Gemini 4 Carbon scores 59 on AA index, 0.0% on prompt injection

Google announced Gemini 4 Carbon on 28 October. Artificial Analysis’ independent evaluation places it first on its Intelligence Index v5.0 with a score of 59, nine points above Gemini 4 Argon’s 50. For anyone running agents, the more interesting figure is a 0.0% attack success rate on Gray Swan’s indirect prompt-injection evaluation. Most teams can’t use it yet. Access goes first to selected cybersecurity defenders, with planned introductory pricing of $2 per million input tokens and $10 per million output tokens.

What Google actually shipped

According to AiCybr’s breakdown of Carbon’s benchmarks, pricing and access, Carbon is the successor to Argon, which arrived on 13 October. It targets longer-running coding, reasoning and security work. Artificial Analysis reports a 1 million token context window, text, image, audio and video input, and text output. The weights are proprietary. After the introductory period the price doubles to $4 input and $20 output per million tokens, and Google hasn’t said when that switch happens. Expansion beyond the first cohort of defenders runs through what Google calls the Fairwind Program. There is no general developer or consumer availability date and no public API model identifier yet.

Google’s own security numbers place Carbon ahead of both Argon and GPT-6 Astra on three suites:

Google published these figures itself, and it describes the evaluations as run without guardrails. The ExploitGym jump is the largest.

The numbers worth reading twice

The leaderboard lead depends on which view you look at. AiCybr reports Carbon first in Artificial Analysis’ 28 October evaluation. BenchmarkList’s Gemini 4 Carbon profile lists it at 59.4 on the same index but ranks it seventh of 324 entries, with Fable 5.1 shown as field leader at 65.7. Before anyone puts “leads the benchmark” into a procurement deck, it is worth checking which models were in the comparison.

Coding is similar. On Artificial Analysis’ Coding Agent Index, Carbon scored 59 using Antigravity CLI. That puts it second, behind Claude Opus 5.5 at 62 in Claude Code. On SWE-sweep, a harder test where the agent gets a repository with no issue description and has to find and fix bugs itself, BenchmarkList shows Carbon top of 12 models at 9.6% of 4,068 reference bugs. That is an agentic capability signal that the headline index number hides. It is also a reminder of how far unsupervised bug-hunting still has to go.

The injection result needs context too. Google reports 0.0% on its evaluated Gray Swan benchmark, down from Argon’s 0.7%. BenchmarkList identifies the configuration as the combined attack set, transfer-only, with no computer use, and measures attack success after 15 attempts. That is a meaningful result. It does not show that Carbon resists injection when it is driving a browser or desktop, which is where many agent deployments are heading.

One regression stands out. On AA-Omniscience, Artificial Analysis found Carbon’s raw accuracy improved, but its measured hallucination rate rose from 4% for Argon to 11%. Google’s internal evaluations report roughly half as many unsupported claims. The two can both be true because they measure different things. Either way, you shouldn’t treat Carbon’s answers as evidence without checking them.

What it means for builders

Our read is that the cybersecurity-first rollout is a positioning choice as much as a safety one. Google is presenting Carbon as the model you trust with untrusted input, not just the one with the highest score. If buyers in regulated sectors start asking vendors for injection benchmark results, labs that haven’t published any will have to explain why. Even so, a benchmark score doesn’t replace controls. Least-privilege tool access, isolated execution and human approval for sensitive actions still apply. We made the same argument when Microsoft shipped Guardian Agents.

Cost needs the same care. Artificial Analysis calculated $7.76 per Intelligence Index task for Carbon at standard rates, against $7.68 for Argon and $10.04 for Claude Opus 5.5. Carbon averaged around 123,000 output tokens per task, and the evaluator measured time to first token at roughly 97.5 seconds at high reasoning. That is fine for a background security agent and a problem for anything user-facing.

What to do now

If your evals still treat Opus 5.5 or GPT-6 Astra as the capability ceiling, the comparison set has changed. When Carbon access opens, run it through the same harness as your incumbent, with the same permissions, repository snapshots and acceptance tests. Measure cost per accepted outcome rather than cost per token, because verbose models with lots of retries can cost more even at identical list prices. Our LLM integration guide for production systems covers how to keep model swaps cheap. Until access opens, keep building on models you can actually call, and keep your prompt and tool layer portable enough that switching is a config change, not a rewrite.

Frequently Asked Questions

Can I use Gemini 4 Carbon in production today?

Not unless you're in the restricted rollout. Access goes first to selected cybersecurity defenders, then to trusted partners via Google's Fairwind Program. No general developer availability date or public API model identifier has been announced.

How much does Gemini 4 Carbon cost?

Introductory pricing is $2 per million input tokens and $10 per million output tokens, with cached input at a 95% discount ($0.10 per million). Subsequent pricing is $4 and $20 per million tokens. Google hasn't specified when the introductory rates end.

Does a 0.0% prompt-injection score mean Carbon is immune to injection?

No. The result comes from a specific Gray Swan configuration: the combined attack set, transfer-only, with no computer use, measured over 15 attempts. Agents still need least-privilege permissions, sandboxed execution and approval steps for sensitive actions.