Google Releases Gemini 4 Carbon: Security Agent Back on Top

Google has officially released Gemini 4 Carbon, which returns to first place on the Artificial Analysis Intelligence Index V5.0 with a score of 59, edging out Claude Opus 5.5 at 58 and GPT-6 Astra at 57. However, what truly sets Carbon apart is not its overall score, but its cybersecurity capabilities.

The Security Chain Split into Three Steps, Each with External Benchmarks

Google breaks the defense chain into three stages—finding vulnerabilities, verifying vulnerabilities, and fixing vulnerabilities—and provides external benchmark results for each: SEC Bench Pro for vulnerability discovery reaches 88.2%, Explore Gen for verifying exploitability scores 54.8%, and CW Bench for vulnerability remediation is 71.0%. These three numbers correspond to the most labor-intensive tasks in a security team's daily work—scanning code, writing POC verification, and producing patches.

CW Bench's 71.0% is particularly noteworthy: it means that about 70% of verified vulnerabilities can directly generate usable fixes without breaking existing functionality. This is the capability enterprises are truly willing to pay for.

According to analysis from a Bilibili tech podcast, internal data is even more impressive: Carbon's success rate in generating secure code is more than double that of Argon. The Chrome team claims that Carbon's performance in producing high-quality patches is more than 10x better than a frontier model from another lab—it's not hard to guess which one. Cloud security platform Waze also stated that it leads on web penetration testing benchmarks.

Additionally, Grace1's indirect prompt injection test blocked all 15 attacks with a 0.0% attack success rate, and Terminal Bench's cheating success rate is also 0.0%. Taken together, Carbon's positioning is clear: it is not a general-purpose chat model, but a "find, verify, fix" machine for security teams and advanced engineering agents.

What Are SEC Bench Pro, Explore Gen, and CW Bench?

These three benchmarks correspond to three independent stages of the security engineering pipeline. Understanding their differences is key to grasping Carbon's capability boundaries. SEC Bench Pro is a vulnerability discovery benchmark for real codebases, assessing whether the model can reliably locate known or injected flaws in a given repository; 88.2% means it won't miss the target issue in most cases. Explore Gen focuses on "exploitability verification"—whether the model can advance a suspicious point to a reproducible exploit path (POC); 54.8% indicates this step remains a bottleneck, with nearly half of suspected vulnerabilities unable to be automatically confirmed. CW Bench measures patch generation quality, requiring fixes to be effective without breaking existing functional tests; 71.0% is the closest to production-ready among the three. Together they cover the complete chain of "scan code—write POC—produce patch," and explain why a single high score does not equal end-to-end automation.

Indirect Prompt Injection and Grace1

Indirect prompt injection refers to attackers hiding malicious instructions in external content the model reads—web pages, code comments, issue descriptions, tool return results—rather than directly in the conversation. For agents that can call browsers, terminals, and code repositories, this is the most realistic attack surface: once the model treats contaminated content as instructions, it may leak data or perform dangerous operations. The Grace1 test evaluates this risk with 15 targeted attacks; Carbon blocked all of them with a 0.0% attack success rate, indicating strict boundary separation between instructions and data. Similarly, Terminal Bench's 0.0% cheating success rate measures whether the model bypasses constraints or fabricates results to "game" the evaluation in terminal tasks—crucial for long-running autonomous agents.

Long-Horizon Tasks Are the Second Highlight

Google internally had Carbon run continuously for several days, performing vulnerability localization and low-level system patching across large codebases. When hitting dead ends, it changes course and continues rather than giving up midway. This is supported by a million-token context: Graphworks long-horizon reasoning jumped from Argon's 84.2% to 96.2%, and Web Dev Arena also rose 89 points, from first to fourth.

For those building agents, this matters far more than single-turn Q&A scores. Truly expensive engineering tasks are never one question and one answer—they involve staring at a repository for three days.

Long-Horizon Tasks and Context Length

A long-horizon task refers to continuous work requiring dozens to hundreds of tool calls, spanning hours or even days—typically tracing call chains in a large monorepo, locating defects, and verifying patches. Its core difference from single-turn Q&A is that errors accumulate, intermediate state must be remembered, and the model must be able to judge "this path is blocked" and proactively change strategy. A million-token context is a necessary condition—enough to hold source code from multiple files, historical diffs, and tool outputs—but not sufficient; what really determines success is long-horizon reasoning and self-correction. Graphworks rising from 84.2% to 96.2% reflects exactly the latter. And pricing based on runtime also makes cost predictability for long-horizon tasks a new variable in enterprise model selection.

Not Fully Open: Fairwind Program First

Such a powerful model is not available to you right now. Google is not doing a full release; it is first giving access to a group of vetted cyber defenders through the Fairwind program, then gradually expanding to trusted partners, with no timeline given for developers, enterprises, or ordinary users. The reason is straightforward: releasing a model this strong at both finding vulnerabilities and writing exploit scripts directly would be too risky. Its participation in the U.S. government's pre-release testing process follows the same logic.

Pricing is fairly restrained. Initial pricing is $2 per million input tokens and $10 per million output tokens, with cached input at a 10% discount—same as Argon—rising to $4 and $20 after the promotional period. Compared with Opus and GPT-6 at the same tier, the unit price is not expensive. But when long-horizon tasks run for days, the bill is based on how long it runs, not how many questions you ask.

Staged Release and Pre-Release Testing of Frontier Models

Models with strong vulnerability discovery and exploit script generation capabilities have obvious dual-use attributes: the same capability can be used for patching or for attacking. Therefore, major labs in recent years have favored staged releases—first opening to vetted defenders, government agencies, and trusted partners, then gradually expanding. The U.S. pre-release testing process requires vendors to submit high-risk models to government agencies for evaluation before public release, which is both a compliance step and a channel for deployment feedback. The Fairwind program follows the same logic of targeted access: it reduces the risk of capability spillover, but also means external independent reproduction and third-party benchmark verification will be delayed. In the short term, conclusions about Carbon will mainly come from the vendor's own claims.

Industry Impact: Iteration Speed and the Tipping Point for Security Automation

For Google, this is two releases from the Gemini 4 series in one month—iteration speed has reached head-to-head competition with OpenAI and Anthropic. For security teams, Carbon is the first frontier model to string auditing, verification, and patching into an automated chain, and is worth applying to try through Fairwind.

However, all current results come from Google internal data and podcast retellings; no external independent reproduction has appeared yet. Fairwind's review threshold also means most teams can only watch in the short term. Whether Carbon can truly change security teams' workflows depends on how the rollout actually progresses.

One-line Summary

Gemini 4 Carbon returns to first place on the intelligence index with 59 points, focusing on security automation and long-horizon tasks, currently available only through targeted access.

Paragraph Summary

Google released Gemini 4 Carbon, which returns to first place on the Artificial Analysis Intelligence Index V5.0 with 59 points, slightly above Claude Opus 5.5's 58 and GPT-6 Astra's 57. What really sets it apart is security capability: SEC Bench Pro 88.2% for vulnerability discovery, Explore Gen 54.8% for exploitability verification, and CW Bench 71.0% for remediation, with about 70% of verified vulnerabilities directly generating usable patches; Grace1 indirect injection test and Terminal Bench cheating success rate are both 0.0%. For long-horizon tasks, Graphworks long-horizon reasoning rose from 84.2% to 96.2%, supporting million-token context. The model is not fully open; it is released through the Fairwind program to vetted cyber defenders at $2 per million input tokens and $10 per million output tokens. All results currently lack external independent reproduction.