Gemini 4 Carbon Is #1, and You Can't Use It

Google announced Gemini 4 Carbon on October 28, and by the end of the week it was the top model on both boards I track. It leads four of Arena’s six main categories and sits first on the Artificial Analysis Intelligence Index with a 59. You can’t use it. Google is giving it to “a subset of cyber defenders” through something called the Fairwind program, and everybody else gets it “as soon as possible.”

So the best model in the world this week is a press release with a leaderboard attached. And it still managed to rearrange my cheapskate table. When the leader goes up, the 50-point cutoff goes up with it, and two of last week’s 50-cent picks fell off the edge without moving a single point.

• Gemini 4 Carbon: number one, behind a velvet rope
  • What the scores say
  • What it costs, if you could buy it
  • The reaction
• The rest of the board
• The cheapskate table
  • A model you can’t buy knocked out two picks
  • The table you can actually buy from
  • Line calls
• Local sweet spot
• Horror stories
  • A backdoored Claude Code extension, served by Cursor
  • The ten-minute first token
• What’s coming
• Finally

Gemini 4 Carbon: number one, behind a velvet rope

Google calls Carbon its next frontier model, “building on Gemini 4 Argon,” which went GA only two weeks ago. Google hasn’t said whether it’s a new training run or a later checkpoint. Before launch, a Google employee reportedly called it “the next Gemini Pro model,” per Let’s Data Science.

The pitch is cybersecurity and long-running tasks. The Register quotes Google’s Koray Kavukcuoglu: “On internal benchmarks, Carbon achieves more than 2x uplift in success rate for generating secure code over Argon.” That’s also the reason for the gated launch. A model that finds and patches vulnerabilities this well is just as handy for someone who wants to exploit them, so defenders go first and Google is taking part in the U.S. government’s voluntary pre-release testing.

Last week I wrote about Moonshot handling the same problem by cutting the cyber data out of Kimi K3.1 Pro’s open weights. Google kept the capability and locked the door. Both approaches end up with the same thing for you and me this week: no access.

What the scores say

The independent scores hold up. On Artificial Analysis, Carbon at high effort scores 59 on the new Intelligence Index v5.0, one point over Claude Opus 5.5 at max (58) and two over GPT-6 Astra at max (57). It takes first place on four of AA’s nine evaluations. On LMArena it’s first in Overall (1527.51), Coding (1573.45), Instruction Following (1524.64) and Hard Prompts (1548.17).

Not many people have voted yet, though. Carbon has 4,403 Overall votes and 1,106 in Coding. Last week I watched Argon lose 6.7 Overall points as its vote count doubled, so expect some of Carbon’s lead to leak away the same way.

The launch table is mostly Google’s own work: 65.2 percent on Terminal-Bench 4.0 against 59.6 for Opus 5.5, 88.2 percent on SEC-bench Pro, 54.8 percent on ExploitGym against Argon’s 42.0. It doesn’t win everything even on Google’s own chart. GPT-6 Astra leads FrontierSWE 2 (65.5 to 61.2), and Opus 5.5 leads OSWorld-2.1 (87.2 to 81.5). AA also has it behind several models on its AA-Briefcase knowledge-work test, with an 11 percent hallucination rate.

What it costs, if you could buy it

The list price is $4 in and $20 out, with a 50 percent launch discount that makes it $2/$10, the same deal Argon got. Argon’s discount ends November 30. AA says Carbon’s has “no confirmed end date.”

AA puts one of its index tasks at $7.76 on Carbon at high effort. That’s about 23 percent under Opus 5.5 at max ($10.04), because Carbon writes 123,000 output tokens per task against Opus’s 173,000. Here’s how the top of AA’s board looks on cost:

Carbon at medium gives up one point to save $1.17 a task and starts answering five times sooner. And GPT-6.1 Sol at max scores 55 for $1.27. Carbon’s extra four points cost six times as much.

Argon at high scores 50 for $7.68 a task. Carbon gets nine more points for eight more cents. Google is replacing Argon with something much better at almost the same per-task price, which is a nice move if it ever ships.

AA moved to Index v5.0 this week and rescaled everything. GLM-5.3-Flash went from 42 to 28, Kimi K3.1 Pro from 55 to 46, Argon from 53 to 50, and none of those models changed. Don’t compare this week’s AA numbers with anything I printed before.

The reaction

The Hacker News launch thread hit 1,018 points and 804 comments, and the top complaints were about access, not quality. One commenter wrote that “showing benchmarks without releasing the model is quite meaningless.” Another said that if a Google PM handed them $100 to figure out how to prompt Gemini 4 Argon, they were “only ~30% sure” they could pull it off, since the Gemini app on their phone only showed 3.8 Pro.

On the thread for AA’s write-up, someone using Argon on Google’s Pro plan reported that five messages on medium effort was enough to trigger a four-hour cooldown. That’s one person’s report, but it lines up with the app-limit complaints that showed up the week Argon went GA. And then the shortest review of the week: “Doesn’t mean jack without access to it.”

Reddit was more excited. r/singularity’s “Gemini 4 Carbon” post pulled 1,627 points, and r/GeminiAI had “Gemini 4 Carbon is #1 and Elon congratulates Demis” at 1,579. Polymarket gives it a 99 percent chance of release by December 31. That’s a low bar.

The rest of the board

OpenRouter’s week through November 2 belongs to DeepSeek again. V4.1 Flash 1017 did 50.4 trillion tokens, up 43 percent, and the original V4.1 Flash slid 13 percent to 15.1 trillion. DeepSeek now has 29.8 percent of all text requests on the platform. The 1017 snapshot runs $0.15/$0.60 from DeepSeek, scores 32 on AA’s new scale at max for 60 cents a task, and streams at 174 tokens a second. A Hacker News commenter says it “does whole projects and asks for $0.10 on US provider with ZDR on Openrouter,” and that they talked a few friends out of their $20 Claude subscriptions. Arena still hasn’t rated it, so it can’t compete in the table yet.

GLM-5.3-Flash is second at 15.3 trillion, up 11 percent. People keep paying for it, and it still lost two spots in my table this week.

MiniMax M3.1 Flash played out about how I guessed last week. The free version, which was fourth at 12.6 trillion, is gone from OpenRouter’s list. The paid version climbed to seventh with 6.46 trillion, up 340 percent. Add the old paid traffic back in and less than half of it stayed once everyone had to pay $0.15/$0.60. The reviews are mixed. The top comment on the HN launch thread calls it “pretty benchmaxed,” saying “in actual use, it doesn’t survive the comparison to models in the benchmark.” MiniMax says the weights “will be released later.”

A few other things:

• Particle-1, from Particle AI, topped New & Trending with 77.2 billion tokens in its first week. It’s a coding model post-trained on DeepSeek V4.1 Flash, priced at $0.05/$0.50.
• Google’s share of OpenRouter requests dropped 32 percent in a week, to 14.4 percent. The chart doesn’t say why, and Google’s best model this week isn’t something OpenRouter can serve anyway.
• Mistral shipped the Large 4 weights on October 29. One pre-release report had said October 27, so it slipped a couple of days, but it beat its own end-of-October promise. It’s 1.05 trillion parameters with 52 billion active, in FP8, under a modified MIT license Mistral calls the Ecosystem Open-Weight license. Arena has it 113th Overall, and on AA the best Chinese open models still score higher. It leads among Western open models, which is the reason to download it.
• OpenClaw is fourth on OpenRouter’s app list at 840 billion tokens, behind Hermes Agent, Claude Code, and Portkey.

Kimi K3.1 Pro, GPT-6.1 Terra, DeepSeek 1017, and MiniMax M3.1 Flash are all still waiting for Arena ratings. The board I used was published October 28.

The cheapskate table

How this works, if you’re new: in each Arena category, the cutoff is the leader’s rating minus 50, and the pick is the cheapest model above it. The band gets computed in code over every row in LMArena’s leaderboard dataset, and I record the first model below the line to prove nothing got cut off. Prices are the maker’s own OpenRouter endpoint. Carbon and Argon are at their $10 intro price.

Band depths: Overall 30, Coding 29, Creative 17, Instruction Following 29, Hard Prompts 37, Math 36. Last week Overall was 49 deep and Coding was 76.

A model you can’t buy knocked out two picks

GLM-5.3-Flash didn’t change. Its Overall rating is 1476.52 on 41,642 votes, more votes than any other pick. Carbon set the Overall cutoff at 1477.51, and GLM missed it by 0.99. In Instruction Following it missed by 0.38. Last week it held four categories. This week it holds three, and it lost the other two to a model almost nobody can call.

This is the mirror image of last week, when Argon sagged and the bands got wider. Carbon pushed the ceiling up, so the bands got narrower. If Carbon’s rating drifts down the way Argon’s did, GLM probably comes back without doing anything.

The new Overall pick is MiMo-V2.6-Pro at 87 cents, 11.5 times cheaper than Carbon’s intro price. It’s thin on votes (4,037) and slow (44 tokens a second on AA). On AA’s new scale it actually beats GLM on both score and price per task: 30 for 26 cents against 28 for 58 cents. For benchmark-style work it would have been worth a look even if GLM had stayed in.

Instruction Following goes to DeepSeek V4.1 Flash at $1.20, with an asterisk: the rated model is the September 10 snapshot, and DeepSeek’s own endpoint now serves the 1017 snapshot instead, which is cheaper ($0.60 out) and not rated. I priced the rated model at the $1.20 standard rate the big third-party hosts charge.

MiMo-V2.6-Flash’s four-issue run as the Coding pick is over too. At 1509.85 it’s nowhere near Carbon’s 1523.45 cutoff. GLM-5.3-Flash takes Coding at 50 cents, 2.65 points over the line.

The table you can actually buy from

Carbon leads four categories, and you can’t send it a single request. So here’s the same method with Carbon taken out, the way I ran Argon back when it was gated:

Creative Writing and Math don’t change, since Carbon doesn’t lead them. Without Carbon, the Overall band is 47 deep and Coding is 78. Coding’s leader becomes Claude Opus 4.7 at $25 out, which is why MiMo-V2.6-Flash’s ratio jumps to 89×.

I’d pick from this second table today.

Line calls

Every category had an edge case under a point this week, and since I don’t round, each one decided something:

• Math’s first model out, Qwen3.7-Max-Preview, missed by 0.02 points.
• In Instruction Following, Muse Spark 1.2 made it in by 0.03, and GLM-5.3-Flash missed by 0.38.
• Hard Prompts’ first model out, Claude Opus 4.5, missed by 0.10. DeepSeek V4.1 Flash is in by 0.56.
• Coding’s first model out, Qwen3.7-Max-Preview again, missed by 0.13.
• Creative Writing’s first model out, GPT-5.6 Sol, missed by 0.16.
• GLM-5.3-Flash missed Overall by 0.99.

Creative Writing still has no cheap answer. Its 17-model band bottoms out at $3.75 with the Gemini Flash family ($1.875 if you use the flex tier). And December 1 is still on the calendar for Argon going to $4/$20, which doubles every Argon-led ratio in that second table.

Local sweet spot

Each row gets the biggest model that fits with room to spare for context and still runs at 15 tokens a second or better. Arena rating decides, and when two models land within 15 points of each other, the Artificial Analysis score breaks the tie.

Nothing changed. I checked the open models that newly surfaced on the board this week (Muse Glimmer, Qwen3.5-27B, Inkling-Small, Qwen3-Next-80B-A3B), and they all rate below Gemma 4 31B on Arena. The AA column is still on the old v4.3.2 scale, since I haven’t rebased the registry to v5.0 yet. The 9B rows are picked by fit, because nothing that small has an Arena rating, and the Gemma speeds stay unmeasured until someone posts a real benchmark.

Horror stories

A backdoored Claude Code extension, served by Cursor

On October 29, for about 11 hours, Cursor’s own extension marketplace served a tampered build of the Claude Code extension. The Hacker News has the details. Versions 2.1.313 (and 2.1.312, per Cursor’s revised notice) added an attacker’s key labeled “svc-telemetry” to ~/.ssh/authorized_keys, tried to turn on SSH, opened a reverse tunnel, and set up persistence through a scheduled task, a crontab entry, or a LaunchAgent depending on the OS. It also sent an unencrypted beacon home with your IP, hostname, username, git email, and the names (not the values) of up to 40 environment variables containing words like KEY, TOKEN, SECRET, or AWS.

Cursor says it hit “at most 5,000 users” and that the build “was not developed by Anthropic.” Anthropic says it “only impacts Cursor users.” The copies on Open VSX and Microsoft’s marketplace were clean. Nobody has said how the attacker got into Cursor’s marketplace.

Microsoft’s warning is the part to act on: “Removing or updating the extension does not remove artifacts written outside its installation directory.” Updating to 2.1.314 leaves the SSH key and the persistence entries right where they were. If you use Claude Code inside Cursor, run cursor --list-extensions --show-versions | grep -i claude-code, check ~/.ssh/authorized_keys for keys you don’t recognize, look through your cron jobs, LaunchAgents, and scheduled tasks, and rotate any credentials that machine could reach. Tech Insider links Cursor’s macOS cleanup script. Read it before you run it.

Last week’s horror story was an AGENTS.md sitting in a Downloads folder, and this week the extension itself was poisoned. Your coding agent has your shell, your keys, and your repo, so anything in its supply chain gets them too.

The ten-minute first token

That AA table has a column most people skip. Opus 5.5 at max effort takes 625.92 seconds, a little over ten minutes, to produce its first token. GPT-6 Astra at max takes six minutes, and Carbon at high takes almost two and a half. If you crank the effort dial on an agent loop to get the top score, you’re also signing up for coffee breaks between steps. Carbon at medium (29 seconds), Opus at high (43.54) and Astra at medium (6.03) give up a few points and come back before you’ve stood up.

What’s coming

Moonshot’s Kimi K3.1 Pro weights are due tomorrow, November 4, with the cyber data cut out and still no license announced. Artificial Analysis lists it as proprietary, and OpenRouter calls it open-weight, so the license will settle that argument. Carbon’s wider rollout has no date beyond “as soon as possible.” Argon goes to $4/$20 on December 1, and Carbon’s discount has no announced end.

Arena should get to Kimi K3.1 Pro, GPT-6.1 Terra, DeepSeek 1017 and MiniMax M3.1 Flash any day now, and the last two have the best shot at landing in a band. Claude Fable 5.5 is still speculation, and this week’s only source traces back to an October 2 post on X that said “5.5 > 6.1.” I found nothing new on DeepSeek V5. And Mistral’s weights shipped, so that one’s off the list.

Finally

Use the second table. GLM-5.3-Flash at 50 cents still covers Overall, Hard Prompts and Math once you remove the model nobody can call. MiMo-V2.6-Flash at 28 cents still holds Coding, and if you care more about hard benchmarks than chat polish, try MiMo-V2.6-Pro at 87 cents. If you need frontier-grade work from something with a public API, GPT-6.1 Sol at max scored 55 for $1.27 a task on AA, against $7.76 for Carbon.

Next week I’ll be watching three things: whether Carbon’s Arena lead holds up as the votes come in, whether the Kimi weights show up with a real license, and whether DeepSeek 1017 finally gets a rating and lands in the table it’s been dominating by volume for two weeks.