Carbon tops the Artificial Analysis index at 59 against 58 for Claude Opus 5.5, at about 23 percent less per task at list prices. Developers cannot buy it yet, and the test where it leads widely measures exploit writing.
Google has released the top ranked model on the independent Artificial Analysis index to almost nobody. Gemini 4 Carbon, announced on 28 October, goes this week to a subset of cyber defenders. Developers, businesses and consumers are told only that access will follow "as soon as possible".
Carbon's lead is thin on general work and patching, and wide on exploit writing. Google is rationing that capability through its Fairwind Program. For anyone choosing a coding or security model before December, the choice is Gemini 4 Argon now or Carbon later.
Carbon's one point lead is a tie for most purposes. Artificial Analysis puts Carbon at 59 on version 5.0 of its Intelligence Index, a composite score of model quality. Claude Opus 5.5 scores 58, and a second Opus 5.5 setting scores 57.
The cost side is clearer. On the data owner's list price figures, a task costs $7.76 on Carbon and $10.04 on Opus 5.5, which is about 23 percent less.
Carbon's gain over its own sibling came almost free. Argon scores 50 and costs $7.68 per task, so Carbon added nine index points for one percent more per task.
Carbon wrote 82 percent more output than Argon, 200 million tokens against 110 million. Output volume did not move the bill.
Artificial Analysis lists all three models at $4 per million input tokens and $20 per million output tokens. Opus 5.5 wrote 220 million tokens, and its tasks cost $10.04.
Where the benchmark lead narrows
Patching shows the same pattern. Google reports 71.0 percent for Carbon on CWE-bench, a test of fixing real software flaws, and calls the lead firm. The CWE-bench leaderboard uses 120 held out tasks, four attempts each.
On the first attempt Carbon passes 71 percent, three points over a three way tie. Argon, Grok 4.7 and GPT-6 Astra all sit at 68 percent, and Opus 5.5 at 67. Given four attempts, Carbon's 81 percent ties Grok 4.7.
The same table shows where Carbon is weak. It passes 39 percent of data integrity tasks and 56 percent of authentication failure tasks, against 85 percent for cryptographic failures. A team triaging integrity and login bugs gets no clear gain from Carbon.
Gemini 4 Carbon passes 71 percent of CWE-bench v1 audit and patch tasks on the first attempt, three points above the three models tied at 68 percent and four above Claude Opus 5.5.
View data
| Model | Programmatic pass at 1, percent |
|---|---|
| Gemini 4 Carbon | 71 |
| Gemini 4 Argon | 68 |
| Grok 4.7 | 68 |
| GPT-6 Astra | 68 |
| Claude Opus 5.5 | 67 |
Google's other claims come from its own tests. It says Carbon more than doubles Argon's success rate at generating secure code. The Chrome team reported Carbon performed more than 10 times better than another lab's large frontier model at writing high quality patches.
On vulnerability finding the lead is also narrow. Google's own SEC-bench Pro chart shows Carbon at 88.2 percent and GPT-6 Astra at 85.4, a gap of 2.8 points. Argon scores 83.4.
Where Carbon pulls ahead
Exploit writing is where Carbon pulls away. Google reports 54.8 percent on ExploitGym, which asks a model to turn a known vulnerability into a working exploit. The benchmark covers 869 real flaws in userspace programs, the V8 browser engine and the Linux kernel.
On Google's chart that is 12 points above GPT-6 Astra, the top entry on the public ExploitGym leaderboard at 42.4 percent. It is nearly 13 above Argon at 42.0 percent.
Time caps differ: Google gave Carbon and Argon 10 hours per task and Astra none. At the same six hour cap the gap holds. Carbon scores 53.5 percent, Argon 39.5 and Opus 5.5 34.5.
The jump over Argon is the point. Argon is already on sale, and its 42.0 percent is within half a point of the best public entry's 42.4.
The benchmark's authors write that "This is inherently dual-use". With memory defences such as ASLR, stack canaries and the V8 heap sandbox switched on, successes "dropped substantially but didn't hit zero". A model that writes exploits this reliably serves attackers as well as defenders.
Google says it is taking "a deliberate approach" and is engaged in the U.S. government's voluntary process for testing models before release. It will phase access to additional trusted partners through Fairwind.
The access restrictions look like a response to that 13 point jump. Capacity alone would not need a vetted cohort or a government test. A model that writes working exploits does.
Google also reports that Carbon blocked every evaluated attack on Gray Swan's indirect prompt injection test, against 0.7 percent success for Argon. On WebDev Arena, a web development leaderboard, Carbon jumped 89 Elo points to fourth place at 1768. Neither measures exploit writing.
Access and the price deadline
Argon is the model to compare. Google announced it on 30 September and opened it to developers on 13 October, so Carbon arrives two weeks after Argon reached developers. Google's Carbon post calls Argon "launched two weeks ago".
The price clock makes the wait costly to plan around. Google prices Carbon at the same introductory rate as Argon: $2 per million input tokens and $10 per million output tokens. Cached input tokens cost 95 percent less.
Google's pricing page ends Argon's introductory rate on 30 November. From 1 December Argon costs $4 and $20. Gemini 3.8 Flash output rises from $3.75 to $7.50 on 1 January 2027.
Budget Carbon at $4 and $20. Artificial Analysis already lists it there, which is what its $7.76 per task reflects, against $10.04 for Opus 5.5 on the same index.
Argon is available to buy today. It is available through the API in AI Studio at the introductory price. It sits nine index points lower, and its exploit score is within half a point of the best public entry. Carbon needs a Fairwind slot or a wait.
Carbon should reach the Gemini API by 1 December, the day Argon's introductory rate ends. A Carbon still gated on that date would show that safety testing, not the price calendar, sets the release date. Once it is open, new ExploitGym and SEC-bench Pro listings will show whether the 54.8 percent holds under the leaderboards' own budget rules.