A New Generation Every Two Weeks, 59 Points on Top, Yet Only for Cyber Defenders: Dissecting Gemini 4 Carbon's World's Best Through Three Framings and Four Ledgers

A New Generation Every Two Weeks, 59 Points on Top, Yet Only for Cyber Defenders: Dissecting Gemini 4 Carbon’s “World’s Best” Through Three Framings and Four Ledgers

Part One: Releasing a model 3 hours before the earnings call

On October 28, 2026, US time, Google DeepMind SVP and Chief AI Architect Koray Kavukcuoglu published “Gemini 4 Carbon: our next frontier model” on the official blog. It came roughly two weeks after the previous generation, Gemini 4 Argon, opened to developers.

The timing was delicate: the announcement landed about 3 hours before Alphabet’s Q3 earnings call. The result was a rare split screen — the model took the world’s top spot, while the earnings sent the stock down more than 10% after hours, wiping over $300 billion in market value.

Start with the model itself. Google positions Carbon as “the strongest model for cybersecurity and long-horizon tasks,” with three headline numbers:

• Artificial Analysis Intelligence Index v5.0: 59 points, #1 globally (Claude Opus 5.5 at 58, GPT-6 Astra at 57; the previous Argon at 50);
• Google’s official 14 core benchmarks: first on 12 (another framing: first on 15 of 17);
• Arena text leaderboard: 1528 points, #1 globally; Agent leaderboard: #2 globally.

Arena’s capability-evaluation lead Peter Gostev’s comment was widely quoted: “Carbon is so much stronger than Argon. I really wish they’d just skipped Argon and shipped this one.” Google CEO Sundar Pichai, meanwhile, wrote on X with something close to humblebragging: “I said before that we’d ship models periodically… now let me introduce Gemini 4 Carbon.”

But the most counterintuitive fact: this “world’s best” has no public API, no model ID, and launches only to a small vetted group of cyber defenders.

Part Two: Three framings, three kinds of “first”

“How many firsts did it take” is the part most easily fudged in coverage like this. Put the three framings side by side and the differences appear immediately:

# Three "first place" framings: count vs weight vs independence
def firsts_summary():
    return {
        "Google official 14 benchmarks": {"total": 14, "firsts": 12, "ratio": 12 / 14},
        "Google official 17 benchmarks": {"total": 17, "firsts": 15, "ratio": 15 / 17},
        "AA Intelligence Index v5.0 (9 tests)": {"total": 9, "firsts": 4, "ratio": 4 / 9},
    }

for name, d in firsts_summary().items():
    print(f"{name:40s} {d['firsts']}/{d['total']} = {d['ratio']:.0%}")

# Third-party leaderboard (Artificial Analysis independent methodology)
aa_index = {
    "Gemini 4 Carbon":   59,
    "Claude Opus 5.5":   58,
    "GPT-6 Astra":       57,
    "Gemini 4 Argon":    50,
}
print("\nAA Intelligence Index v5.0:")
for k, v in sorted(aa_index.items(), key=lambda x: -x[1]):
    print(f"  {k:20s} {v}")

The comparison makes one thing clear: both “12/14” and “15/17” are results on vendor-selected benchmark sets; “4/9” is the number of category wins inside a third-party independent index. None of the three numbers is false, but they mean entirely different things — the former is “nearly all correct on questions Google picked,” the latter is “first in 4 of 9 fixed third-party tests, and first on the weighted total.”

What’s genuinely worth reading is AA’s breakdown: Carbon takes 4 of 9 tests, excelling at complex reasoning, scientific research, knowledge QA, and automation tasks. The total-score win doesn’t come from across-the-board dominance but from “no obvious weak spot plus a few category blowouts.”

And “no obvious weak spot” is itself the most important progress here. Argon’s soft spot was coding and terminal tasks; Carbon patches precisely that.

Part Three: Long-horizon agents — what “running for days” actually means

Google repeatedly emphasizes one capability: Carbon can run continuously for days, re-find solutions after hitting dead ends, and ultimately locate and fix complex problems in large codebases. It supports a 1M-token context.

The technical weight of that sentence matters more than the scores. “Running for days” isn’t a model capability metric — it’s a system reliability metric, determined by per-step success rate, error recovery, context management, and most critically: the curve of success decaying with step count.

# Reliability decay model for long-horizon agents
def long_run_success(step_success_rate, n_steps, recovery_rate=0.0):
    """
    step_success_rate: per-step success rate
    n_steps: steps needed for the task
    recovery_rate: probability of self-recovery after failure (per step)
    """
    if recovery_rate == 0:
        return step_success_rate ** n_steps
    # With recovery: Markov approximation of steady-state success
    p, r = step_success_rate, recovery_rate
    p_eff = p + (1 - p) * r
    return p_eff ** n_steps

print("Steps -> end-to-end success rate")
for n in (10, 50, 100, 500, 1000, 5000):
    no_rec = long_run_success(0.95, n)
    with_rec = long_run_success(0.95, n, recovery_rate=0.6)
    print(f"  {n:5d} steps | no recovery {no_rec:7.2%} | with 60% recovery {with_rec:7.2%}")

This table exposes the real difficulty of “running for days”: with a 95% per-step success rate, a 1000-step task, and no error recovery, end-to-end success is around 0.5% — near-certain failure. Add 60% post-failure recovery and the same 1000 steps jump above 60%.

That’s why Google emphasizes “re-finding solutions after hitting dead ends” rather than “higher per-step accuracy.” The decisive factor in long-horizon agents isn’t “getting every step right” but “can it steer itself back after going wrong.” Which also explains why the GraphWalks number matters — tracking complex associations across 256k to 1M context at 96.2%, versus Opus 5.5 at 66.8% and GPT-6 Astra at 71.8%. The longer the context, the easier it is to “forget what you were doing”; 96.2% says Carbon’s long-horizon memory retention is a category apart.

Two supporting data points confirm it:

• Vending-Bench 2 (simulated long-cycle autonomous operation): Carbon finishes with an account balance of $16,484, roughly 1.8x Claude Opus 5.5’s $9,235;
• Terminal-Bench 4.0: 65.2%, versus Opus 5.5 at 59.6%, GPT-6 Astra at 59.1%, Argon at 57.1%; Terminal-Bench-Science 0.1: 64.8% (Opus 59.0%).

Getting 1.8x on a benchmark that simulates “long-term operation” says more about long-horizon decision quality than any single score — because every step in an operating simulation depends on prior state, with no chance to start over.

Part Four: The three gates of cybersecurity — from finding holes to fixing root causes

Carbon’s standout capability is cybersecurity, which Google breaks into three stages, each mapped to a benchmark:

   The three-stage cybersecurity chain (three benchmarks)
   ┌──────────────┐    ┌──────────────┐    ┌──────────────┐
   │  ① Find bug   │───>│  ② Verify     │───>│  ③ Fix root  │
   │               │    │     exploit   │    │     cause    │
   │ SEC-bench Pro │    │  ExploitGym   │    │  CWE-bench   │
   │    88.2%      │    │    54.8%      │    │    71.0%     │
   └──────────────┘    └──────────────┘    └──────────────┘
        ↑                     ↑                     ↑
   183 real high-       10-hour limit per      73 CWEs, real
   risk JS engine       red-team exploit      repo audit & fix
   vulnerabilities      verification

   Comparison:
   SEC-bench Pro : Carbon 88.2% | Astra 85.4% | Argon 83.4%
   ExploitGym    : Carbon 54.8% | Astra 42.4% | Opus 34.5% | Argon 42%
   CWE-bench     : Carbon 71.0% (Pass@4 81%) | Opus 67.0% | Argon 68.0%

A chained-success model makes the meaning of these three numbers more intuitive:

# Chained success across the three security gates: find -> verify -> patch
def exploit_chain(find_rate, verify_rate, patch_rate):
    """Full chain: discover -> exploitable -> root cause fixed"""
    end_to_end = find_rate * verify_rate * patch_rate
    return {"find": find_rate, "verify": verify_rate,
            "patch": patch_rate, "end_to_end": round(end_to_end, 4)}

models = {
    "Gemini 4 Carbon": (0.882, 0.548, 0.710),
    "GPT-6 Astra":     (0.854, 0.424, 0.65),   # patch partially undisclosed, approximated
    "Claude Opus 5.5": (0.82,  0.345, 0.670),  # find partially undisclosed, approximated
    "Gemini 4 Argon":  (0.834, 0.42,  0.680),
}
for name, (f, v, p) in models.items():
    r = exploit_chain(f, v, p)
    print(f"{name:18s} end-to-end {r['end_to_end']:.2%}  (find {r['find']:.1%} x verify {r['verify']:.1%} x patch {r['patch']:.1%})")

Under this model, Carbon’s full-chain end-to-end is about 34%, versus roughly 19% for Opus 5.5 and 24% for Argon. The end-to-end gap is far larger than any single-stage gap — a property of all chained capabilities: lead by 10% at each stage and you lead by 40%+ in the chain.

But a risk caveat is essential here: this capability is dual-use. A model that can automatically “find a vulnerability → generate exploit code → write a patch” is, with the last step removed, an automated zero-day weapons factory. That’s why Google adopted a nearly conservative release strategy: this week, only a small group of trusted cyber defenders (the Fairwind program list), then trusted partners, and only then developers, enterprises, and consumers — with no timeline given. Google also says it has submitted Carbon to the US government’s voluntary pre-release safety testing.

A product billed as “the world’s strongest cybersecurity model” constrained its own distribution over dual-use risk. That trade-off is more recordable than the scores.

Part Five: The “honest model” — anti-cheating, injection-resistant, but hallucination rose from 4% to 11%

Another feature Google pushed hard is behavioral reliability. This cluster is the most information-dense part of the launch:

The last row deserves its own note: in Gray Swan’s indirect prompt injection tests, Carbon’s attack success rate was 0.0%. For comparison: Argon 0.7%, Claude Opus 5.5 1%, GPT-6 Astra 8.5%. These attacks hide malicious instructions in web pages, emails, and external documents, triggering when an agent reads them — the most realistic attack surface for long-running agents. 0.0% means every attempt was blocked even with up to 15 tries.

The anti-cheating row is also interesting. Google claims Carbon’s cheating success rate on Terminal-Bench 4.0 fell to 0%, with an attempt rate of 0.4%. This targets a real problem: models gaming the test environment and taking shortcuts that don’t meet task requirements just to pass. Carbon closes that door.

The flip side is rising hallucination. Artificial Analysis’s AA-Omniscience shows: Carbon’s correctness rose from Argon’s 48% to 58%, but hallucination rose from 4% to 11%. The definition here is “among all non-perfect answers, the share that are fabricated” — i.e., when it doesn’t know, how often does it bluff instead of abstaining.

Read together, these two directions reveal an uncomfortable truth: “fewer unsupported claims” (Google internal testing) and “rising hallucination” (third-party testing) don’t contradict — they measure different things. The former is “say fewer unfounded things on known tasks”; the latter is “prefer giving an answer over abstaining beyond the knowledge boundary.” A more capable model is often a more willing answerer — the price of capability, not a bug you can simply patch.

One more field report is worth recording: multiple testers with early access said Carbon generates noticeably slower than Argon — 2x to 4x depending on the task. Google hasn’t confirmed the test build, but this aligns with the token-efficiency data: more thinking time, fewer output tokens.

Part Six: The cost ledger — token efficiency is the most practical advance here

For developers, Carbon’s most practical impact isn’t scores but cost per task.

# Cost-per-task model: unit price x token consumption
def cost_per_task(input_tokens, output_tokens, in_price, out_price,
                  cached_ratio=0.0, cached_discount=0.95):
    """
    prices in USD per million tokens
    cached_ratio: share of input hitting cache
    cached_discount: cache discount (0.95 = 95% off)
    """
    normal_in = input_tokens * (1 - cached_ratio)
    cached_in = input_tokens * cached_ratio
    in_cost = (normal_in * in_price + cached_in * in_price * (1 - cached_discount)) / 1e6
    out_cost = output_tokens * out_price / 1e6
    return round(in_cost + out_cost, 2)

# Output token consumption per Intelligence Index task (third-party breakdown)
print("Output tokens per Intelligence Index task:")
for name, out_k in [("Claude Opus 5.5", 173), ("Gemini 4 Carbon", 123)]:
    print(f"  {name:18s} {out_k}k output tokens")

# At standard pricing ($4/$20), input estimated at 10k
print("\nCost per task at standard pricing $4/$20:")
for name, out_k, price in [("Claude Opus 5.5", 173, (4, 20)),
                            ("Gemini 4 Carbon", 123, (4, 20)),
                            ("GPT-6 Astra", 90, (3, 15))]:
    c = cost_per_task(10_000, out_k * 1000, price[0], price[1], cached_ratio=0.5)
    print(f"  {name:18s} ${c}")

# Launch half-price ($2/$10)
print("\nCost per task at launch pricing $2/$10:")
for name, out_k in [("Gemini 4 Carbon", 123)]:
    c = cost_per_task(10_000, out_k * 1000, 2, 10, cached_ratio=0.5)
    print(f"  {name:18s} ${c}")

Key finding: Opus 5.5 is close in capability but its reasoning is extremely verbose, averaging 173k output tokens per Intelligence Index task; Carbon needs only 123k, a 29% reduction in output. Even after Carbon reverts to standard $4/$20 pricing, its average cost per task ($7.76) stays about 23% below Opus 5.5 ($10.04); GPT-6 Astra is cheaper still at $6.24, about 20% below Carbon.

In other words, on the capability/cost plane, Carbon isn’t the absolute optimum — Astra is cheaper, Opus is stronger on pure software engineering — but it’s the most balanced value in the top tier.

Pricing strategy matters too: Carbon carries over Argon’s introductory pricing — $2 per million input tokens, $10 output, 95% off cached input (as low as about $0.10–0.20); after the promo it reverts to standard ($4 in / $20 out). Per the official Gemini API pricing page, Argon’s promo runs through November 30, 2026, rising to $4/$20 on December 1.

“Low entry price, doubled at expiry” is a play Google has now used for two consecutive generations. The practical implication for developers: capacity planning must use post-December-1 pricing, not the half-price number. An easily missed trap.

Part Seven: The other ledger — the mismatch between the best model and the most expensive infrastructure

Three hours after Carbon’s launch, Alphabet’s Q3 results landed. These numbers are the real pressure behind “world’s best”:

• Revenue $127.58B, +25% YoY, below the $128.22B consensus;
• Net income $26.17B, down about 25% YoY (from $34.98B), including $8.66B in equity investment losses, mainly tied to its SpaceX stake;
• Free cash flow -$9.065B, the second consecutive negative quarter;
• Capex $51.36B, +114% YoY; full-year capex guidance held at $195–205B, with the CFO saying 2027 capex will “increase substantially”;
• Long-term debt climbed from $21.6B a year ago to $125.1B, up about 479%;
• The one bright spot is cloud: revenue $30.71B, +103% YoY, operating profit $11.1B;
• Search and related revenue $63.35B, +12% YoY, decelerating sharply from 17% last quarter and below expectations.

# Alphabet Q3: the revenue-vs-investment scissors gap
def scissors_gap(revenue_yoy=0.25, capex_yoy=1.14, fcf_b=-9.065,
                 debt_now_b=125.1, debt_prev_b=21.6):
    return {
        "revenue growth": f"{revenue_yoy:.0%}",
        "capex growth": f"{capex_yoy:.0%}",
        "gap (capex - revenue)": f"{(capex_yoy - revenue_yoy) * 100:.0f} pct pts",
        "free cash flow": f"${fcf_b:.2f}B",
        "long-term debt growth": f"{(debt_now_b / debt_prev_b - 1):.0%}",
    }

for k, v in scissors_gap().items():
    print(f"  {k:26s} {v}")

The message is blunt: revenue growth 25%, capex growth 114%, an 89-percentage-point gap. That gap can only be filled by two things — cloud cash flow (and +103% growth is indeed filling it) and debt (+479%). With free cash flow negative two quarters running, it isn’t filled enough.

So “Carbon takes #1” and “the stock drops 10%” aren’t contradictory — they’re two sides of the same thing: better models need more compute, more compute needs more capex, more capex needs more financing, and financing is getting more expensive. What the market worries about is whether that chain closes, not whether Carbon’s score is high enough.

Which is why a “world’s best” that isn’t publicly available earns applause but not a Wall Street bid. The deeper question: at a moment when AI efficiency hasn’t visibly improved, does the market really need this many “best models”?

Part Eight: Judgment and boundaries

First, Carbon is a “patch the weak spots” success, not a redefinition. It offers no new paradigm; it fills Argon’s gaps in coding, terminal work, and long-horizon tasks, and creates a category lead in cybersecurity. That’s an engineering win, not a scientific breakthrough. But for Google it’s enough — what it needed was the fact of “back on top,” not a new story.

Second, iterating every 14 days shows Google’s parallel training pipeline actually works. Per earlier internal leaks, Google trained and evaluated multiple Gemini 4 checkpoints in parallel — Argon, Barium, Carbon (publicly released Argon was internally the Barium-B checkpoint). Pichai’s framing: “Our researchers are working hand in hand with our models, advancing capability faster while reinforcing safety guardrails in parallel.” In plain terms: using the strongest AI to help train, evaluate, and optimize the next generation of AI — that loop is now running inside Google. This is the engineering version of the RSI narrative — not models rewriting their own code, but models compressing the cycle of “training the next model.”

Third, staged release is the new normal and the most overlooked risk. Carbon has no API, no model ID, and goes only to a few cyber defenders. Which means: the #1 on the leaderboard and the model you can use are two different things. What developers can do now is build on Argon (it’s live, model ID gemini-4-argon), abstract the model name into a config, and change one line when Carbon opens. That sounds mundane but is far more useful than chasing leaderboards.

Fourth, the shelf life of “first place” is shrinking. This return to the top comes about half a year after Google last led AA’s index (April 2026, Gemini 3.1 Pro tied with GPT-5.4 and Claude Opus 4.7), while Argon’s lead lasted two weeks. When all three frontier labs compress release cycles to months or even weeks, the strategic value of any single #1 decays fast — the real moat is ecosystem, cost, reliability, and distribution, not leaderboards.

Fifth, and most important: what should be remembered from this launch isn’t 59 points, but the behavioral reliability cluster. Rising hallucination and slower generation are the price of capability; a 0% cheat rate, 0% injection success, -26% overreach, and -80% misalignment alerts are the precondition for “can this be trusted to work autonomously.” In the agent era, a smarter but less obedient model may be worth less than a slightly duller but absolutely reliable one. Google putting reliability metrics on par with benchmark scores deserves credit — even though its hallucination number doesn’t look good.

A trackable framework: don’t judge Carbon’s impact by 59 points; watch four numbers — ① when ordinary developers actually get the API (the only variable that truly determines influence); ② whether the cost-per-task gap versus Astra widens after the December 1 price increase; ③ whether the two weak spots, FrontierSWE 2 and OSWorld 2.1, get fixed next generation (Astra leads at 65.5%, Opus at 87.2%); ④ whether the 11% hallucination rate gets amplified into incidents in real production. Those four numbers say more than any “12 of 14 firsts” table.

Sources: Google DeepMind official blog “Gemini 4 Carbon: our next frontier model” (Koray Kavukcuoglu, 2026-10-28); Artificial Analysis Intelligence Index v5.0, Coding Agent Index, and AA-Omniscience evaluations; Arena text and Agent leaderboards; Gemini Developer API official pricing page (Argon promo valid through 2026-11-30); Alphabet Q3 2026 earnings and call (relayed by 36Kr, TMTPost, EET-China, Huanqiu, QbitAI, Wall Street CN). Benchmark scores, cost calculations, long-horizon reliability modeling, and chained security success rates are inferences and illustrative models based on public data, not official figures; Carbon has no public API yet and some comparison models’ sub-scores are not fully disclosed, with approximations noted in code comments.

• ←Previous
• Next→