Google announces Gemini 4 Carbon for cyber defenders

Google announced Gemini 4 Carbon on October 28, an AI model for programmers and security teams to write and repair software. First cyber-defender access is planned this week; general availability has no date. Google’s announcement

Carbon arrives with a narrow lead on an independent measure of overall AI performance and stronger reported security scores. Those findings come from several different testing arrangements. Reading them together gives software teams a more useful picture of Carbon than a single first-place label: where it improves, what researchers tested, and which costs remain unmeasured.

A small lead across nine tests

Artificial Analysis places Carbon, at its High reasoning setting, first on its version 5.0 Intelligence Index with 59 points. Claude Opus 5.5 at Max with Default Fallback follows at 58, and GPT-6 Astra at Max scores 57. These are the published rounded scores as checked October 28. Artificial Analysis’ current index combines nine evaluations.

The index gives equal weight to four broad areas: knowledge work, coding, science and general capabilities. Its methods describe a mainly English-language, text-based suite. Some tasks allow agents to run code or use software tools; others ask for answers without them. An agent is a model linked to software that lets it take several steps toward a task, such as inspecting files, changing code and checking its answer. The mix includes short answers as well as tasks requiring completed files.

For example, FrontierCode 2.0 asks agents to change real open-source software projects. Artificial Analysis runs its 132 tasks three times each, then checks submitted changes against tests and grading criteria. A failed blocking check gives an attempt zero. This assesses whether an agent can deliver an acceptable code change, including the steps needed to produce it. The published method explains the grading.

A 59-point index score therefore has a different meaning from a 59% success rate on a particular task. The combined ranking depends on which abilities the evaluator includes and how much each counts. A team choosing a coding assistant can learn more from tests close to its own projects than from the overall order alone.

Google’s evaluation report records a coding test where Astra finishes ahead. On FrontierSWE 2, Carbon scores 61.2%, compared with Astra’s 65.5%.

Security scores cover different jobs

CWE-bench, created by Collinear AI, asks agents to audit real open-source projects and repair security problems without being told where the flaws are. Carbon leads with 71% on its main score from automated tests, ahead of Argon and Astra at 68%. A fix passes only when an exploit stops working and existing tests continue to pass. The evaluation contains 120 tasks covering 73 weakness types.

CWE-bench lists Carbon running in Antigravity, Astra in Codex and Opus in Claude Code. These programs control how models investigate and edit code, so scores reflect each model together with its surrounding software.

CWE-bench allows four runs per task, each capped at an hour. The headline pass@1 figure summarizes success per attempt; pass@4 measures whether at least one of four attempts succeeds. Carbon reaches 81% on the latter programmatic measure. The leaderboard has not published Carbon’s average cost per run.

Google reports 88.2% on SEC-bench Pro, using 183 tasks in a May 2026 JavaScript-engine subset. It averages three independent runs per task. Google’s own checks require a demonstration that crashes vulnerable software under its stated judging rules. Its separate ExploitGym evaluation runs without internet access and with system defenses disabled, testing both six-hour and ten-hour limits. The report does not assign its 54.8% headline to one of those limits. Google’s methodology provides these conditions.

The SEC-bench Pro website describes a broader 344-case combined leaderboard covering V8, Firefox and Linux. Google’s slice and the public table cover different problems. The project tests vulnerability discovery and proof-of-concept generation: producing an input or program that demonstrates a software flaw.

ExploitGym tests another step, developing an exploit from a real vulnerability. Its public repository spans ordinary programs, Google’s V8 engine and the Linux kernel; its current v1.0 release lists 869 cases. Google’s report does not supply an ExploitGym task count for its Carbon run, so the public total should not be substituted as the denominator for Google’s percentage.

Finding a flaw, showing that someone can exploit it and repairing it require different actions. Assessing a security assistant also requires checking whether its fixes preserve the program’s normal behavior, how much staff review each change needs and how often repeated runs fail on the same problem.

Price depends on how much Carbon does

Google announces introductory rates of $2 per million input tokens and $10 for output, later doubling to $4 and $20. It gives no expiry date. Google’s pricing footnote specifies those rates.

Artificial Analysis currently uses those higher rates and reports an average $7.76 per Intelligence Index task for Carbon. It also reports 200 million output tokens across that evaluation. Tokens are small pieces of text that a model processes or generates. Its model page lists these measurements. The evaluator calculates task cost from input, cached input, reasoning and answer tokens, weighted across the tests.

An illustrative bill makes the distinction clearer. At the later rates, processing 100,000 uncached input tokens and producing 10,000 output tokens costs 60 cents. More output raises that bill even if the task remains unfinished. For teams comparing coding assistants, staff time spent reviewing and merging a patch adds another cost. Artificial Analysis’ benchmark figure covers model tokens, leaving that labor expense unmeasured.