Gemini 4 Carbon Tops the Index With No Price on the Board That Counts

TL;DR

Google announced Gemini 4 Carbon on October 28, 2026 and put it first on the Artificial Analysis Intelligence Index v5.0 at 59, with 88.2% on SEC-bench Pro, 54.8% on ExploitGym and 71.0% on CWE-bench.
Those three cyber numbers are a funnel — find, exploit, patch — and the last stage, the one an agent has to actually complete, is the weakest of the three.
Access is gated: a subset of cyber defenders first, then trusted partners through the Fairwind Program. No general availability date, no public API row.
On the one public leaderboard that carries a cost column, Carbon’s cell is empty. Claude Opus 5.5 fixes 67% of tasks at $0.79 per rollout; Gemini 4 Argon fixes 68% at $6.63; Carbon fixes 71% at “—”.
Independent testers put Carbon first overall but behind Opus 5.5 on coding agents (59 against 62), and its hallucination rate is 11% against Argon’s 4%.

The best model Google has is the one you cannot buy

For two years the frontier release ritual has been the same: benchmark table, price list, API key. Gemini 4 Carbon breaks the pattern. Google published the numbers, the price and the safety claims, then handed the model to vetted defenders instead of developers.

“Carbon ranks #1 on the recently updated v5.0 of Artificial Analysis Intelligence Index at 59,” the announcement states, and it “shows significant gains across coding and agentic tasks” — the pitch is long-horizon engineering work, with Google saying internal teams have watched the model run for days on multi-step debugging across large codebases. (Source : Google — Gemini 4 Carbon: our next frontier model)

That framing matters for anyone building agents, because the thing being sold is no longer a better answer. It is a better shift: a task that survives hundreds of tool calls without drifting. The question this article asks is narrower than “is Carbon good”. It is: what does Carbon cost per unit of work actually finished, and can you check that answer? For the second half of that question, the leaderboards say no.

The three cyber scores are a funnel, not a headline

Google’s security numbers are usually quoted as a triple. They are better read as a sequence, because each stage consumes the output of the previous one:

Stage	Benchmark	Carbon	What it means
Find	SEC-bench Pro	88.2%	Autonomously uncovering real flaws in real software
Validate	ExploitGym	54.8%	Turning a finding into a working exploit to rank severity
Fix	CWE-bench (Collinear)	71.0%	Producing a patch that blocks the exploit and keeps the code working

End to end, a defender who wants a shipped fix is multiplying, not averaging: 0.882 × 0.710 puts the best case near 63% of findings landing as a merged patch, before any human review. Google’s own wording is careful — the model “lands a firm lead” on detection and exploitation and merely “reaches 71.0%” on patching. (Source : Google)

That is the quiet problem with agentic security work. Finding bugs has never been the bottleneck; a scanner finds bugs by the thousand. The queue is patching, and a 71% patch rate on a benchmark where each task is a real open-source repository is respectable and still means roughly three in ten agent-written fixes fail a grader that checks both exploit blocked and functionality preserved. The commentary around the launch agrees: finding faster than you can fix converts a capability into a backlog. (Source : explainx.ai — Gemini 4 Carbon launch)

Two conditions attach to all three figures. Google says the cyber benchmarks were run “evaluated without guardrails”, so the shipped, guarded model is not the model that scored. And as of October 29 the public SEC-bench Pro leaderboard has no Carbon row, while CWE-bench — the only one of the three with public cost data — does.

Where the independent numbers disagree with the launch post

The aggregate index is corroborated. Carbon sits at 59 on Intelligence Index v5.0, first of 52 models, roughly nine points above Gemini 4 Argon. The rest of the picture is less flattering:

Measure	Carbon	Best rival on the same measure
AA Coding Agent Index	59 (Antigravity CLI)	Claude Opus 5.5 via Claude Code: 62
AA-Omniscience hallucination	11%	Gemini 4 Argon: 4%
Cost per Intelligence Index task	$7.76	GPT-6 Astra: $6.25 (Opus 5.5: $10.04)
Output tokens per index task	123k	200M tokens for a full index run vs a 64M median

(Source : NeuralTrust — Gemini 4 Carbon benchmarks, pricing, citing Artificial Analysis)

The hallucination line is the one to keep. Google reports that Carbon cuts unsupported claims “by approximately 2x over Argon” in internal testing, and Artificial Analysis measures the opposite movement on its knowledge benchmark — 4% to 11% between two models released two weeks apart. Both can be true: internal live-coding checks and a public question set probe different behaviours. But an agent that patches a vulnerability it misdescribed is a worse failure mode than an agent that abstains, and this is the first Gemini 4 release in which the independent fabrication number moved the wrong way.

Verbosity compounds it. At 123k output tokens per index task and 200M for a full run, Carbon spends compute on reasoning the buyer pays for; the $7.76 per task is only 23% below Opus 5.5 and 1.2 times GPT-6 Astra, despite a lower sticker price per million tokens. That gap between list price and cost per completed task is the same trap TAR documented in the agent-runtime economics of AWS Infinity: tokens per turn, not tokens per million, set the bill.

The cost column that says “—”

Collinear’s CWE-bench leaderboard is the only public scoreboard where Carbon and competitors are graded by an identical harness: four rollouts per task, 120 tasks, one-hour limit each, real repository checkout, one instruction — audit and fix. It is the closest thing to a like-for-like patch test that exists today.

Rank	Model	Programmatic pass@1	Avg cost per rollout
1	Gemini 4 Carbon (Antigravity)	71%	—
T2	Grok 4.7 (opencode)	68%	$2.75
T2	Gemini 4 Argon (Antigravity)	68%	$6.63
T2	GPT-6 Astra (Codex)	68%	$2.85
5	Claude Opus 5.5 (Claude Code)	67%	$0.79
6	Claude Fable 5.1 (Claude Code)	58%	$3.47

(Source : CWE-bench leaderboard via braindetox.kr)

Read the cost column next to the score column and the ranking inverts. Carbon is four points ahead of Opus 5.5 in pass@1 and, on the only published cost figure in its row, undefined — the leaderboard “notes that Carbon has no cost figure yet, so it is on the leaderboard but not on the cost chart.” Argon, the model Google will actually sell you today, posts the same 68% as Grok 4.7 and GPT-6 Astra at $6.63 per rollout against $2.75 and $2.85 — more than twice the cost for the same success rate. On the one axis a security team has to defend in a budget meeting, the newest Gemini 4 model is not the best value on the board; it is absent from the argument.

A second caveat cuts the other way for the cyber headline. Jake Handy’s review notes the ExploitGym result used a 10-hour cap against 6 hours for Opus 5.5, and that at 6 hours Carbon scores 53.5%. Benchmark caps are a legitimate methodological choice and an easy way to win a horse race.

Gated cyber models are becoming a product class

Carbon is not the first restricted cyber release. DeepSeek’s V4.1 Flash 1017 scores 57% on Artificial Analysis’ Cyber Index, behind OpenAI’s restricted GPT-6 Sol (Daybreak Blue, max) at 69% — a model TAR covered as an agentic benchmark story in DeepSeek V4.1 Flash 1017. Google’s gate is the most formalised so far: the Fairwind Program reportedly covers more than 650 partners, prioritising governments, critical infrastructure and core software platforms, with phishing-resistant MFA, internal-technology-only access, tracked usage and a ban on redistribution. Apply through your Cloud account team; there is no self-serve door.

For agent operators outside that cohort, the useful conclusion is not “wait for Carbon”. It is that the capability will arrive on a normal API eventually — Argon went from gated to generally available in about two weeks — and that the controls you need are the ones that do not depend on which model answers: scoped credentials per agent, human approval before a patch merges, a token budget per run, and your own replication of any vendor benchmark you plan to cite internally. The pattern is already familiar from the $50-per-breach economics of agentic intrusion and from Replit’s three-switch monitoring agent: the model improves, the approval boundary is still yours to draw.

FAQ

Can I use Gemini 4 Carbon today? No. Google says it is available “starting this week” to a subset of cyber defenders, then phases access through the Fairwind Program, with developer, business and consumer access promised only “as soon as possible” and no date.

What does Carbon cost? Introductory pricing is $2 per million input tokens and $10 per million output tokens, cached input 95% off. A footnote sets the post-introductory rate at $4 and $20. Google gives no end date for Carbon’s introductory window, unlike Argon’s, which the pricing page ties to November 30, 2026.

How does it compare with Claude Opus 5.5 and GPT-6 Astra? First on the aggregate Intelligence Index at 59, behind Opus 5.5 on Artificial Analysis’ Coding Agent Index (59 against 62), and on CWE-bench it leads on pass@1 (71% vs 67%) while Opus 5.5 costs $0.79 per rollout against a blank cell for Carbon. Cost per Intelligence Index task: $7.76 for Carbon, $6.25 for GPT-6 Astra, $10.04 for Opus 5.5.

Are the security scores verified? Partly. CWE-bench is independently run and shows Carbon at 71% pass@1. SEC-bench Pro and ExploitGym have no public Carbon row as of October 29, and Google states all three were evaluated without guardrails.

Should agent builders care about a model they cannot access? Yes, for two reasons: the token economics predict the bill when access opens, and the gating itself signals that Google considers this capability powerful enough to restrict — which is the argument for putting approval gates around your own agents now rather than after the API key lands.