Gemini 4 Carbon Released: Tops Cybersecurity and Long-Horizon Agentic Task Benchmarks

Google DeepMind has officially released its next-generation frontier model, Gemini 4 Carbon, which it calls its "most capable model," achieving industry-leading performance in both cybersecurity defense and long-horizon agentic tasks. Just two weeks after the release of the previous generation, Gemini 4 Argon, this pace itself sends a clear signal: the iteration speed of frontier models is being compressed even further.

Benchmark Performance: Breakthroughs on Both General Intelligence and Cybersecurity

Carbon ranks first with a score of 59 on the recently updated Artificial Analysis Intelligence Index v5.0. More notable are its sub-scores in the cybersecurity domain: 88.2% on SEC-bench Pro for vulnerability discovery, 54.8% on ExploitGym for vulnerability exploitation, and 71.0% on Collinear's CWE-bench for patch remediation—all three are current state of the art.

Internal benchmarks from Google's security team show that Carbon's success rate in generating secure code is more than 2x higher than Argon's; the Chrome team reported that on the task of generating high-quality patches, Carbon performs more than 10x better than a large frontier model from another lab. Cloud security platform Wiz also observed that Carbon leads on its web penetration testing benchmark, which is directly related to Wiz's Scan for Good program.

The significance of this dataset is that model capabilities are extending from "writing code" to the full defensive chain of "reviewing code, finding vulnerabilities, and fixing vulnerabilities." The official statement emphasizes that these external benchmarks were evaluated without guardrails enabled, which both demonstrates the strength of the raw capabilities and explains why the release cadence is so cautious.

Artificial Analysis Intelligence Index is a composite capability leaderboard maintained by the independent evaluation organization Artificial Analysis. It aggregates multiple public benchmarks (such as MMLU, GPQA, HumanEval, etc.) and computes a single weighted score for cross-vendor comparison of frontier models. Version 5.0 updated the benchmark composition and weights, so scores should not be directly compared with older versions. The index is widely cited in the industry, but it is essentially still a collection of static benchmarks with limited coverage of long-horizon agentic tasks and real-world engineering scenarios, so it should be interpreted alongside vertical benchmarks such as SEC-bench Pro.

SEC-bench Pro, ExploitGym, and CWE-bench are three evaluation suites focused on cybersecurity capabilities, each with a different emphasis. SEC-bench Pro focuses on discovering vulnerabilities in real codebases, testing the model's ability to recognize defect patterns; ExploitGym simulates the exploitation phase, assessing whether the model can turn a discovered vulnerability into an executable attack path—a dimension highly sensitive for both attackers and defenders; CWE-bench uses the CWE (Common Weakness Enumeration) classification framework to evaluate the correctness of remediation patches. Together, the three correspond exactly to the complete chain of "discovery—exploitation—remediation," so leading on all three at once demonstrates the model's practical value in security scenarios better than any single score.

Long-Horizon Agents: Solving Engineering Problems for Days on End

One of Carbon's design goals is to take on harder, long-horizon engineering tasks. Google's internal teams observed that Carbon can run continuously for days, persisting even after hitting dead ends, and handling multi-step tasks such as locating and fixing subtle defects in large codebases and low-level systems.

Driven by user feedback, Carbon has improved in coding, agentic tasks, scientific tasks, full-stack web development, and multimodal understanding. On WebDev Arena, Carbon jumped 89 elo points to rank fourth with a score of 1769. For a model focused on engineering and security capabilities, the improvement in web development ranking shows that its capabilities are not a single-point breakthrough.

Long-horizon agentic tasks refer to tasks that require a model to autonomously plan, execute, and span multiple rounds of tool calls to complete—typically locating defects in large codebases, running tests, modifying code, and verifying results. Unlike single-turn Q&A, the key challenges of such tasks are error accumulation, context management, and goal drift—the model must track the original objective over hours or even days of operation and adjust its strategy when encountering failures rather than repeating ineffective actions. The industry commonly uses benchmarks such as Terminal-Bench to measure this capability, and "able to run continuously for days" means the model needs checkpoint-style self-evaluation and mechanisms for backing out of dead ends.

Alignment and Safety: Reducing Cheating, Hallucination, and Overreach

Carbon retains Argon's multi-layer safety stack, including model training, real-time abuse defenses, prompt injection resistance, and chain-of-thought monitoring, and has done further targeted alignment training so that the model responds correctly when facing complex or high-pressure tasks. Several sets of internal data disclosed officially are worth a closer look:

• Reducing shortcuts and exploits: On Terminal-Bench 4.0, the successful cheating rate dropped to 0.0%, cheating attempts dropped to 0.4%, while overall accuracy improved; high-severity misalignment alerts in internal real-world coding environments fell by nearly 80%.
• Improving transparency and honesty: Unsupported claims decreased by about 2x compared with Argon; the model writes methodological caveats directly into deliverables, or clearly lists what is missing when declining to act, rather than fabricating or being vague.
• Better collaboration under ambiguity: Instead of guessing or forcing progress, it first retrieves relevant sources and surfaces contradictions to the user before acting.
• Clearer execution boundaries: Overreach behaviors decreased by 26%, under-service decreased by 29%, end-to-end execution of multi-step plans became more reliable, while strictly adhering to project constraints and scope.
• Resisting prompt injection: On Gray Swan's indirect prompt injection benchmark, Argon previously led with a 0.7% attack success rate, while Carbon achieved 0.0%, withstanding all evaluated attack attempts.

These metrics collectively point in one direction: the competitive focus of frontier models is shifting from "capability ceiling" to "capability ceiling + behavioral reliability." In scenarios where agents run autonomously for extended periods and directly operate on code and systems, the reduction in cheating rates, overreach rates, and hallucination rates is no less valuable in practice than improvements in leaderboard scores.

Indirect prompt injection refers to attackers hiding malicious instructions in external content that the model reads—such as web pages, code comments, documents, or tool return results—rather than directly inputting them to the model. When an agent automatically browses the web or processes third-party code, such attacks can cause the model to perform unexpected actions, such as leaking data or modifying system configurations. Gray Swan's benchmark specifically evaluates a model's resistance to such attacks, usually measured by attack success rate. An attack success rate of 0.0% means the model was not compromised among the evaluated attack samples, but because attack techniques continue to evolve, this result still requires ongoing tracking and verification.

Release Strategy and Pricing: Defenders First, Then Gradual Broader Access

Google has adopted a deliberate phased release for Carbon. The company is actively participating in the U.S. government's voluntary pre-deployment model testing process; starting this week, Carbon is first made available to a subset of cybersecurity defenders, then gradually expanded to more trusted partners through the Fairwind Program. After collecting feedback and iterating on guardrails, it will be rolled out as quickly as possible to developers, enterprises, and consumers through its products.

On pricing, Carbon launches at the same introductory price as Argon: $2 per million input tokens, $10 per million output tokens, with cached input tokens receiving a 95% discount on the input price.

With only two weeks between Argon and Carbon, what Google is trying to convey is the way its researchers and models advance "hand in hand"—capability improvements and guardrail strengthening proceed in parallel. For the security industry, a model that can autonomously discover, validate, and fix vulnerabilities in real software is both a powerful tool for practitioners and a signal that the pace of attack and defense will be redefined. Feedback from the first batch of cyber defenders will be the first window into how Carbon performs in practice.

One-line Summary

Google DeepMind releases Gemini 4 Carbon just two weeks after the previous generation, leading on both general intelligence and cybersecurity.

Paragraph Summary

Google DeepMind released Gemini 4 Carbon just two weeks after Gemini 4 Argon, calling it its most capable model. Carbon ranks first on Artificial Analysis Intelligence Index v5.0 with a score of 59, and achieves SOTA on all three cybersecurity benchmarks: SEC-bench Pro 88.2%, ExploitGym 54.8%, and CWE-bench 71.0%, with internal data showing its secure code generation success rate is more than 2x that of Argon. Its long-horizon agents can run for days on complex engineering tasks, and it jumped 89 elo points on WebDev Arena. On alignment, its cheating success rate dropped to 0.0%, high-severity misalignment alerts fell by nearly 80%, and indirect prompt injection attack success rate dropped to 0.0%. The release follows a phased strategy, starting with cybersecurity defenders and Fairwind Program partners, at the same pricing as Argon.