Google's Strongest AI Isn't Widely Available Yet. The Reason Matters.

01What Carbon actually changed

On the Artificial Analysis Intelligence Index v5.0, Carbon scores 59, ahead of Claude Opus 5.5 at 58 and GPT-6 Astra at 57. Argon scored 50. That nine-point gain is notable, and it reflects a model that now leads the independent ranking overall, but the cybersecurity results carry the most strategic weight for organisations running AI in security and engineering workflows.

Google reports 88.2% on SEC-bench Pro, which measures a model's ability to find real-world vulnerabilities, 54.8% on ExploitGym, which measures how effectively it turns a known vulnerability into a working exploit, and 71.0% on CWE-bench, which assesses remediation. Google describes each as state-of-the-art. The picture is strong, but it is not a clean sweep. Artificial Analysis ranks Carbon second on its separate Coding Agent Index, at 59 against 62 for Claude Opus 5.5, and organisations evaluating Carbon should note where the gaps remain.

The safety and reliability results come from different kinds of evidence, so it helps to keep them apart. On Gray Swan's Indirect Prompt Injection benchmark, an external test that Google reports on, Carbon recorded a 0.0% attack success rate, resisting every evaluated attack attempt. Argon recorded 0.7%. Ars Technica's coverage of the announcement puts the same figure at 1.0% for Claude Opus 5.5 and 8.5% for GPT-6 Astra.

Separately, Google's own internal testing found that high-severity misalignment alerts fell by almost 80% in live coding environments. Successful cheating on Terminal-Bench 4.0 fell to 0.0%, with cheat attempts at 0.4%. Unsupported claims fell by approximately half relative to Argon, while overreach fell 26% and under-service fell 29% in multi-step tasks. These are Google's figures from its own environments, so they are best read as directional evidence about how the model behaves when working autonomously, not as an independent verdict.

02The trade-off your team needs to understand

There is also a trade-off hidden inside the independent results. On Artificial Analysis's AA-Omniscience v1.1 evaluation, Carbon's measured hallucination rate rose from Argon's 4% to 11%, even as its accuracy increased by ten percentage points to 58%. Carbon's rate remains the second lowest of any model Artificial Analysis compares, behind only Argon. But the divergence is a useful reminder that improving one reliability dimension does not guarantee improving every other one.

That is why a single benchmark score cannot settle the question. Which of your tasks benefit most from improved accuracy, and which are exposed by a higher hallucination rate? Those are different tasks, and treating them as interchangeable is where governance frameworks tend to break down.

Google's announcement also describes internal teams running Carbon continuously for days on complex debugging and patching across large codebases, and reports that the Chrome team found it performed more than 10 times better than a competing frontier model at producing high-quality security patches. That is Google's own reporting rather than independent testing. Either way, multi-day autonomous work on production codebases needs oversight structures that most organisations have not yet built for any model.

03Why access is limited, and what that tells you

Google describes its approach as deliberate. Carbon is going first to a subset of cyber defenders, with access expanding gradually to additional trusted partners through the Fairwind Program, while Google gathers feedback and iterates on guardrails before broader availability. Google is also taking part in the US government's voluntary process for pre-release model testing. Google says broader availability for developers, businesses and consumers will follow as soon as possible, but at the time of writing no general availability date has been confirmed.

Google has not said Carbon is too dangerous to release. It has described a controlled rollout, and that is the more interesting signal. Carbon's ability to discover vulnerabilities, validate exploitability and generate remediation increases the consequences of misuse, and therefore changes the risk profile of broad, ungated access.

When a frontier developer changes its deployment posture because capability has moved, enterprise governance cannot remain static. Fairwind is one part of Google's controlled deployment strategy for advanced cyber capabilities. What is the equivalent control around the frontier models already operating in your environment?

04Why this matters now

Scale is part of the picture. On 28 October, Sundar Pichai said Google's first-party model APIs now process nearly 32 billion tokens per minute, 40% more than the previous quarter and more than four times the volume of a year earlier. Against infrastructure growing at that rate, annual model evaluation cycles look increasingly hard to defend, and it is one more reason the governance conversation cannot wait for the market to settle.

Cost belongs in the evaluation too. Carbon launches at introductory API pricing of $2 per million input tokens and $10 per million output tokens, with cached input 95% cheaper. After the introductory period, pricing rises to $4 and $20. Using standard rather than promotional pricing, Artificial Analysis estimates a cost of $7.76 per Intelligence Index task, about 23% below Claude Opus 5.5 at $10.04. For agentic security workflows, capability per token matters alongside the benchmark scores.