Google Launches Gemini 4 Carbon, Tops Intelligence Index with Price Cuts

Capable of grinding through bugs for days on end, immune to prompt injection

Meng Chen reporting from Ao Fei Si QbitAI | WeChat Official Account: QbitAI

Just two weeks after the release of Argon, Google swiftly unveiled its new flagship model, Gemini 4 Carbon.

This time, it surpassed Claude Opus 5.5 and GPT-6 Astra.

In the recently updated Artificial Analysis Intelligence Index 5.0, it dominated the global rankings with a high score of 59.

Two weeks ago, when Google released Gemini 4 Argon, Silicon Valley was buzzing about a mysterious checkpoint named "Carbon" leaked from within Google's internal archives. At that time, internal engineers rated it as having a coding experience approaching that of Opus 5.5.

Unexpectedly, in just half a month, the official version of Carbon not only achieved a direct overtaking of Opus 5.5 in intelligence and long-horizon programming but also significantly led in code security and anti-cheating measures.

It even unlocked the talent of being 100% immune to prompt injection.

What kind of brutal progress speed is this? Did they really master RSI (Recursive Self-Improvement)?

During its initial launch phase, Carbon continues Argon's half-price discount, with input costs at $2 per million tokens and output costs at $10 per million tokens, making the nominal unit price exactly half that of Opus 5.5 ($4/$20).

Furthermore, for cached input frequently used in Agent tasks (cached input), a 95% steep discount is offered (as low as $0.2 per million tokens).

Surpassing Opus 5.5, Capable of Grinding Through Low-Level Bugs for Days

Although Gemini 4 Argon, released two weeks ago, showed stunning performance in long-context and multimodal tasks, it still lagged behind Opus 5.5 in the comprehensive intelligence index (53 points) and some hardcore terminal tasks.

This time, Gemini 4 Carbon precisely filled the last piece of the puzzle, pushing capabilities toward the form of an "all-weather autonomous engineer."

In Google's internal real-world programming environments, the R&D team observed a scene that left them stunned:

Carbon can run continuously for several days, navigating independently through massive, complex codebases and underlying systems; even if it hits multiple "dead ends" along the way, it persists until completion, independently handling complex multi-step engineering tasks. From tracing clues to locate extremely hidden bug root causes to finally writing the fix patch, it does so seamlessly.

This long-term execution capability is directly reflected in surpassing multiple hardcore metrics:

• Command Line and Terminal Engineering

In Terminal-Bench 4.0 (AA test set), Carbon scored 65.2%, leading Opus 5.5 (59.6%) and GPT-6 Astra (59.1%);

It also ranked first with 64.8% in scientific terminal task Terminal-Bench-Science 0.1 (Opus 5.5 scored 59.0%).

• Ultra-Long Context and Multi-Step Decision Making

In GraphWalks tests with contexts ranging from 256k to 1M, Carbon scored 96.2%, significantly outperforming Opus 5.5 (66.8%) and Astra (71.8%);

In Vending-Bench 2, which simulates long-cycle business operations, Carbon's final account balance reached $16,484, nearly 1.8 times that of Opus 5.5 ($9,235).

• Full-Stack Development and Enterprise Tasks

On WebDev Arena, thanks to improvements in frontend components and output quality, Carbon's Elo score rose by 89 points to 1769. Although it ranks fourth globally, its average task cost is lower.

On Vals Index v2.2, which measures the value of enterprise-level workflows, it narrowly leads Opus 5.5 with 70.4% (vs. 70.2%).

However, according to breakdowns by third-party evaluation agency Artificial Analysis, Opus 5.5 still retains part of its moat in pure code engineering domains.

For example, in the tables published by Google itself, there are two metrics where Carbon did not take the top spot:

One is FrontierSWE 2, measuring frontier software engineering, where GPT-6 Astra (65.5%) and Opus 5.5 (62.3%) still rank ahead of Carbon (61.2%);

The other is the offline subset of the computer operation benchmark OSWorld-2.1, where Opus 5.5 maintains first place with 87.2% (Carbon scored 81.5%).

Additionally, on the Coding Agent specific index paired with respective official CLI tools, Carbon combined with Google Antigravity CLI scored 59 points, still trailing Opus 5.5 powered by Claude Code (62 points) by a margin of 3 points.

This wave of "anti-gravity" seems to have dragged down the hamster (referring to the mascot or nickname associated with the model/team).

But for developers, Carbon's true lethality lies in token consumption efficiency.

Independent evaluation data shows that while Opus 5.5 is powerful, its reasoning process is extremely verbose, consuming an average of 173,000 output tokens to complete a single Intelligence Index assessment. In contrast, Carbon requires only 123,000 tokens, reducing output volume by 29%.

This means that even if Carbon returns to the same standard pricing as Opus 5.5 ($4/$20) in the future, Carbon's average cost per task ($7.76) will be approximately **23$10.04).

If we factor in the current launch half-price of $2/$10, Carbon's actual billing cost in production environments is less than 40% of Opus 5.5's.

Completing the Grand Slam: From Vulnerability Discovery to Patching in AI Coding

Beyond conventional coding, Google has staked Carbon’s core differentiator on the full lifecycle of cybersecurity defense.

This move was born out of necessity—Google couldn’t just stand by while its frontier models constantly uncovered vulnerabilities in Chrome and Android.

(Note: All external benchmarks below were evaluated with safety guardrails removed to assess full capability.)

• Step 1: Finding Real Vulnerabilities

The cornerstone of cybersecurity defense is identifying deep-seated, complex defects in real-world software before hackers do. In the SEC-bench Pro test, which includes high-risk vulnerabilities from components like the V8 engine and the Linux kernel, Carbon achieved a score of 88.2%. This not only significantly surpassed its predecessor Argon (78.8%) but also exceeded OpenAI’s GPT-6 Astra (85.4%), setting a new State-of-the-Art (SOTA) record.

• Step 2: Validating Risk Through Exploitation

Faced with hundreds or thousands of potential vulnerabilities, how should security teams prioritize fixes? This requires the model to act like a real attacker, verifying which vulnerabilities are genuinely exploitable.

On the renowned exploitation benchmark ExploitGym, Carbon set a new SOTA with a score of 54.8% (up from Argon’s 35.1%), helping defenders accurately prioritize remediation efforts.

• Step 3: Patching at the Root Cause

After finding and validating vulnerabilities, the ultimate challenge is writing fix code that works without breaking existing functionality. In Collinear’s CWE-bench (a repository audit and repair test covering 73 Common Weakness Enumerations), Carbon reached 71.0%, comprehensively outperforming Claude Opus 5.5 (67.0%) and Argon (68.0%).

Beyond topping external leaderboards, Carbon’s success rate in generating secure code within Google’s internal security benchmarks improved by more than 2x compared to Argon.

Even more impressive results came from Google’s own Chrome browser team: in practical comparisons for generating high-quality security patches, Carbon performed over 10x better than large frontier models from another top-tier lab.

Curbing Agent Cheating: 100% Immunity to Prompt Injection

When models run continuously in terminals for days, developers’ biggest headache often isn’t the compute bill, but the model starting to “cut corners” (Shortcut & Loophole Exploitation) when facing high-pressure, complex tasks.

Previous third-party audits of Terminal-Bench 4.0 revealed that many high-scoring models would fake “test passes” by modifying test scripts or exploiting loopholes when they couldn’t fix bugs properly. To address this persistent issue, Google focused heavily on alignment training for Carbon:

• Cheating Success Rate Dropped to 0.0%

On the terminal operation benchmark Terminal-Bench 4.0, while significantly improving overall accuracy, Carbon crushed the “successful cheating rate” down to 0.0%. Even the rate of attempting shortcuts dropped to just 0.4%.

In live coding environments used by internal Google teams, high-severity misalignment alerts plummeted by nearly 80%.

• Refusing to Pretend: Hallucination Rates Far Below Competitors

In internal tests, the frequency of Carbon making unsupported claims decreased by approximately 2x compared to Argon.

When evidence is missing or operations are blocked, it no longer uses vague language or forces assumptions. Instead, it explicitly documents methodological limitations in deliverables or provides clear checklists telling humans exactly what conditions are still missing.

• Asking When Unclear: Defining Execution Boundaries

Facing ambiguous requirements, Carbon doesn’t blindly guess or force progress. It first retrieves relevant sources, surfaces discovered contradictions, and confirms them with the user.

During end-to-end execution of multi-step plans, instances of overreach decreased by 26%, and under-service (skipping steps) decreased by 29%.

• 100% Immunity to Prompt Injection

When agents read web pages, emails, and external codebases in the wild, they are highly susceptible to hijacking via Indirect Prompt Injection (IPI).

In the Gray Swan IPI benchmark, the previous generation Argon led the field with an extremely low compromise rate of 0.7%.

This time, Carbon delivered a perfect score with a 0.0% attack success rate, successfully defending against every attempted attack during evaluation.

Behind the 14-Day Blitz: RSI Accelerates Across the Board

From Gemini 4 Argon’s debut at the end of September and full rollout two weeks ago, to today’s sudden emergence of Gemini 4 Carbon completely surpassing Opus 5.5.

CEO Sundar Pichai playfully remarked on X (with a doge emoji):

I said before that we would release models periodically... Now, introducing Gemini 4 Carbon.

Based on previously leaked internal information, Google has actually been training and evaluating multiple Gemini 4 checkpoints—Argon, Barium, and Carbon—in parallel internally. Notably, the publicly released Argon corresponds to the internal Barium-B checkpoint.

In a subtle corner of the official announcement, Koray Kavukcuoglu, Senior Vice President and Chief AI Architect at Google DeepMind, revealed the real secret:

“Our researchers are working hand in hand with our models to accelerate capability evolution while simultaneously strengthening safety guardrails.”

In other words, using top-tier AI to assist in training, evaluating, and optimizing next-generation AI is already fully operational within Google.

However, true to form, Google’s release does not equal immediate availability.

Due to Carbon’s strong vulnerability discovery and exploitation capabilities, it must undergo pre-release testing procedures. Starting this week, Carbon will first be made available to a subset of cybersecurity defense professionals.

Remember how long it took for Argon to go from announcement to actual user access? The wait this time won’t be short either.

With Anthropic approaching its IPO milestone, isn’t it about time they released Fable 5.5?

As for OpenAI, which seems obsessed with releasing mid-sized Terra models and sending SMS notifications for Dot updates, I wish them luck.

References: [1]https://blog.google/innovation-and-ai/models-and-research/gemini-models/introducing-gemini-4-carbon/ [2]https://x.com/sundarpichai/status/2115489219804352921?a=TCW5gQam8bc7T7enVWo&s=20