Gemini 4 Carbon: our next frontier model

TL;DR

Gemini 4 Carbon is Google DeepMind’s next frontier model, shipped two weeks after Gemini 4 Argon and positioned specifically for state-of-the-art cybersecurity defense and long-horizon engineering tasks. Carbon ranks #1 on Artificial Analysis Intelligence Index v5.0 at 59, and claims SOTA on three external cybersecurity benchmarks: SEC-bench Pro (88.2%) for finding vulnerabilities, ExploitGym (54.8%) for exploitability validation, and Collinear CWE-bench (71.0%) for patching. Headline alignment claim: Carbon reduces successful Terminal-Bench 4.0 cheating to 0.0% (attempts to 0.4%), cuts unsupported claims ~2×, and achieves 0.0% attack success on Gray Swan’s Indirect Prompt Injection benchmark (down from Argon’s 0.7%). Initial release is gated to cyber defenders via the Fairwind Program; pricing matches Argon at $2/$ 10 per 1M input/output tokens.

Key claims

Ranks #1 on Artificial Analysis Intelligence Index v5.0 at a score of 59 [§opening].
Achieves SEC-bench Pro 88.2% (vulnerability finding), ExploitGym 54.8% (exploitation), CWE-bench 71.0% (patching) — reported as SOTA across the cybersecurity defense lifecycle [§State-of-the-art cybersecurity performance].
+89 elo on WebDev Arena, landing #4 at 1769 — framed as evidence of broader coding/UI improvement beyond cybersecurity [§Improving coding and reasoning].
Reports >2× uplift in secure-code generation success rate over Argon on internal benchmarks; Chrome team reports >10× improvement over an unnamed competing frontier model on patch generation [§State-of-the-art cybersecurity performance].
Terminal-Bench 4.0 successful-cheating rate reduced to 0.0% (attempts drop to 0.4%) while overall accuracy improves; high-severity misalignment alerts in live internal coding environments dropped ~80% [§Advancing frontier model safety & security].
Carbon cuts “unsupported claims” (fabrication-shaped failure) ~2× vs Argon in internal testing [§Advancing frontier model safety & security].
Overreach reduced 26% and under-service reduced 29% simultaneously — reported as “much more reliable execution of multi-step plans end-to-end” [§Advancing frontier model safety & security].
0.0% attack success rate on Gray Swan’s Indirect Prompt Injection Benchmark, down from Argon’s 0.7% [§Advancing frontier model safety & security].
Carbon is designed for sustained agentic workflows; internally reported running “for days” on complex multi-step engineering tasks like root-causing and patching subtle cross-codebase bugs [§Improving coding and reasoning].
Priced identically to Argon at $2/M input tokens and$ 10/M output tokens, with cached input at 95% off [§opening].
Initial access gated through the Fairwind Program to cyber defenders; broader rollout to developers/businesses/consumers deferred; also described as “actively engaged in the U.S. government’s voluntary process for pre-release model testing” [§opening].

Method

Not disclosed. No architecture, parameter count, training compute, context length, modality list, or training-recipe detail. The blog is a product/positioning announcement: it quantifies capability (cybersecurity benchmark trio, WebDev Arena elo, Artificial Analysis Intelligence Index) and alignment (Terminal-Bench cheating rate, Gray Swan IPI, misalignment-alert telemetry, overreach/under-service metrics) but defers to the referenced Safety and Security report for Argon-level methodology, and does not include a separate Carbon tech report. The one architectural commitment implied by the “deliberate rollout” framing is that the same Fairwind trusted-tester gate used for Argon has been extended rather than reopened. Pricing match with Argon suggests comparable inference cost on Google infrastructure.

Results

Headline aggregate: Artificial Analysis Intelligence Index v5.0 = 59 (#1).
Cybersecurity external benchmarks (evaluated “without guardrails”):
- SEC-bench Pro: 88.2% (vulnerability finding)
- ExploitGym: 54.8% (exploitability validation)
- CWE-bench: 71.0% (patching)
Web development: WebDev Arena #4 at 1769 elo (+89 pts over previous).
Alignment / safety deltas vs Argon:
- Terminal-Bench 4.0 successful cheating: 0.0% (attempts: 0.4%)
- High-severity misalignment alerts in internal live coding deployments: ~80% reduction
- Unsupported claims: ~2× reduction
- Overreach: −26%; under-service: −29%
- Gray Swan Indirect Prompt Injection attack success: 0.0% (Argon: 0.7%)
Internal benchmarks (no absolute numbers given):
- Secure-code generation success rate: >2× uplift over Argon
- Chrome team patch generation: >10× better than an unnamed competing lab’s large frontier model
No head-to-head numbers against GPT-5.5 / 5.4 / Codex, Claude Opus 5.5, Kimi K3.1 Pro, or DeepSeek V4.1-Flash on the open agentic-SWE benchmark quadruple (SWE-Bench Pro / Terminal-Bench 2.0 or 4.0 / OSWorld / GDPval) that recent releases on this concept page have adopted.

Why it’s interesting

Three things. First, Carbon is the first filed closed-frontier release where the headline capability axis is cybersecurity defense, not SWE-Bench Pro + Terminal-Bench + OSWorld + GDPval — the benchmark quadruple Introducing GPT-5.3-Codex established and that most of the open MoE pack (Kimi K3, GLM-4.7, DeepSeek V3.2, Step 3.5 Flash) now reports against. The three-benchmark cyber trio (SEC-bench Pro / ExploitGym / CWE-bench) is a different evaluation surface oriented around the vulnerability lifecycle: find → validate → patch. This complements the Agentic Software Engineering cluster’s execution-grounded-RL recipe but extends the evaluation axis specifically toward adversarial code understanding and secure code generation.

Second, the alignment metrics Carbon publishes are the most concrete filed numbers on reward-hacking resistance in a frontier model. The Terminal-Bench 4.0 successful-cheating rate dropping to 0.0% (with cheating attempts at 0.4%) is a direct response to the natural-cyber-eval reward-hacking failure mode METR documented in Brief independent investigation of agents' behavior, reasoning and collaboration in the OpenAI / Hugging Face hacking incident, and sits adjacent to Opus 4.7’s and 4.8’s effort-tier framing (Introducing Claude Opus 4.7, Introducing Claude Opus 4.8) where cyber-capability differential reduction is becoming a shipped alignment deliverable rather than only a scaling-framework commitment. The 0.0% IPI result is also notable — if it holds up under third-party replication, that’s the first zero-attack-success filed on this concept page.

Third, the two-week Argon → Carbon cadence is itself the story. Argon (Google DeepMind announces Gemini 4 Argon — new frontier model with 1M-token output for coding, enterprise knowledge work, and cybersecurity defense) was positioned as the “deeper multi-step reasoning in one go” model with 1M-token output; Carbon is a specialized cybersecurity + long-horizon-coding sibling released only two weeks later at the same price. This mirrors the OpenAI pattern of shipping a Codex specialization alongside the main line (Introducing GPT-5.3-Codex) but at a much tighter release interval, and raises the open question of whether Google is now shipping task-specialized frontier variants on an Argon-scale base model, or whether Carbon is a distinct training run.