On October 28, 2026, after the US market closed, Google did two things that seem to contradict each other in a single day. It first delivered an earnings report that sent its stock plunging and wiped out hundreds of billions of dollars in market value overnight, then turned around and released what it calls the strongest frontier model available. That model, Gemini 4 Carbon, scored 59 on the freshly rebased leaderboard of independent evaluation lab Artificial Analysis (AA), edging out Claude Opus 5.5 at 58 and GPT-6 Astra at 57 to take the top seat.
The twist comes in the next sentence: there is no API, no entry point in the Gemini app, and ordinary developers and consumers cannot spend a single dollar on it right now. According to Google's official blog, starting this week the model is available only to a small group of vetted cybersecurity defenders, with broader access to follow gradually through the Fairwind program. For developers and consumers, the timeline is a single word — "soon" — with no date attached.
The model topped the chart, but the door stayed shut. This piece covers three things: where the 59 comes from, why Google handed the keys to cyber defenders first, and what the real cost picture looks like behind a friendly price list. As for which flagship you can actually pay for today, that is a different question — this site's comparison piece handles it separately, so we will not repeat it here.
Two Number Ones in 24 Hours
Some leaderboard context first, because the meaning of 59 depends on it.
AA's Intelligence Index completed a major version change on October 27. Version 5.0 covers four domains — knowledge work, coding, science, and general reasoning — each weighted at 25 percent, spread across nine evaluations, with 60 percent of the evaluation weight drawn from private test data or hidden answers. A version change means all old scores are void and cannot be compared across versions. On the day the new board went live, Claude Opus 5.5 led at 58, Astra followed at 57, and GPT-6.1 Sol sat at 55. Anthropic had held the crown for roughly 24 hours.
On October 28, Carbon overtook it at 59. Its predecessor, Gemini 4 Argon, had launched only two weeks earlier and scores 50 on the same new scale. A nine-point jump is rare in a fight where top models usually trade places by fractions of a point. Zoom out: Opus 5.5 shipped on September 22, GPT-6 Astra in early September, each lab claiming the crown in turn. The shelf life of a number one is now measured in days.
The launch day carried a second layer of drama. Carbon's debut coincided with Alphabet's third-quarter earnings. Per Phoenix Tech, the stock fell more than 10 percent after hours and over 300 billion dollars in market value evaporated; Fortune's figures were a post-market drop of more than 11 percent and over 280 billion dollars; Traders Union put the loss near 400 billion dollars; and the following day's close, as cited by Economic Observer, was worse still — down 12.64 percent on October 29, the worst single-day drop since the 2004 listing, erasing more than 500 billion dollars. The outlets disagree on the exact figures, so we list them side by side rather than picking one; the point is that on coronation day, the company publishing the model had one of its worst trading days ever. Google Cloud revenue doubling year over year was the bright spot; profit and free cash flow dragged, while Pichai still insisted the company was "leading at the frontier," citing nearly 32 billion tokens per minute on first-party APIs and a Gemini app past one billion users.
Score Breakdown: Four Wins Out of Nine, Not a Sweep
The 59 does not mean it won everything. According to AA's analysis article, Carbon took first place in 4 of the 9 evaluations: HLE-Diamond at 69 percent (Opus 5.5 at 68), Terminal-Bench-Science at 65 percent (Astra at 63), plus AA-Omniscience and AutomationBench-AA.
Google's official comparison table is far more aggressive, claiming 15 of 17 benchmarks. One row deserves a different evidentiary weight: Terminal-Bench 4.0, which the official table notes was run independently by AA, where Carbon scored 65.2 percent against 59.6 for Opus 5.5 and 59.1 for Astra. Agents' Last Exam v1.1 came in at 77.4 percent. The two losses were FrontierSWE 2 (Astra leads at 65.5 percent) and OSWorld-2.1 (Opus 5.5 leads at 87.2 percent). Note that apart from the AA-run entries, most of the official table is Google's self-reported data with no third-party reproduction at launch.
In agentic coding as a separate track, the throne is not its yet. On AA's Coding Agent Index, Claude Code paired with Opus 5.5 still leads at 62, with Carbon running on Antigravity CLI second at 59, and Argon at 53. Knowledge work has gaps too: on AA-Briefcase, Carbon earned 1609 Elo, up 126 from Argon's 1483, with the presentation sub-score jumping 293 points — yet it still trails Kimi K3.1 Pro at 1678, Muse Wonder at 1659, and Grok 4.7 at 1638. On WebDev Arena, a gain of 89 Elo lifted it to fourth place.
Another line is easy to miss: the open-closed gap widened again on v5.0. The best open-weight model remains Moonshot AI's Kimi K3.1 Pro at 46, thirteen points behind Carbon; the gap grew from 3 points on v4.3 to 12, as this round of closed-source sprinting pushed the open-weight camp's pursuit back a step — background in the related reading below.
The Security Benchmarks: Why Defenders Get the Keys First
The most unusual part of this release is the order of access.
Google's official blog presents three cybersecurity-focused benchmarks, and the framing must come first: all three are Google's self-reported numbers, evaluated "without guardrails," with no third-party reproduction available at publication. The figures: SEC-bench Pro (vulnerability discovery) at 88.2 percent, up from Argon's 83.4; ExploitGym (exploit validation) at 54.8 percent, up from 42.0 — the largest jump of the three; and CWE-bench (automated patching) at 71.0 percent, up from 68.0. The official narrative follows the defensive lifecycle: find real vulnerabilities, verify exploitability, then fix the root cause.
The catch is that these capabilities cut both ways: a model that finds vulnerabilities finds the ones nobody has patched yet, and validating an exploit is half a step from writing one. The backdrop is the PHP2Shell incident, in which Wiz used Argon and GPT-5.6 Sol to turn PHP vulnerabilities into working attacks, briefly taking Dutch hospitals and government sites offline pending patches. Hence "defenders first": the stronger the capability, the more it belongs with the people closing holes before it becomes an API anyone can call. Carbon has also joined the US government's voluntary pre-release model testing process.
A set of accompanying safety numbers, likewise self-reported without third-party reproduction: a cheating success rate of 0.0 percent on Terminal-Bench 4.0 with attempts at 0.4 percent; high-severity behavioral-inconsistency alerts down nearly 80 percent in internal coding environments; indirect prompt-injection attacks fully blocked on the Gray Swan benchmark at a 0.0 percent success rate — though evaluators caution that a zero could also mean the test no longer challenges the model, not that prompt injection is solved; unsupported claims cut to roughly half of Argon's level; and secure code generation succeeding at more than twice Argon's rate. The boldest claim comes from the Chrome team, which says Carbon produces high-quality patches more than 10 times better than "a large frontier model from another lab" — an official self-description with no supporting data, an unnamed rival, and no way to verify independently.
The Fairwind program's priority order is explicit: government and national cybersecurity agencies, operators of critical infrastructure (healthcare, telecom, energy, financial networks), core technology platforms, and academic labs running defensive benchmarks. Applications are reviewed one by one through Google Cloud account teams, and usage is restricted to internal security, incident response, and penetration testing teams.
Cheap per Token, Not per Task
The price list looks friendly. Introductory pricing matches Argon: 2 dollars per million input tokens, 10 dollars per million output tokens, with cached input at a 95 percent discount. After the introductory period, prices double to 4 and 20 dollars. The comparison is telling: Argon's introductory window ends November 30, stated plainly in Google's developer docs, while Google declined to say when Carbon's window closes. AA describes it as a 50 percent launch discount with an unconfirmed end date.
But identical unit prices do not mean identical task costs. AA's independent measurements offer several numbers: each Intelligence Index task costs an average of 7.76 dollars on Carbon, about 23 percent less than Opus 5.5 at 10.04 dollars, roughly 1.2 times Astra's 6.25 dollars, and essentially flat with Argon's 7.68 dollars at the same standard price — flat, yet 9 points higher, which counts as evidence on the efficiency side. The other side is speed: the median delay before the first output token is 97.5 seconds, against an average of 3.6 seconds for comparable models, and a full run of the index produces about 200 million output tokens, roughly three times the median. "Slow and verbose" is the picture AA's measurements paint, even though per-task output of 123,000 tokens is actually 29 percent less than Opus 5.5's 173,000.
Third-party testing points the same direction on time. The Decoder reports that on finance and tax agent tasks, Carbon takes more than twice as long as Argon; Vals AI's independent tests give finer numbers: 2.25 times Argon's average duration on finance agent tasks and 2.12 times on tax, while finance accuracy actually slipped from 67.66 to 67.16 percent. Its legal research test finished first, but at nearly 52 minutes per task, about 20 minutes more than Argon. In short, the introductory unit price is a marketing price; your bill is shaped by how long it thinks and how much it says.
Controversies and Limits
The first reversal concerns honesty. Using AA-Omniscience v1.1, AA independently measured a commonly misread metric: the share of questions the model fails to fully answer correctly where it nonetheless confidently gives a wrong answer, rather than admitting it does not know or answering partially. Carbon sits at 11 percent, Argon at 4 percent, while Opus 5.5 and Astra both hit 50 percent. So Carbon guesses more than its own predecessor, yet is far better behaved than its two biggest rivals. This coexists with Google's claim of halved unsupported assertions — one is an internal Google benchmark, the other an independent AA test; the tasks and statistical definitions differ, so the two figures cannot be merged into one number or used to refute each other.
The second issue is slowness. A week before launch, early testers reported 2 to 4 times slower than Argon depending on the task, with front-end work still weak — though one noted it seemed "less lazy" and no longer cut corners. All personal impressions, no formal latency measurements.
The third is the fight over methodology. v5.0 assigns 60 percent of its weight to private or hidden questions — AA's rationale is contamination resistance, critics question reproducibility. Hacker News faulted Google for announcing early with no open-access date, and Mashable offered a motive reading: announcing early locks in the number-one claim. When Agentic Tribune fact-checked the release, Carbon's entry had not yet even appeared on AA's public leaderboard page, leaving the 59 traceable only to Google's own announcement — AA has since published an independent analysis confirming the score, but its three security benchmarks remain Google-measured with no independent replication.
Several facts remain unpublished: no parameter count or architecture details from any official or third-party source, and no context-window figure in Google's launch materials. AA's model page lists a 1M-token context window — that is AA's annotation, not an officially published Google number.
The Verdict: A Real Number One, Behind a Closed Door
Three takeaways.
First, the 59 deserves to be unpacked. It is the new overall number one, but the agentic-coding crown still belongs to Anthropic and knowledge work belongs to Kimi K3.1 Pro. This is a "first overall, imperfect in parts" ascension — a more accurate story than a clean sweep, and a more interesting one to keep watching.
Second, "defenders first" is the real experiment of this launch. No parameter disclosure, no API, cyber defenders admitted first: the release schedule for a dual-use capability has, for the first time, become an explicit process. Whether it contains PHP2Shell-style abuse, and whether the defensive dividend turns into real patching output, the pace of Fairwind's expansion over the coming weeks will supply the first evidence.
Third, for most readers, waiting is the correct strategy. The introductory price has no end date, which suggests Google has not fixed its own rollout timeline either; by the time the door opens, the discount will likely have doubled and rivals will have shipped newer models. Comparing then, on a level field, is the only advice that does not expire on a leaderboard that resets every 24 hours.
Related reading
- Kimi Cut Its Cyber Attack Skills Before Open-Sourcing: Why? — why the open-vs-closed gap widened this round, and Moonshot's full story of deliberately trimming offensive capability.
- Anthropic S-1 Filing: $16.3B Revenue, $80.7B Net Loss Decoded — the capital story behind Opus 5.5, context for this week's battle for the top spot.
- Flagship LLM Comparison: How to Choose Opus 5.5, Astra or Argon — the buyable-flagship side of this week's leaderboard shake-up.