Gemini 4 Carbon puts Google on top of the AA Index, but its first release goes only to cyber defenders

Google has released Gemini 4 Carbon, its newest frontier model. The company says it brings "significant gains" in coding, agentic tasks and cybersecurity. The Verge reports that Carbon holds the top spot on version 5.0 of the Artificial Analysis Intelligence Index, a broad composite benchmark, with Anthropic's Claude Opus 5.5 and OpenAI's GPT-6 Astra behind it. Access is limited for now. Only a select group of cybersecurity defense companies can use Carbon. Google says it will later expand to other partners in its Fairwind Program.

Cybersecurity is the headline. Google calls Carbon a "significant leap" in cyberdefense, saying it is better at finding vulnerabilities and writing secure code. According to the company, Carbon ranks first on two benchmarks. SEC-bench Pro measures how well a model finds real-world bugs. ExploitGym measures how well it turns a vulnerability into a working exploit. Google also says Carbon beat GPT-6 Astra on SEC-bench Pro. The model is an upgrade over Gemini 4 Argon, which Google released earlier this month. That pace says a lot on its own: two frontier releases in a matter of weeks.

Google's other claims point toward agents. The company says its internal teams have seen Carbon "run for days" and "persist through dead ends" on complex, multi-step engineering tasks. Google also says Carbon is better at avoiding shortcuts, resisting prompt injection (attacks that hide malicious instructions inside the content a model reads) and collaborating with users. It says Carbon makes half as many "unsupported claims" as Argon. The introductory price stays the same as Argon's: $2 per million input tokens and $10 per million output tokens.

Some caution is needed. Google picked the benchmarks it highlights, and almost nobody outside its partner circle can test the model yet. Our own rankings have had Google solid but behind Anthropic and OpenAI on the hardest tasks. If independent tests confirm the AA Index lead, that would be a real shift. The two cyber benchmarks are also the right kind to watch. Saturated tests like Cybench, where models score near 100%, no longer tell the leaders apart. SEC-bench Pro and ExploitGym measure real bugs and real exploits. But a model that is better at writing exploits is, by definition, more dangerous in the wrong hands. A top score there describes a risk that needs managing, not a feature to celebrate.

Our reading: the most important decision here is the rollout, not the benchmark score. By giving Carbon to defenders first, Google is following the logic we saw with Anthropic's Mythos 6. At the frontier, a strong enough model stops being treated as a plain product and becomes a controlled asset, with access tiered by who uses it and why. Whether that becomes a lasting governance norm or a one-off marketing gesture depends on what comes next. We'll be watching for independent evaluations, the criteria for expanding the Fairwind Program, and whether the claimed prompt-injection resistance holds up outside Google's tests. In the short term, the risk is familiar: exploit-writing ability is spreading faster than most organizations can patch. Over the long term, the picture is more hopeful. Models that find and fix vulnerabilities at scale, and that can work on hard engineering problems for days, could make software much safer. That is the kind of abundance worth wanting, but only if defenders get these models first and evidence, not press releases, decides who gets them next.