Gemini 4 Carbon Is WAY More Crazy Than You Think (Here's Why)

Summary

The video examines Google’s Gemini 4 Carbon, focusing on its reported long-running coding ability, resistance to prompt injection, and reliability in coding tests. The presenter emphasizes that many figures come from Google and have not been independently verified.

Reported capabilities and test results

• Long-running coding work: Google says Carbon worked for several days on a complex engineering task to find and fix a hidden error in a large codebase. It reportedly encountered dead ends, tried other approaches, and continued working. The presenter describes this as a potential shift from AI that answers a single prompt to agents that can handle extended tasks.
• Prompt-injection resistance: In a Grey Swan benchmark, Google reports that Carbon had 0.0% successful attacks, compared with about 0.7% for Argon. The video cautions that passing a set of tested attacks does not prove the model is immune to real-world malicious instructions in webpages, emails, or files. VentureBeat is cited for this caveat.
• Coding-test behavior: Google reports 0.0% successful cheating on Terminal-Bench 4.0, a 0.4% fraud-attempt rate, and increased accuracy. Google also reports fewer critical alerts in live programming, less abuse of authority, and fewer task failures. These figures are presented as Google’s internal results, not independent findings.
• Chrome-team fixes: Google reportedly said Carbon’s fixes were ten times better than those from a large model from another lab. The presenter notes that VentureBeat reported Google did not provide supporting data.

Practical guidance and tests

The video recommends giving AI agents a short, three-part brief before assigning extended work:

1. Goal: State the desired result.
2. Constraints: Specify what the agent may and may not change.
3. Verification: Define how a person can confirm the work succeeded.

For example, when updating prices on a services page, prohibit changes to payment settings. Then check the new prices and test every button.

The presenter also describes a simple “banana test” for prompt injection: place an instruction on a page you own telling an AI to ignore its task and reply “banana,” then ask the AI to summarize the page. If it obeys the embedded instruction instead of summarizing, it may be vulnerable to third-party instructions. The video advises using only a non-private test page.

Other recommendations include:

• Start with read-only access.
• Require human approval before an agent sends messages, publishes content, or handles money.
• Check evidence of completed work rather than trusting an agent’s report.
• Record the model and test date, since models change.

Access and availability

According to the video, Carbon was not yet available to ordinary developers, businesses, or consumers at the time discussed. Google was initially providing access to selected cybersecurity experts and trusted partners through its Fair Wind program, with applicants vetted and usage monitored. The presenter warns against buying purported Carbon access from resellers, noting that Google prohibits resale.

The video says Argon is publicly available through Google’s API and paid products. It gives a temporary listed price for Carbon matching Argon’s starting price: $2 per million input tokens and $10 per million output tokens. It also mentions Code Mender, a code-fixing assistant that can use publicly available models. The presenter cautions that later public versions may have different performance or security metrics from those in Google’s tests.

Main takeaway

The video’s central advice is that safe AI-agent use depends not only on model capability, but also on setting clear permissions, limiting access, and independently verifying results: prepare, limit, and check.

Main speakers and sources

• Main speaker: Nick Ponte’s AI avatar, as identified in the video. It says the real Nick Ponte works in marketing.
• Sources discussed: Google’s announcements and Fair Wind information, VentureBeat reporting, the Grey Swan prompt-injection benchmark, and Terminal-Bench 4.0.