Gemini 4 Carbon: our next frontier model

Jessica The weird part is, Google's most general frontier claim is hiding inside a very specific cyber rollout.

Cathy Yeah. Carbon is framed as Gemini's new top model, but the launch is basically saying: trust the cybersecurity and long-horizon results before you trust the chatbot vibes. That is a much sharper claim than another leaderboard screenshot.

Jessica And the leaderboard is still there. Carbon scores fifty-nine on Artificial Analysis Intelligence Index version five. Quick refresher, that index is a composite across things like knowledge, coding, science, and general reasoning, and the newer version leans more on private tests to make contamination harder.

Cathy Right.

Jessica So number one matters, but it matters as a shape indicator, not a crown ceremony. The practical consequence is that Google is trying to make Carbon feel like the model you route hard security and engineering work to, while most people cannot actually touch it yet.

Cathy Also, Argon was two weeks ago. I had this tiny moment of checking the model names like we are sorting lab samples now. Carbon, Argon. If Neon shows up with a debugger, I'm leaving the periodic table open.

Jessica Stop it.

Cathy The technical story is coherent, though. Long-horizon here means tasks that need many steps over time, not one clever answer. Google says internal teams have had Carbon run for days, hitting dead ends, then continuing until it can root-cause and patch subtle bugs across big codebases and low-level systems.

Jessica Mm-hm.

Cathy Then the cyber benchmarks line up with that lifecycle. S E C-bench Pro is about finding real vulnerabilities, and Carbon gets eighty-eight point two percent. ExploitGym asks whether a found issue can actually be exploited, and Carbon gets fifty-four point eight percent. C W E-bench is patching the root cause, and Carbon reaches seventy-one percent.

Jessica That is the part product people should care about, honestly. Security teams do not just need a model that says, maybe this code is sketchy. They need triage, proof of risk, and a patch that survives review. If Carbon can connect those steps, even for a narrow trusted cohort, that is a workflow.

Cathy Sure.

Jessica But Google is not pretending this is a normal developer launch. Access starts with a subset of cyber defenders, then trusted partners through Fairwind, then broader products later. Price is the same introductory level as Argon: two dollars per million input tokens, ten dollars per million output tokens, and cached input tokens at ninety-five percent off.

Cathy The access gate is doing real work in that sentence. Google says those external cyber benchmarks were evaluated without guardrails, which is useful for measuring raw capability. But the shipped product will have misuse defenses, refusals, monitoring, and probably lots of policy machinery around it.

Jessica Yeah.

Cathy So I buy the technical direction more than I buy every implied deployment claim. The same model that validates exploitability for defenders is also the model you have to keep from becoming an exploit assistant. That is not a decorative caveat. It changes whether the benchmark maps cleanly to work.

Jessica Cathy, I think you're slightly underplaying why the gated version might still be the product. We keep coming back to this doorway question: who controls the surface where the model meets real systems. For Carbon, the doorway is almost the whole thing. If only vetted defenders get it first, that is not just caution, it is part of the offering.

Cathy Okay, fair.

Jessica And I would want to see whether those defenders get fewer abandoned investigations, cleaner patches, or faster validation loops. Not whether the model sounds impressive in a demo. The article's best evidence points at that, but a lot of it is still internal.

Cathy The safety numbers are where I perked up. Google says Carbon reduced successful cheating on Terminal-Bench four point oh to zero point zero percent, while attempts to cheat dropped to zero point four percent. It also says high-severity misalignment alerts in live coding environments fell by almost eighty percent, and unsupported claims were cut roughly in half versus Argon.

Jessica Oh wow.

Cathy And on Gray Swan's indirect prompt injection benchmark, Argon already had a zero point seven percent attack success rate. Carbon is reported at zero point zero percent. Prompt injection is when malicious instructions are hidden in data the model reads, like a webpage telling an agent to ignore its user and leak something.

Jessica The collaboration claim is maybe less flashy, but I like it. Google says Carbon retrieves relevant sources, surfaces discrepancies before acting, and is better about withholding blocked actions with a clear list of what remains required. That is exactly where agents usually get weirdly confident.

Cathy Hm.

Jessica They also report overreach down twenty-six percent and under-service down twenty-nine percent. Which is a very Google-y pair of measurements, but the underlying behavior matters: do the thing you were asked to do, and do not quietly expand the mission.

Cathy Jessica, the sentence I land on is: Carbon's real test is whether Google can turn dangerous cyber capability into a controlled workflow, because right now the strongest evidence is also the reason access is gated. The benchmarks make the capability plausible. The rollout has to prove the usefulness survives contact with controls.

Jessica That is where I am too. And it is funny, because the score of fifty-nine will get the screenshot treatment, but the actual buyer story is much narrower. A security platform, a Chrome-scale codebase, a team drowning in vulnerability triage. Those are the people who should look first.

Cathy The Chrome example is interesting, but I would keep it in pencil. Google says Carbon performed more than ten times better than another lab's frontier model at generating high-quality patches. I want the setup, the patch criteria, and the baseline before I let that sentence get too comfortable.

Jessica All right, Cathy, I'm putting Carbon in the handle-with-tongs folder, and leaving the leaderboard tab only halfway open.