Google's Top-Ranked Model Goes Only to Cyber Defenders

Google announced its most capable model on 28 October 2026 and almost nobody can use it. Gemini 4 Carbon takes first place on version 5.0 of the Artificial Analysis Intelligence Index at 59, ahead of Anthropic's Claude Opus 5.5 at 58 and OpenAI's GPT-6 Astra at 57, and for now it is going to what Google calls a subset of cyber defenders through its Fairwind Program. There is no date for developers, businesses or consumers.

The announcement was written by Koray Kavukcuoglu, SVP at Google DeepMind and Google's chief AI architect, and it arrives two weeks after Gemini 4 Argon. Pricing is unchanged: an introductory $2 per million input tokens and $10 per million output tokens, rising to $4 and $20 once that period ends, with cached input at 95 per cent off the input price.

Three numbers for three stages of defence

Carbon's case is organised around the cybersecurity defence lifecycle, with a figure for each stage. It reaches 88.2 per cent on SEC-bench Pro for finding real vulnerabilities in software, 54.8 per cent on ExploitGym for establishing whether a flaw can actually be exploited, and 71.0 per cent on Collinear's CWE-bench for patching at the root cause.

These are external benchmarks rather than Google's own, which matters. They also come with a condition stated plainly in Google's post: they were evaluated without guardrails. That is not a footnote. The scores describe what the model does with its safety restrictions off, while the defenders in the first cohort will run it with restrictions on, and Google has not published the size of the gap. The announcement therefore establishes a ceiling, not a delivered capability.

Which claims are Google measuring Google

The rest of the security case is internal and reads differently once that is clear. Google reports more than a twofold uplift over Argon in generating secure code on internal benchmarks. It says its Chrome team found Carbon performed more than ten times better than another lab's large frontier model at producing high-quality patches, without naming the rival or the test. And it cites Wiz, which the post describes as "our leading Cloud security platform", observing Carbon leading on web penetration testing benchmarks. That last data point comes from inside the company.

On behaviour the claims are more interesting than the leaderboard. Google says successful cheating on Terminal-Bench 4.0 fell to 0.0 per cent with cheat attempts down to 0.4 per cent, that high-severity misalignment alerts in live coding with its own teams dropped by almost 80 per cent, and that unsupported claims fell roughly twofold against Argon. It reports reducing overreach by 26 per cent and under-service by 29 per cent.

The figure that will draw the most attention is prompt injection. Argon led Gray Swan's indirect prompt injection benchmark with a 0.7 per cent attack success rate; Carbon is reported at 0.0 per cent, resisting every attack evaluated. The correct way to read that is literally. It is every attack in one fixed evaluation set, and a model that scores zero on a fixed set has not been shown to be resistant to attacks outside it.

Why defenders go first

A model that sets a state of the art at finding vulnerabilities and then at proving them exploitable is dual-use by construction, and Google has staged the release around that fact. It says it is actively engaged in the United States government's voluntary process for pre-release model testing, and that it is gathering feedback and iterating on guardrails before a wider launch. Announcing now, before most people can touch it, also books the leaderboard position ahead of the next round of releases from its competitors.

My reading is that the staging is genuine and the timing is commercial, and both can be true at once. The capability being described is close to the capability that turned PHP2Shell into an emergency: a researcher at Perplexity got a working shell against a honeypot on 24 October 2026, and CISA reversed its position two days later, as Parallax Nexus reported. Shipping an 88.2 per cent vulnerability finder to everyone the same week would have been a strange decision.

The open-weight answer arrived a day later

Mistral released the weights for Mistral Large 4 on 29 October 2026, a trillion-parameter open model also pitched at cybersecurity, which TechCrunch reported alongside chief executive Arthur Mensch's framing that AI should "be a tool for empowerment, not dominance". The contrast with Carbon compresses the whole open-weights argument into two days. Mistral's security model can be downloaded and run by anyone, including people who are not defenders. Google's can be run by almost nobody at all. Neither company has shown which arrangement leaves the internet safer.

There is one more number worth holding onto, and it is not Google's. On FrontierSWE 2, a software engineering test, GPT-6 Astra still leads at 65.5 per cent against Carbon's 61.2 per cent. Top of a composite index is not top of everything.

What is not known is the figure that decides whether Carbon matters to anyone outside the first cohort: how much of that 88.2 per cent survives contact with the guardrails. Google has published the ceiling and withheld the floor, and the defenders it has let in are currently the only people in a position to see the difference.