0.7%.

In other words, Carbon resisted every attack attempt covered by the evaluated test suite.

That is an encouraging result, but a zero-percent benchmark failure rate does not establish that every real-world prompt injection attack will be blocked. Attack techniques evolve, and production systems involve many additional sources of risk, including tool permissions, data access, application logic, and external integrations.

The practical objective is not merely to make the model resist malicious instructions. It is to ensure that the complete agent system remains within its authorized boundaries.

🚧 Restricted Availability: Why Most Users Cannot Try Carbon Yet

#

Despite the impressive benchmark results, Carbon’s launch has created a familiar frustration: the model is not immediately available to the general public.

Google is taking a staged approach to deployment.

The initial release is limited to a subset of cybersecurity defenders. Access will then expand gradually to additional trusted partners through the Fairwind Program.

Google says it is also participating in the U.S. government’s voluntary pre-release model-testing process and continuing to refine safeguards before making Carbon available to developers, businesses, and consumers.

The company has not provided a firm public release date.

Why is Google limiting access?

#

Carbon’s cybersecurity capabilities create a dual-use problem.

The same technology that helps defenders discover vulnerabilities and develop patches could potentially assist attackers in identifying weaknesses and constructing exploits.

Restricting initial access gives Google an opportunity to evaluate the model with selected security professionals, collect feedback, and improve its safeguards before a broader rollout.

The approach is consistent with the model’s focus on security research and autonomous engineering, although it also limits the ability of independent developers to evaluate the product directly.

The vaporware criticism

#

The restricted launch has generated frustration among some developers and AI enthusiasts.

The criticism is not necessarily that Carbon lacks meaningful capabilities. Instead, users question the value of announcing a model with impressive benchmark results when most people cannot access it.

This frustration is particularly visible in discussions surrounding Gemini 4 Argon’s usage limits and availability.

Hacker News discussions include reports from individual Argon users who experienced rapid quota consumption during complex tasks, while others described less restrictive usage under different workflows and subscription configurations.

These are anecdotal experiences rather than a standardized measurement of Google’s quota policies. Nevertheless, they highlight a practical issue: a powerful model is only useful when developers can access it reliably and afford to run their workloads.

Carbon’s limited release makes that question even more important.

For now, Google’s announcement establishes the model’s initial rollout strategy, not a general availability date.

💰 Gemini 4 Carbon Pricing: $2 per Million Input Tokens

#

Google is launching Gemini 4 Carbon at the same introductory API pricing as Gemini 4 Argon.

Artificial Analysis describes the introductory pricing as a 50% launch discount, with no confirmed end date at the time of its evaluation.

This pricing is attractive for a frontier model focused on long-horizon engineering and cybersecurity. However, token prices alone do not establish the total cost of completing a task.

An agent that spends several hours analyzing a repository, invoking tools, and generating large amounts of code may consume substantially more tokens than a conventional question-answering request.

Artificial Analysis estimates that Carbon’s standard-priced Intelligence Index task costs approximately $7.76, compared with $10.04 for Claude Opus 5.5 Max in its evaluation.

That suggests Carbon can offer a lower cost per task in this particular comparison, although actual expenses depend on the workflow, reasoning configuration, context length, and output volume.

Developers evaluating Carbon for production should therefore consider cost per successfully completed task rather than simply comparing the price of one million tokens.

🔍 What Gemini 4 Carbon Means for the AI Competition

#

Gemini 4 Carbon represents another important step in the race toward autonomous AI systems.

Its Intelligence Index score of 59 gives Google a new overall leaderboard leader. Its cybersecurity results also demonstrate progress in applying frontier models to vulnerability discovery, exploit validation, and software remediation.

However, the results should not be interpreted as proof that Google has overtaken every competitor in every category.

Artificial Analysis places Carbon behind Claude Opus 5.5 on its Coding Agent Index, and Carbon’s WebDev Arena position is fourth rather than first. The Intelligence Index itself is a composite score, not a universal measure of model quality.

The availability question is equally important. Google has chosen to begin with a restricted cybersecurity deployment, meaning that independent developers and ordinary users cannot yet assess the model under their own workloads.

The next phase of competition will depend on several factors:

• Long-horizon reliability: Can Carbon consistently complete multi-day engineering tasks with minimal human intervention?
• Security effectiveness: Do its benchmark improvements translate into useful vulnerability discovery and remediation in production environments?
• Agent safety: Can it reliably respect permissions and avoid prompt injection across diverse applications?
• Inference economics: Will the model deliver competitive cost per completed task as reasoning workloads become more demanding?
• Availability: How quickly can Google expand access without compromising its safety requirements?

These questions will matter more than a single leaderboard position.

🏁 Conclusion: A Major Gemini Upgrade, but Access Is the Next Test

#

Gemini 4 Carbon is one of Google’s most ambitious frontier model releases to date.

Its 59-point score on Artificial Analysis Intelligence Index v5 places it at the top of that evaluation, while its cybersecurity results demonstrate strong capabilities across vulnerability detection, exploit validation, and patch generation.

The ability to sustain engineering workflows for days is particularly interesting. It points toward a future in which AI systems do not merely generate code but take responsibility for substantial portions of software development and security operations.

Google has also placed significant emphasis on reliability. Reduced shortcut behavior, fewer unsupported claims, lower misalignment rates, and improved resistance to indirect prompt injection all address problems that become increasingly important as AI agents receive more autonomy.

Yet Carbon’s most important test is still ahead.

The model is initially available only to selected cybersecurity defenders and trusted partners. Its benchmark leadership therefore remains easier to evaluate than its value in everyday production workflows.

Google has made a compelling technical statement. The next challenge is turning that achievement into a model that developers, businesses, and ordinary users can actually access and rely on.

In the current AI race, claiming the No. 1 position is impressive. Making that capability consistently useful is the harder achievement.