Gemini 4 Carbon Tops the Frontier at 59 and Finds 88.2% of Real Bugs — You Still Can't Buy It

Two weeks after shipping one frontier model, Google shipped another. Gemini 4 Carbon was announced on 28 October 2026 and it went straight to number one on the Artificial Analysis Intelligence Index v5.0 with a score of 59 — one point ahead of Claude Opus 5.5 at 58, and above the same model at higher effort at 57.

One point is a rounding argument, not a coronation. The number that actually matters in the announcement is 88.2%, and it is not about chat quality at all.

What actually happened

Koray Kavukcuoglu, SVP at Google DeepMind, framed Carbon as "our strongest model with state-of-the-art cybersecurity and long horizon capabilities". It builds directly on Gemini 4 Argon, which arrived about two weeks earlier — an unusually short gap between two labelled frontier releases, and a sign that Google is now iterating the top of its line rather than the middle of it.

The three external results Google published are all on security work:

• SEC-bench Pro: 88.2% — autonomously finding real vulnerabilities buried in production software.
• ExploitGym: 54.8% — proving a vulnerability is actually exploitable, which is what decides whether a bug gets fixed this week or next quarter.
• CWE-bench: 71.0% — turning a confirmed finding into a working patch at the root cause.

Everything else in the post is either a web-development metric or an internal one. Carbon gained 89 Elo points to reach 4th place at 1768 on WebDev Arena, and Google reports that its own Chrome team saw Carbon generate "more than 10X better" high-quality patches than "another lab's large frontier model" — the other lab is not named, so treat that comparison as a claim, not a measurement. Internally Google also claims a >2x uplift in secure-code generation over Argon, and says Wiz observes Carbon leading its web penetration-testing benchmarks.

Then there is the part that matters for anyone running agents: on Gray Swan's Indirect Prompt Injection benchmark, Google reports Carbon at a 0.0% attack success rate, down from Argon's already-low 0.7%. In live coding environments with internal teams, high-severity misalignment alerts fell by almost 80%, unsupported claims roughly halved against Argon, overreach dropped 26% and under-service 29%, and successful cheating on Terminal-Bench 4.0 went to 0.0%.

Read the 88.2% twice

Google states plainly that the security benchmarks were "evaluated without guardrails" — the model with its safety layer switched off, because the point is to measure raw capability for defenders. That is the right way to run a capability test and the wrong number to put in a procurement slide without the footnote.

There is a second wrinkle. The public SEC-bench Pro leaderboard is a 344-instance aggregate across V8, Firefox and Linux, and as of writing its top entry is GPT-5.5 (xhigh) Codex at 58.4%. Carbon is not on that board; the benchmark's own page notes that newer results for some models are unavailable "due to safeguard restrictions". So 88.2% is Google's own run, not an entry you can cross-check on the public table today. That does not make it wrong — it makes it unverified by a third party, which is what you should say internally when someone forwards the chart.

Access is where the story becomes concrete. Carbon is not available to developers, businesses or consumers yet. From this week it goes to "a subset of cyber defenders", then gradually to trusted partners through the Fairwind Program — the scheme that gives vetted governments, healthcare providers and telecom operators early access, and which currently lists Gemini 4 Argon and the CodeMender patching agent. Fairwind's terms are worth reading before you apply: phishing-resistant MFA, access limited to cybersecurity, incident-response and penetration-testing teams, background checks on the organisation, and no redistribution. Everyone else gets "as soon as possible", which is not a date.

Pricing, when it does open up: the same introductory rate Argon launched at — $2 per million input tokens and $10 per million output tokens, with cached input at 95% off the input price. Google's own footnote says the price becomes $4 and $20 per million after the introductory period. That doubling is in the fine print, not the headline.

Why this matters for Indian SMBs and mid-market teams

The cost of finding a bug is collapsing; the cost of reviewing a fix is not. Run the arithmetic on a triage pass: 200,000 input tokens of source code and scanner output plus 20,000 output tokens of analysis comes to $0.60 on introductory pricing. Even at 500,000 input tokens it is a dollar. For an Indian mid-market firm that has never paid for continuous vulnerability discovery — because the alternative was an annual pen-test engagement and a quarterly calendar — the model call is no longer the expensive part. Your engineer's afternoon is.

That shifts the bottleneck to procedure, and most Indian teams are not ready for it. A model that returns 40 real findings and 60 plausible-looking ones is worse than useless without a triage owner, a severity rubric and a patching window. The organisations that benefit first are the ones that already have a change-management habit: a ticket, a reviewer, a regression test, a rollback. If your security process is "the vendor checks it once a year", adding a frontier model to the stack just produces a longer list nobody owns.

Access is gated, and the gate is a form. If you are a hospital chain, an insurer, a state utility or a payments company, the honest answer is that Fairwind is the route in, and it goes through a Google Cloud account team with due diligence attached. Most Indian SMBs are not eligible today and should plan around that: use what is generally available, build the patching workflow now, and treat Carbon-class models as a 2027 capability you will be ready for.

For anyone already running agents, the 0.0% prompt-injection figure is the one to file. Agent stacks in Indian offices increasingly read email, PDFs, WhatsApp messages and web pages — all attacker-controlled text. A model that resists every evaluated indirect injection on a public benchmark is a genuine improvement in the layer under your tool permissions. It is also a benchmark, not a guarantee: keep the tool allowlist, keep the human approval on money movement, and do not let a leaderboard score replace either.

One thing Google has not published is any data-residency, DPA or India-region detail for Carbon. Until that exists, a regulated Indian entity cannot put it near customer data regardless of what the benchmarks say.

Where Guruji Corporation fits in

We do not train models and we will not pretend a launch blog is a security audit. What we build is the layer that decides whether a new capability survives contact with an Indian organisation: vulnerability triage and patch-approval workflows with a named owner and an audit trail, agent stacks with tool allowlists and logged approvals, and short measured evaluations of a model against your codebase rather than a vendor's leaderboard.

If the real question is "we have 300 unpatched findings and no process to work through them, what does a defensible triage workflow look like here", that is a two-week piece of work with a written handover. Start with a short project brief.

Sources

• Google — Gemini 4 Carbon: our next frontier model (28 October 2026)
• Artificial Analysis — Intelligence Index v5.0
• Google — Gemini 4 Argon: Built to solve your hardest problems (13 October 2026)
• Google DeepMind — Fairwind Program
• SEC-bench Pro — long-horizon software security benchmark leaderboard
• ExploitGym benchmark (sunblaze-ucb)
• Collinear — CWE-bench leaderboard
• Google DeepMind on X — Gemini 4 Carbon announcement thread (28 October 2026)