A Top Model Two Weeks Later: Google Holds Gemini 4 Carbon Back From the Market Over Safety Concerns
Google launched its newest frontier model, Gemini 4 Carbon, on October 28, 2026, just two weeks after its predecessor Argon. Independent evaluations place Carbon in first place on Artificial Analysis's composite index — but the model has a substantially higher hallucination rate than Argon, loses to Claude Opus 5.5 on agentic coding, and is for now reserved for a curated group of cybersecurity experts through Google's "Fairwind Program."
The launch: two weeks after Argon
Google announced Gemini 4 Carbon on October 28, 2026, in a blog post written by Koray Kavukcuoglu, SVP at Google DeepMind and Google's chief AI architect. The company describes Carbon as its strongest model to date, with cybersecurity and long-running, multi-day tasks as its biggest areas of strength (Mashable).
The pace is remarkable in itself: Argon reached the Gemini app on October 13, Anthropic's Opus 5.5 arrived on September 22, and OpenAI's GPT-6 Astra arrived in September. With Carbon, frontier-model releases have in practice moved to a two-week cadence between Google's own flagship models.
The market reaction was positive but modest: Alphabet stock (GOOG/GOOGL) rose about 1.5 percent in early afternoon trading on Wednesday, October 28, according to Seeking Alpha.
What the independent assessment says
The most tangible news is that Carbon, according to the independent evaluation firm Artificial Analysis, retakes first place on Intelligence Index v5.0 — a recently updated and harder version of the index. Carbon, with high reasoning mode enabled, scores 59 points. That places the model ahead of Claude Opus 5.5 at 58, GPT-6 Astra at 57, and Argon at just 50 points (VentureBeat).
But the same evaluations reveal real tradeoffs. According to The Decoder, citing Artificial Analysis:
- Accuracy up from 48 to 58 percent compared with Argon.
- Hallucination rate up from 4 to 11 percent — nearly tripled, but still the second-lowest in the ranking. VentureBeat describes the same pattern: Carbon has a higher hallucination rate than Argon on a factual knowledge test.
- Agentic coding: Carbon scores 59 against Opus 5.5's 62. VentureBeat adds that Carbon trails several competitors on professional tasks, even though the model improves substantially over Argon in both coding and knowledge work.
The picture, then, is not "best model at everything" but "best model on the composite index, with documented weaknesses in sub-areas." That is a difference readers should keep in mind when the company itself talks about a lead.
Google's own claims — separated from the independent numbers
Several of the strongest figures in the announcement come from Google itself and have not been independently verified. That applies first and foremost to the cybersecurity results: Google claims the model has a "firm lead" with 88.2 percent on SEC-bench Pro (vulnerability discovery), 54.8 percent on ExploitGym (exploitation), and 71 percent on CWE-bench (patching bugs) (Anadolu Agency via The Express Tribune). Google also says internal testing shows Carbon halves the number of unsupported claims compared with Argon — that is, claims the model cannot substantiate.
The same applies to Google's long-horizon agent tasks: "Internally, our teams have seen Carbon run for days," the company writes in the announcement, referring to the model working through failed approaches while diagnosing errors and updating large codebases (VentureBeat). This is internal reporting, not independent testing.
In Google's own comparison table against Argon, GPT-6 Astra, Claude Opus 5.5, and Claude Fable 5.1, Carbon topped 15 of 17 benchmarks; GPT-6 Astra leads FrontierSWE 2 and Opus 5.5 leads OSWorld-2.1 (Mashable). Note that The Decoder puts the figure at 15 of 16 tests — the benchmark count is thus reported inconsistently across coverage outlets, and we leave it open.
One methodological change is worth noting: Google now reports Terminal-Bench 4.0 results run by Artificial Analysis, not its own numbers — a departure from the Argon launch. Carbon improved there by roughly eight points over Argon and passed Opus 5.5. It is a small but concrete sign that the company is adapting to the demands of independent evaluation.
Finally, prompt injection: according to Google, Carbon reduced the attack success rate on Gray Swan's benchmark for indirect prompt injection from 0.7 percent with Argon to 0.0 percent — blocking every tested manipulation attempt (The Decoder). The Decoder points out, however, that the benchmark appears to be saturated — that is, it no longer differentiates well between top models. The figure therefore impresses more than it informs.
Access: the Fairwind Program and US pre-testing
Perhaps the most significant limitation in the launch is who actually gets to use the model. For now, Google is granting access only to selected cybersecurity defenders through its curated "Fairwind Program." Most developers and businesses will have to wait for a broader launch, which for now has no date (VentureBeat).
The rationale is the model's cybersecurity capabilities: because of its advanced security skills, Carbon is going through the US government's voluntary pre-testing process and will initially be available only to selected security experts (The Decoder).
This carries significant signal value. A frontier model that is explicitly marketed on its ability to find, exploit, and patch vulnerabilities — SEC-bench Pro, ExploitGym, CWE-bench — has obvious uses on both sides of the attack/defense line. Google and the US government are thus treating these as capabilities that warrant restricted deployment, at least in the initial phase. The available source material does not make clear exactly how long the restriction will last, or what criteria the Fairwind Program uses for selection.
Pricing: two outlets, two versions
Here the sources diverge, and we cannot resolve it from the available evidence.
VentureBeat reports that Carbon is launching with introductory prices of $2 per million input tokens and $10 per million output tokens, with a 95 percent discount on cached inputs. But according to a footnote in Google's material, these prices are temporary: the subsequent prices are $4 and $20. Google has not said when the introductory period ends (VentureBeat).
The Decoder, on the other hand, writes that pricing "remains the same as for Argon" (The Decoder). The two accounts could conceivably be reconciled — if Argon had the same introductory structure — but that is not stated in the available source material, and we choose not to speculate.
For enterprise customers considering building on Carbon, the consequence is concrete: the starting price could double, and nobody knows when.
What Google doesn't say
The absences tell a story too. According to VentureBeat, Google has not released a technical report for Carbon, has not disclosed whether the model uses a new architecture, and has not given a parameter count. There is no API specification either.
The latter has practical significance: without an API spec, we do not know whether Argon's documented context limits and modalities carry over to Carbon. Developers cannot plan integrations on the basis of official specifications — only on the basis of benchmark figures.
Omitting a technical report is not unknown among frontier-model publishers, but the combination of (1) a top placement on an independent index, (2) no documentation of how the model is built, and (3) no date for broad access means that Carbon is for now more a result than a product.
What it means — and what remains
Three patterns are worth drawing out:
The release pace is accelerating. Two weeks between Argon and Carbon, with Opus 5.5 and GPT-6 Astra in between, means that independent evaluations like Intelligence Index v5.0 effectively become the fixed reference point. The index was recently updated to v5.0, described as having harder benchmarks, ahead of this launch.
The security-restricted rollout is new as a pattern. Holding a model back from broad access because of cybersecurity capabilities, with voluntary pre-testing by the government and a curated defenders program as the only access channel, is a more cautious launch than the industry has been used to. Whether this becomes a template for future models with sharp capabilities, or a one-off, remains to be seen.
The lead is narrow, not universal. Carbon's 59 points on Intelligence Index v5.0 make it the strongest general model according to Artificial Analysis. But it hallucinates more than Argon, loses to Opus 5.5 on agentic coding and several professional tasks, and the cybersecurity results at the core of the marketing are, for now, only the company's own numbers.
The concrete things to watch going forward: a technical report, a date for broad availability, clarification of the pricing structure, and more independent evaluations as additional benchmarks come online. For now, Google's strongest claims about Carbon remain unverified, while the weakest numbers in the picture — the 11 percent hallucination rate — come from Artificial Analysis's independent evaluations.