Google Retakes Global #1 in Two Weeks: Gemini 4 Carbon Review

Google has released its new flagship model, Gemini 4 Carbon, just two weeks after the previous generation, Argon. CEO Hassabis described the iteration as "lightning-fast." On the Artificial Analysis Intelligence Index V5.0, Carbon topped the global rankings with 59 points, reclaiming the throne it had lost only two weeks earlier.

Scorecard: A Narrow Lead, But First Is First

Carbon scored 59 on the Artificial Analysis Intelligence Index V5.0, ahead of Cloud Opus 5.5 at 58 and GPT-6 Astra at 57. The top three are separated by just 2 points—a clear sign of how tight the competition is. Among the 14 core benchmarks Google published itself, Carbon took first place in 12. On the community blind-test Arena, it ranked #1 globally on the overall text leaderboard with 1,528 points, and #2 on the overall Agent leaderboard.

A word of caution here: official leaderboards and first-party benchmarks should both be taken with a grain of salt. It doesn't dominate every category on Arena's overall Agent leaderboard—it's only second. But taken together, Google has indeed reclaimed the throne.

The Artificial Analysis Intelligence Index is a composite model-capability scoring system maintained by the independent evaluation firm Artificial Analysis. It weights and aggregates results from multiple public benchmarks (reasoning, coding, math, knowledge Q&A, etc.) into a single score, iterated by version (such as V5.0 in this article). Because it doesn't rely on vendor self-reported data and applies the same question set and scoring criteria to every model, the industry often uses it as a reference point for cross-model comparison. Note, however: the index weights are set by the firm itself, scores are not directly comparable across versions, and a 1–2 point gap often falls within evaluation noise—so "topping the chart" is better understood as being in the top tier rather than an absolute lead.

Arena (LMArena) is a crowdsourced evaluation platform where anonymous head-to-head battles are decided by real user votes, with leaderboards for text, Agent, and other categories, scored on an Elo-like rating system. Its strengths are that it reflects real-world usage preferences and is hard to game with targeted optimization; its weaknesses are that voters skew toward enthusiast communities and that coverage of capabilities like tool calling and long-horizon tasks is limited. The gap between "#1 on the overall text leaderboard, #2 on the overall Agent leaderboard" in this article shows precisely that the model is more favored for open-ended dialogue while still having rivals in multi-step tool orchestration.

Core Differentiator: Making Cybersecurity a Scoring Category

The real differentiator this generation is cybersecurity. Carbon turns the entire defense chain into three SOTA results:

• Finding vulnerabilities: 88.2% on the SEC Bench Pro benchmark, surpassing GPT-6 Astra's 85.4% and Argon's 83.4%. The task is for the model to autonomously hunt down complex vulnerabilities hidden in real software.
• Validating vulnerabilities: 54.8% on Exploit Gym, far ahead of the runner-up's 42.4%. It determines whether a vulnerability can actually be exploited, helping security teams prioritize remediation.
• Fixing vulnerabilities: 71% on CWE Bench, writing validated vulnerabilities directly into runnable fix code.

It's not just benchmark scores. In internal tests, its success rate at generating secure code more than doubled Argon's; Argon's security team found in real-world testing that its ability to write high-quality vulnerability patches was more than ten times better than other frontier models. For the first time, security has gone from a liability to an asset for AI.

The three benchmarks in this article correspond to different stages of the vulnerability lifecycle, and understanding their positioning helps interpret what the scores mean. SEC Bench Pro is a vulnerability-discovery benchmark: its questions come from historical vulnerabilities already patched in real open-source and commercial software, requiring the model to autonomously locate the problem in a given codebase—testing cross-file code comprehension and taint tracking. Exploit Gym focuses on exploitability determination: given a suspected vulnerability, judge whether it can be triggered and exploited under real conditions—a critical step in how security teams decide remediation priority, since a high false-positive rate drowns out human effort. CWE Bench aligns with the CWE (Common Weakness Enumeration) classification system, requiring the model to produce, for a specific defect type, a fix patch that compiles and passes regression tests; evaluation typically examines both functional correctness and whether new issues are introduced. Chained together, the three cover the complete loop of "discover—confirm—fix," which is why Google emphasizes "SOTA across the entire chain" rather than a single benchmark score.

Long-Horizon Tasks: Built for Agents That Run for Days

Carbon is designed for agentic workflows that are highly difficult and run for several days straight. Google's internal teams observed that it can run for days on end, neither stalling at bottlenecks nor taking shortcuts—it works through failed paths one by one on its own, ultimately locating the root cause of a vulnerability in large codebases and low-level systems and writing a patch.

The blogger's hands-on test is telling: given the same prompt to draw a four-panel grid of a Chinese pagoda in 3D sculpted style, Argon's pagoda body was thin and crude, while Carbon made an across-the-board leap in the proportions of its multi-tiered eaves, the texture of water reflections, and the layering of the courtyard landscaping—its level of completion directly matching Cloud's Opus 5.5. On the classic SVG pour-over coffee brewer bicycle test, it churned out engineering details like a continuously variable transmission and smooth pedaling, even incorporating the kinematics of riding. On the Web Dev Arena front-end leaderboard it rose 89 ELO points, ranking fourth with 1,768.

In a word: this model can work for you, and it won't bail halfway through.

Long-horizon tasks refer to agentic workflows that require dozens to hundreds of tool calls and span hours or even days to complete—for example, end-to-end bug fixing in a large codebase or migrating an entire build system. The key difference from single-turn Q&A is error accumulation: small deviations at each step get amplified in subsequent steps, and the model must also maintain task state, decide when to backtrack, and avoid falling into infinite loops or taking the shortcut of "changing the tests instead of the code." The industry commonly measures this capability with benchmarks like METR's task-length curves and long-cycle benchmarks such as SWE-Lancer. The "not stalling at bottlenecks, working through failed paths one by one" mentioned in this article is essentially a manifestation of long-horizon planning and self-correction—and the main bottleneck for agents moving from demos to production today.

A Reality Check: Ordinary Users Can't Use It Yet

The rollout is security-tiered. This week Carbon is only available to select cyber defense parties, after which it will gradually expand to trusted partners through dedicated programs; Google is also participating in the U.S. government's voluntary pre-release model testing process. Full availability to developers, enterprises, and consumers will wait until safety measures are iterated—with no timeline given.

The pricing is deceptive. During the introductory period it's $2 per million input tokens and $10 per million output tokens, on par with Argon and seemingly cheap; but once the promotional period ends, prices revert to $4 and $20, and Google hasn't said when that ends. The only certainty is a 5% discount on cached input.

Discount the data. "Running for days" is a claim from Google's internal teams; third-party data warrants a degree of skepticism.

The Release Paradigm Has Changed: Give It First to Those Who Can Defend Against It

Google is changing its release paradigm. In the past, a flagship launch meant simultaneous global availability; this time it's a security-tiered rollout: first to national-level cyber defenders, then to trusted partners, and finally to the public. The logic is straightforward—the more capable the model, the more it must first be placed in the hands of those who can defend against it.

Combined with Argon's pace two weeks ago, Google has entered lightning-iteration mode. One official statement is worth savoring: "Researchers are working with the model to improve its capabilities at an even faster rate." Some netizens interpret this as evidence that recursive self-improvement has already been achieved—currently speculation with no empirical proof. But the signal is clear: competition has shifted from benchmark scores to who can safely release a model that can do work on its own.

Security-tiered release (staged / tiered release) is a launch strategy that frontier labs have gradually shaped over the past two years: no longer opening weights or APIs to the public all at once, but releasing in batches according to users' risk tolerance and defensive capability—typically in the order of internal red team, government or national-level security agencies, a handful of trusted partners, and finally enterprises and the public. Supporting mechanisms include voluntary pre-release testing frameworks (such as the pre-deployment evaluation agreements of the UK's AISI and the US's CAISI), model card and system card disclosure, and abuse monitoring. The underlying judgment is that the closer a model's capabilities come to "autonomously executing long-horizon tasks," the greater the downside risk of misuse and loss of control—so it should first go to those able to evaluate and defend against it. The cost is that ordinary users and developers are delayed, and the rollout timeline is often opaque, which explains the "no timeline" phrasing in this article.

Action Guide for Three Groups

Security teams and infrastructure folks: This is the tool built for you. Keep a close eye on Google's dedicated program channels—it can cover all three stages of finding, validating, and fixing vulnerabilities. Prioritize handing it repetitive triage tasks as a pilot.

API developers: Hold off for now. Wait until it opens up to the Gemini API and AI Studio before integrating; following Argon's precedent, the introductory price will most likely carry over at that point. For long context, remember the 5% cached-input discount and do the math to save.

Ordinary users: Keep using the current model in the Gemini App; when Carbon rolls out depends on the progress of safety testing. If you want to experience the top tier in the coming days, Opus 5.5 and GPT-6 Astra are both still online.

The point of this generation isn't when you and I get to use it—it's that agents capable of working autonomously for days are genuinely entering production. When a model starts running for days on end, finding vulnerabilities on its own, and patching them on its own, AI goes from being a chat tool to an indefatigable colleague.

One-line Summary

Gemini 4 Carbon reclaims the top spot by a narrow margin, focusing on cybersecurity and long-horizon agents, but is only available via tiered release.

Paragraph Summary

Just two weeks after the previous generation Argon, Google launched Gemini 4 Carbon, which tops the Artificial Analysis Intelligence Index V5.0 with 59 points—only 2 ahead of Opus 5.5 and GPT-6 Astra—taking first in 12 of its own 14 benchmarks, #1 on Arena's text leaderboard and #2 on its Agent leaderboard. The real differentiator is cybersecurity: finding, validating, and fixing vulnerabilities all reach SOTA, turning security from a liability into an asset. The model is designed for agentic workflows that run for days, autonomously locating root causes and writing patches in large codebases. But ordinary users won't get it anytime soon: it's being released in security tiers, first to defenders and trusted partners, with no timeline for full availability; the introductory $2/$10 pricing comes with a promotional-period trap, reverting to $4/$20 afterward.