Gemini 4 Carbon Tops the Leaderboard. Google Won't Let You Use It.

The number is 59. On Wednesday Google put Gemini 4 Carbon at the top of Artificial Analysis's Intelligence Index v5 with 59 points, one ahead of Claude Opus 5.5 and two ahead of GPT-6 Astra. Its own predecessor, Gemini 4 Argon, scored 50 two weeks ago and is already on general sale.

You cannot use Carbon. There is no API key, no Gemini app toggle, no Vertex endpoint. It goes this week to "a subset of cyber defenders", then in phases to more partners through Google DeepMind's Fairwind Program, and only then to developers, businesses and consumers "as soon as possible." Google has not said when.

That ordering is the story. A model that tops a public leaderboard is normally the one a lab sells fastest. Carbon is best at exactly what you would not hand to strangers.

The gate, in detail

Fairwind is not a waitlist. It works with more than 650 partners, runs background checks, requires phishing-resistant multi-factor authentication, restricts use to internal security, incident-response or penetration-testing teams, and forbids resale. Priority goes to governments and national cyber authorities, and to critical infrastructure in health, telecoms, energy and finance. Google also says it is taking part in the US government's voluntary pre-release testing process.

The precedent suggests a short gate: Argon reached Fairwind partners on 30 September and the paid API and consumer subscriptions on 13 October, thirteen days. If Carbon follows, "as soon as possible" means early-to-mid November.

What Carbon is actually good at

Google's own table gives it 88.2% on SEC-bench Pro for finding vulnerabilities, 54.8% on ExploitGym for exploiting them, and 71.0% on CWE-bench for patching them. Google says internal tests show double Argon's success at generating secure code, and that its Chrome team measured Carbon writing patches "more than 10X better than another lab's large frontier model" - a lab it does not name.

It does not have to. On 27 October, Anthropic's Frontier Red Team published five working exploit chains built by an unreleased internal model: a Chrome chain of four separate bugs that ran code outside the browser sandbox from a single page load - 62 CVEs assigned, all critical or high, 13 of them sandbox escapes, patched as of Chrome 156 - and a Safari chain that disabled the same-origin policy without executing code, fixed in iOS 26.5.2 and credited to two Anthropic researchers "with Claude."

The competitive claim and the competitive proof landed in the same week, in the same domain. Labs have argued for two years about knowledge benchmarks; the argument has moved to who can find and fix memory-safety bugs in other people's software.

It is not apples to apples, either. Ten times better at writing a patch is not ten times better at finding or exploiting a vulnerability, and the patch benchmark is Google's own.

The numbers you can check

Artificial Analysis runs its index independently, and the full result is more mixed than one rank implies. Carbon leads four of nine evaluations and wins on cost: $7.76 per index task against $10.04 for Opus 5.5, on 123,000 output tokens against 173,000.

It does not lead on coding agents - 59 on the Coding Agent Index against 62 for Opus 5.5, and 51% to 56% behind on FrontierCode v1.1. Google's historic weakness was exactly here, so second is a gain; it is not first.

One clean trade-off sits in the data: Carbon's accuracy on AA-Omniscience rose 10 points to 58%, and its hallucination rate rose from 4% for Argon to 11%. Still the second lowest measured, but not free.

The money question

Pricing is $2 and $10 per million tokens, cached input 95% off, doubling to $4 and $20 when the introductory period ends. Google has not said when.

So the model that tops the index currently earns nothing at list price from anyone who would pay it. Fairwind's members - national cyber authorities, hospital groups, grid operators - are the customers least likely to be charged full freight and least likely to buy consumer seats. Google is buying a safety story with weeks of commercial time - given Argon's thirteen-day gate, a cheap bet rather than a strategy.

What is still unconfirmed

• A general availability date. None exists; Argon's precedent is an inference, not a promise.
• Independent verification of the security numbers. SEC-bench Pro, ExploitGym and CWE-bench were not run by a third party, and the model cannot be tested outside Fairwind, so "firm lead" is not falsifiable today.
• Which lab the Chrome comparison refers to. Google says "another lab's large frontier model" and stops.
• Whether the released model behaves like the scored one. Google says it is still iterating guardrails, its stated reason for the gate.
• A Carbon-specific safety report. The announcement links the Gemini 4 report published with Argon; we found no separate Carbon document.

Two things would settle most of it: Carbon on the public API, and a third party allowed to rerun the cyber benchmarks. This post will be updated when Google opens access, or when someone independent publishes a number that is not Google's.