Google Built the World's Best AI Model. It Won't Let You Use It.

Gemini 4 Carbon tops the global intelligence index, fifteen days after Argon - then ships to a hand-picked roster of cyber defenders. The strongest model on earth is being handled like a controlled substance.

On Wednesday afternoon Google published a blog post with a claim it has not been able to make for over a year: its model is the best in the world. Gemini 4 Carbon, the company wrote, is "our strongest model with state-of-the-art cybersecurity and long horizon capabilities." It scores 59 on version 5.0 of the Artificial Analysis Intelligence Index. Claude Opus 5.5 sits at 58. GPT-6 Astra at 57. Google's own previous flagship, Argon, at 50.

That is the headline. Here is the sentence underneath it, four paragraphs further down the same post: starting this week, Carbon will be available to "a subset of cyber defenders." Access will then expand gradually through DeepMind's Fairwind Program to "additional trusted partners." Developers, businesses and consumers will get it "as soon as possible," once Google has gathered feedback and iterated on guardrails.

So the most capable model on the planet is, for now, a model almost nobody can use. The newest entry at the frontier does not arrive with a sign-up page. It arrives with a vetting process.

Two frontier models in a fortnight

The timing is the part that should rearrange your sense of how fast this is moving. Google introduced Argon on September 30, initially giving approved cybersecurity partners access through Fairwind. It opened Argon more broadly — API, paid consumer products, AI Studio, Android Studio — on October 13. Carbon arrived on October 28. Fifteen days.

That is not a product cycle. That is a research organisation shipping a new frontier model faster than its own distribution machinery can absorb it. Google's own framing nods at this: Carbon, it says, "illustrates the pace at which we're pushing the frontier forward," with researchers and models working "hand in hand."

The Decoder notes the gains land across the board — agentic tasks, coding, scientific reasoning, multimodal understanding and full-stack web development. On WebDev Arena, Carbon climbs 89 Elo points to 1,768 and fourth place.

What it is actually built for

Carbon is aimed at work that does not fit in a chat window. Google says internal teams ran it "for days" as it worked through dead ends on its own, root-causing subtle bugs across large codebases and low-level systems before producing patches. That is a different product from a model that answers a question. It is closer to a contractor.

The security numbers are the ones Google wants you to remember. On SEC-bench Pro, which measures autonomous discovery of real vulnerabilities in real software, Carbon scores 88.2 per cent, leading every model tested. On ExploitGym, which asks whether a system can turn a discovered flaw into a working exploit, it reaches 54.8 per cent. On Collinear's CWE-bench, which measures whether a proposed fix actually repairs the root cause, it hits 71.0 per cent. Google's Chrome team reports Carbon wrote higher-quality security patches than "another lab's large frontier model" — unnamed — by more than a factor of ten.

Finding a flaw, proving it is exploitable and fixing it are three different skills, and the benchmarks separate them deliberately. SiliconANGLE frames the release the same way: a flagship model defined by security work rather than by chat.

The fine print is unusually interesting

The leaderboard crown is real but narrow. Carbon leads on the aggregate index; it does not lead everywhere. On Artificial Analysis's coding agent index, which measures a model working inside a coding tool, Carbon scores 59 — three points behind Claude Code with Opus 5.5 at 62. On FrontierSWE 2 it trails both Astra and Opus. On the offline computer-use subset of OSWorld, Opus reaches 87.2 per cent against Carbon's 81.5. On agentic knowledge work it gains 126 Elo over Argon to 1,609, and still finishes behind Kimi K3.1 Pro, Muse Wonder and Grok 4.7.

Then there is the detail that deserves more attention than it will get. Artificial Analysis reports Carbon's answer accuracy rising from 48 per cent to 58 per cent over Argon — and its hallucination rate rising from 4 per cent to 11 per cent. It is answering more questions correctly and, when it is wrong, wrong more often. The metric is not "11 per cent of answers are fabricated": it is incorrect responses as a share of incorrect, partially correct and unanswered ones, and abstention carries no penalty. Carbon still posts the second-lowest hallucination rate in the ranking. But the direction of travel is worth naming. A model that is more useful and more confidently mistaken at the same time is a specific kind of hazard in engineering work, where the wrong patch compiles.

There is also the condition attached to the security results. Google says the external cybersecurity evaluations were run "without guardrails." Whatever scores customers eventually receive will be produced under restrictions that do not exist in the test harness.

And there is what Google has not published: no technical report, no parameter count, no API specification. Artificial Analysis's own chart marks the model as having no publicly available API. The pricing is announced — $2 per million input tokens, $10 per million output tokens, cached input at a 95 per cent discount — but that is the introductory rate, matching Argon's, and Google has not dated when it ends.

The staged release is the story

Look at what is actually happening to the release process. Google is participating in the US government's voluntary pre-release testing regime. It is handing the model to defenders before developers. It is describing a rollout in stages — cyber defenders, then trusted partners, then businesses, then you — with no dates attached.

For two years the argument about AI risk ran through benchmarks and evals: does the model do dangerous things when asked? Carbon suggests a different axis has quietly become operational. The question is no longer only what a model can do, but who is allowed to hold it while it does. When the capability in question is finding and exploiting vulnerabilities in software that runs the world, shipping the best version of it to the people who defend systems before shipping it to the people who sell things is not obviously wrong. It is also not a decision that gets made on a launch calendar.

The uncomfortable symmetry is that the same capability that patches a flaw finds it. SEC-bench Pro measures discovery. ExploitGym measures weaponisation. Google reports both, in the same table, as evidence of strength. That is honest — and it is the entire reason the download link is not public.

Google says broader access will come "as soon as possible." Wall Street read the announcement as a modest positive; the stock edged up. The model that beat everything on the index will not touch a customer's codebase this week unless that customer is defending something.

The leaderboard is public. The model is not. For the next year, that gap is where the interesting decisions live.

Sources: Google, The Decoder, SiliconANGLE, Artificial Analysis, DeepMind Fairwind