Gemini 4 Carbon Tops the Charts but Stays Behind a Security Gate
A one-point lead on the composite index makes scenario sub-scores more decisive than the headline rank, and the gated launch means most teams can't independently verify the security and alignment claims before choosing a model base. The alignment improvements Google reports — zero cheating success, zero prompt-injection success, lower scope violations — are exactly what enterprises need to trust autonomous agents, but they remain vendor-reported until third parties replicate them.
Gemini 4 Carbon takes the top spot on Artificial Analysis's Intelligence Index v5.0 with 59 points, edging Claude Opus 5.5's 58 and GPT-6 Astra's 57, but the lead is a single point and it only wins four of nine subcategories. On coding, Terminal-Bench 4.0 gives it 65.2% against Opus 5.5's 59.6%, but GPT-6 Astra beats it on FrontierSWE 2 and Opus 5.5 stays ahead on the Coding Agent Index.
Cybersecurity is where Carbon opens a real gap. In guardrails-off evaluations, it hits 88.2% on SEC-bench Pro for vulnerability discovery, 54.8% on ExploitGym for exploit verification, and 71.0% on CWE-bench for patch generation. Google also reports alignment improvements: cheating attempts on Terminal-Bench dropped to 0.0% success, indirect prompt injection attacks fail at a 0.0% rate (vs Argon's 0.7%), and multi-step tasks show fewer scope violations.
Access, however, is the catch. The model ships only to Fairwind, DeepMind's trusted-partner program, and only for security defenders. General developers hear "as soon as possible." On Hacker News, the announcement post gathered 765 points and 625 comments, with most skepticism aimed at the naming scheme, the missing leaderboard entry at launch, and the gated rollout. A few early users report stronger 3D generation but still-weak frontend output.
A 1-point lead across nine subcategories means a headline "world's best" carries little practical weight; choosing a model requires matching specific benchmark scores to your workload.
Google's decision to publish full benchmark and pricing data while gating access behind a security-partner program reverses the usual launch order, turning a product release into a trust-building exercise. It also invites skepticism that the model isn't ready for general use.
The alignment improvements, especially the 0.0% prompt-injection success rate, matter more than the raw intelligence scores for agent workloads, because injection attacks are the primary threat when models act autonomously on third-party content. But these numbers are self-reported and need independent replication.
The vendor-reported "10x better" patch claim from Chrome and Wiz's affiliated testimony should be discounted until an independent lab verifies them; the anonymous competitor makes it impossible to check.