Google DeepMind Launches Gemini 4 Carbon Frontier Model

Full analysis

Google DeepMind shipped Gemini 4 Carbon two weeks after Gemini 4 Argon. It tops the Artificial Analysis Intelligence Index (a blended score covering reasoning, coding, and agent work) at 59, claims state-of-the-art numbers on three cybersecurity benchmarks, and reports a prompt-injection attack success rate of 0.0% in its own testing. Pricing matches Argon at $2 per million words in, $10 per million out. Early access goes to a hand-picked group of security defenders first.

Hard to undo? No. This is a model release, not a commitment. Nobody has to adopt anything. What's actually being decided for the reader is whether to believe the headline numbers before anyone outside DeepMind has touched the model, and whether a two-week release cadence changes how you plan your own roadmap. What sets any deadline: nothing external. Access is gated for weeks, so there is time to watch.

The Skeptic. Two frontier models in two weeks, both benchmarked by the same lab, both priced identically. That is a launch rhythm built for press, not for replication. The Artificial Analysis Intelligence Index is a useful composite, but it is run by a small team with thin adversarial coverage. Ranking first there is not the same as ranking first on a locked, outside-administered test. The 0.0% prompt-injection number is the one to distrust most. A test set that did not include the attack that beats it produces a clean zero, not a solved problem. And "our models are helping build our models" has been in every lab's deck for eighteen months. It explains nothing you can check.

The Safety Lens. Gate the initial rollout to cyber defenders, fine. But a model scoring 54.8% on ExploitGym (validating working software exploits) defends and attacks with the same muscle. The Fairwind Program limits who probes it early; it does not limit what the model can do once it is broadly available. The 80% drop in high-severity misalignment alerts is the most meaningful internal signal here, but DeepMind never says what counts as an alert or how often they fire normally. Eighty percent of a noisy counter is not eighty percent of a clean one. Every safety figure in this post is self-graded on distributions DeepMind chose. Encouraging direction, unaudited substance.

The Researcher. The cybersecurity benchmark suite is the genuinely unusual part. Labs normally lead with general reasoning scores. Leading with SEC-bench Pro, ExploitGym, and CWE-bench signals real investment in offense-versus-defense asymmetry. The 54.8% exploitation number is the hardest to fake, because validating an exploit on held-out targets either works or it does not. The composite index at 59 deserves more suspicion: a blended score can hide a regression in a narrow slice that happens to be the slice you depend on. The two-week gap between Argon and Carbon means the research loop that produces these models has genuinely compressed, and that compression is a structural fact about Google's pipeline, not a launch calendar coincidence.

The Compute Pragmatist. Shipping Carbon two weeks after Argon says DeepMind is either running training in parallel on capacity it already owns or has cut its post-training cycle to almost nothing. Both point at the same thing: Google's own TPU chips. Anthropic and OpenAI rent their silicon from third parties and pay market rates to iterate this fast. DeepMind owns the factory. That is why $2/$10 holds for a frontier model built for long autonomous runs, where a single agent session burns through huge piles of output words. The output price being five times the input price tells you where the cost sits: generating all those words at inference time, under memory-bandwidth pressure.

The Enterprise Buyer. None of this is buyable yet. Fairwind is a waitlist for a curated few, so any CTO reading the benchmark table is reading marketing until API access opens. When it does, the questions are the same ones DeepMind did not answer: is there an audit log, an indemnity for exploit-generation misuse, a data-residency option, and a service guarantee on a model that runs for hours unattended. A 0.0% injection claim means nothing in a contract unless DeepMind will stand behind it. Right now the useful move is to keep your current agent stack and write down the specific tasks you would retest the day access opens.

Where they disagree. The Researcher takes the 54.8% exploitation score as the one number that is hard to fake; the Safety Lens takes that exact number as the reason to worry, because an exploit validator is a weapon. Both are right, which is the point: the capability that makes Carbon a strong defender is the capability that makes it dangerous widely released. The second split is the Compute Pragmatist versus the Skeptic. The Pragmatist reads the two-week cadence as a real structural edge from owning TPUs. The Skeptic reads it as a launch tempo tuned for headlines. Both are probably right: the cadence is real, the benchmark framing is oversold, and neither conclusion cancels the other.

What it hinges on. One belief: does the 0.0% prompt-injection result survive contact with outside red teams. Prompt injection (tricking an agent into following instructions hidden in the data it reads) is the main way production agents get hijacked. If zero holds under independent adversarial testing, it genuinely changes how safe multi-step agents are to deploy. If it does not, it was a test-set artifact and the rest of the safety table deserves the same discount. The council leans skeptical on the specific number and respectful of the cadence. Before anyone bets a workflow on Carbon's safety claims, wait for a third party to run injection attacks the lab did not pick.

Prediction: When independent red-teamers publish prompt-injection results for Gemini 4 Carbon after general API access opens, the measured attack success rate will be above 0.0%, by Google DeepMind's I/O 2027 conference in May 2027.

Confidence: High. A clean zero on an adversarial metric has never survived outside testing across any prior lab.

Why: DeepMind's 0.0% figure comes from its own test harness on attack patterns it selected, and prompt injection is an open-ended problem where new attacks are invented faster than defenses close them. Every prior "we solved injection" claim across labs has fallen the moment outsiders tried inputs the vendor did not anticipate, because a defender can only test the attacks it already knows. A clean zero is evidence of a bounded test set, not a solved problem. The opposite outcome, zero holding under genuine adversarial probing, would require DeepMind to have anticipated attacks that have not been invented yet, which no model has managed.

Revisit by 2027-05-31: We're right if any independent red-team or security researcher reports a non-zero prompt-injection success rate against Gemini 4 Carbon. We're wrong if no credible outside test reports a successful prompt injection against it by then.