What Google announced

On 2026-10-28 Google released Gemini 4 Carbon, a frontier model the company describes as delivering “significant gains” in coding, agentic tasks and cybersecurity. The Verge’s Emma Roth reports that Carbon takes the top spot on the Artificial Analysis Intelligence Index (v5.0), ahead of Claude Opus 5.5 and GPT-6 Astra, and that it improves on Argon, the model Google shipped earlier in October.

The distribution detail is the one most coverage buries: Carbon is not generally available. Google has released it to a select group of cybersecurity defense companies, with wider access planned through its Fairwind Program. That single sentence changes how to read everything else in the announcement.

The security benchmarks, and what they measure

Two results are worth naming because they measure different things:

  • SEC-bench Pro measures a model’s ability to find real-world bugs. Google says Carbon holds first place, and beat GPT-6 Astra there.
  • ExploitGym measures whether a model can turn a vulnerability into a working exploit. Carbon is also first on this one.

That pairing is the reason the release is gated to defenders first. A model that is measurably better at both finding bugs and weaponising them is, from a vendor’s perspective, a dual-use artifact. Shipping it to security teams before the general market is a deliberate sequencing choice, not a capacity problem.

The agent-relevant claims

Three claims in the announcement matter more than the leaderboard position, because they map onto the ways agents actually fail:

  1. Long runs. Google says internal teams have seen Carbon “run for days to persist through dead ends” on multi-step engineering tasks. Long-horizon persistence is the difference between a demo and a job.
  2. Prompt-injection resistance. Google claims Carbon is better at resisting prompt injection. For any agent that reads untrusted text - a web page, an email, a PDF - this is the vulnerability that matters, not the benchmark score.
  3. Fewer unsupported claims. Google says Carbon cuts “unsupported claims” by 2x compared with Argon. In practice that is the hallucination rate that makes an agent’s report unusable, because you cannot tell which sentence was invented.

None of these are independently verified yet. They are vendor claims about behaviours that are notoriously hard to measure, and the model is not in public hands to test.

Why the gating matters more than the ranking

A model at the top of a leaderboard that most developers cannot call is a signal, not a tool. The practical consequences:

  • No pricing pressure yet. Carbon is quoted at $2 per million input tokens and $10 per million output tokens - the same introductory price as Argon. Until it is generally available, it does not discipline anyone else’s pricing.
  • No independent evaluation. Third-party harnesses cannot test what they cannot access.
  • Roadmap risk. “Eventually expand” is the least binding phrase in any launch post.

For a desktop agent builder, the honest read is: watch it, do not plan around it.

What to do with this today

If you run agents on your own machine, the useful takeaway is the checklist Carbon is being judged against, not the model itself:

  • Test long-horizon persistence. Give your agent a task with a dead end in the middle and see whether it recovers or fabricates progress.
  • Test injection resistance with your own documents. Put an instruction inside a PDF or a web page the agent reads and see whether it follows it.
  • Count unsupported claims. Ask the agent for a summary of five files and check each sentence against the files. The ratio is your real quality metric.

Those three tests are model-agnostic, and they are the ones that decide whether an agent can be trusted with a real folder on a real desktop. MOOGH is built so each of those failure modes is visible: the plan is shown before execution, the actions are logged, and anything outside the scoped folder stops for approval. Download MOOGH if you want to run the checklist against a desktop agent.

FAQ

Does the Anthropic comparison hold?

The index ranking is third-party, so the ordering is at least measured by someone other than Google. Whether it holds on your workload is a different question - leaderboards average over tasks you do not have.

Is “run for days” plausible?

Google attributes it to internal teams, and there is no published trace. Multi-day runs are usually limited by context management and cost rather than raw capability, so treat the claim as a direction rather than a spec.

Should I switch models because of this?

Not on the basis of a gated release. If you need better injection resistance today, the lever available to you is architecture - scope, approvals, and logging - not a model you cannot call.