Gemini 4 Argon, two weeks on: not in the API yet

On September 30, 2026, Google announced Argon, the first model of the Gemini 4 generation. The official post is signed by Koray Kavukcuoglu, senior vice president at Google DeepMind, under the title “our next era of frontier intelligence”.

This site wrote a version on October 1, centered on the model going first to cyber defenders, and in a version with the cyber guardrails removed. The facts in that version were broadly right. This time I reread the full post, read the official page for the Fairwind Program, and checked the Gemini API’s model list, and several things need adding or changing. A set of rival scores the old version cited has no source I can find, so it is removed. The old version did not cover how Google uses the model internally, which is in fact the most concrete part of the post. Most important is timing: two weeks after the announcement, ordinary developers still cannot get it.

Who can get Argon now?

Figure 1: The release approach described at the top of the post (source: Google Blog)

The first paragraph says it: Argon is rolling out to a set of trusted cyber defenders through the Fairwind Program. The second says that safely releasing capabilities at this level requires a phased approach. Google is engaged in the US government’s voluntary process for pre-release model access, and will gather feedback from early testers while it iterates on guardrails, before making Argon available to developers, enterprises and consumers “as soon as possible”. The end of the post gives the order: paid API customers and Google AI Ultra subscribers first.

Figure 2: Four tiers and where each stands (data: Google Blog; the API models page was checked for this article on October 13)

The post gives no date at all. On October 13 I opened the Gemini API models page. The top of the list says “Gemini 3.8 Flash is now available”, and below it are the models of the Gemini 3 family. There is no Argon and no Gemini 4 entry of any kind. Secondary coverage mentioned social media talk of paid API access on October 9 or 10. That date has passed, and the models page is unchanged.

So the situation is this: Google announced a model it says leads on a number of tests, and two weeks later outsiders still cannot verify a single number themselves.

Who gets “no cyber guardrails”, and on what conditions?

Figure 3: The original wording on removing cyber guardrails, and the Wiz example (source: Google Blog)

The text says that to better equip defenders for a new era of cyberattacks, Google trained Argon to be highly capable at cybersecurity defense, able to autonomously find, validate and patch critical software vulnerabilities. For trusted defenders and Google’s own internal teams, it will release Argon “without cyber guardrails” so they can use its full defensive capabilities.

The logic is easy to follow. A model that is very good at finding exploitable flaws is at the same time the tool attackers want most. Guardrails exist to block such requests, yet defenders doing vulnerability discovery, validation and patching need exactly those capabilities. Google’s approach is to draw the line at access: vet who you are first, and give you the version without guardrails if you pass.

The old version had a line here: “the safety boundary is not in the model, it is on a list”. I keep that line, but it needs the list’s conditions added, which the old version did not check.

The Fairwind Program launched on September 2, four weeks before Argon, offering Gemini 3.8 Flash Cyber at the time. Its official page says there are more than 650 participating partners globally, with initial access staged for three groups: governments and national cyber authorities, critical infrastructure operators (healthcare, telecommunications, energy, finance), and core technology platforms.

Figure 4: What Fairwind requires of participating organizations (source: Google Blog)

Participating organizations agree to “strict operational standards”, and the page gives two: limiting access to employees on internal cybersecurity, incident response or penetration testing teams, and deploying protections such as multi-factor authentication.

More is left unsaid on that page. It does not state the vetting criteria, whether all 650 partners can get Argon, whether usage logs are audited, or what happens if the standards are breached. The two stated requirements are things any competent security team should be doing already. When a model without guardrails that excels at finding flaws is handed to 650 organizations, how large the risk of leakage is depends on the parts that are not written down.

Anthropic’s approach makes a comparison. It keeps its similarly positioned Mythos line behind verification programs, and September’s Opus 5.5 hands most cybersecurity work to an older model. Both companies are replacing “one restriction for everyone” with “vet the user”. The difference is that Google applies it to its newest flagship and says outright in the announcement that the version has no guardrails.

The example in the post comes from the security firm Wiz. Wiz is using Argon in its Scan for Good initiative, which finds and remediates high-risk exposures in critical public infrastructure for free. The post says the model uncovered a critical vulnerability exposing sensitive personal information across healthcare software used by hospitals worldwide, one that previous frontier models had missed. Google has not published the name of the affected software, a vulnerability identifier or technical details, so for now this is Google’s and Wiz’s account, with no means for outsiders to check it. Withholding details while a flaw is being patched is reasonable, but it also means the case cannot serve as evidence yet.

How do the specifications and prices work out?

Figure 5: Specifications, prices and this article’s calculation (data: the text and footnote of the Google Blog post)

The most distinctive specification is output length. The post says Argon’s output limit is expanded to an “industry-leading” 1 million tokens, up from the previous 64K, which works out to about 15.6 times. This is a different thing from the familiar 1-million-token context: context governs how much a model can read in, and the output limit governs how much it can write in one go. In the post’s words, when the model has the headroom to think deeply and generate hundreds of thousands of tokens in a single trajectory, it can solve tough problems in one go.

Pricing comes in two stages. The introductory price is $2 per million input tokens and $10 per million output tokens, with cached input at 95% off the input price, or about $0.10. The price after the introductory period sits in a footnote that you have to expand to see: $4 for input and $20 for output. The footnote does not say when the introductory period ends.

I worked out one number. If you really fill the 1-million-token output limit once, output alone costs $10 during the introductory period and $20 afterwards. That is not expensive, but it is a reminder that the “write it all in one pass” style has a cost, and the longer the output, the more it costs to start over when something goes wrong partway. Google has published no data on whether quality degrades over long outputs, and that will have to wait for people who can get the model.

Estimating long-term cost from today’s introductory price understates it by half.

Which scores did Google publish?

Figure 6: The results mentioned in the text of the post (data: Google Blog; the AutomationBench comparison is from Anthropic’s Opus 5.5 announcement)

The text of the post gives four scores. DeepSWE v1.1 is 77.9%, which Google calls a new state of the art on a test of real-world long-horizon software engineering tasks. CWE-bench v1 is 68% on remediating security vulnerabilities, and Google’s wording is “ties for first place”. AutomationBench is 51.3%, ranked first, on Zapier’s test. LVBench is 91.7% on long video understanding. For two others, the Vals Index and Gray Swan’s indirect prompt injection benchmark, the post says only that Argon leads and gives no numbers.

Here the old version wrote that on DeepSWE Claude Opus 5.5 scored 74.2% and GPT-6 Astra 74.1%, described as a comparison from media coverage. I could not find a source for those two numbers this time, so they are removed.

One item I can cross-check myself. AutomationBench also appears in Anthropic’s Opus 5.5 announcement of September 22, where the table has Opus 5.5 at 40.0% and GPT-6 Astra at 41.4%. On the same Zapier-run test, Argon’s 51.3% is nearly 10 percentage points above Astra, the previous best. These are two companies each citing the same third-party test, which is somewhat more reliable than a one-sided claim. But I have not seen Zapier’s own leaderboard and cannot confirm the test conditions were the same on both sides.

The “ties for first” on CWE-bench is worth a note. The whole launch revolves around cybersecurity, and on the item Google most wants to stress it does not lead alone. A secondary write-up says the tie is with Grok 4.7, and I did not find the original source.

One more reminder concerns DeepSWE. Some coverage mentions that an audit by Epoch AI in September found problems in at least 23 of the 113 tasks in DeepSWE v1.1. I have not read the audit itself, so I can say only that the reliability of this test has been questioned.

What has Google itself done with it?

The old version left this out entirely. The post says thousands of Googlers are already using Argon and gives four examples, each with numbers.

Quantum computing researchers use it to optimize the resource use of bottleneck subroutines, and in one example it beat the published baseline by 40% in a matter of minutes.

A team of Argon agents analyzed fleet-wide profiling telemetry and autonomously identified and applied memory optimizations, freeing more than 300 TiB of memory once rolled out, with estimated total savings of 500 TiB to 1 PiB.

Argon agents are migrating C and C++ codebases to Rust across Google, at scales from tens of thousands of lines in core libraries such as re2 and libgav1 up to more than 800,000 lines for the Fuchsia Zircon kernel. The post makes a point of saying these large rewrites undergo rigorous automated and manual auditing, emulation testing and review before reaching production.

The most specific is libgav1, Google’s open source video decoder. Argon agents took an existing Rust port and replaced 32,000 lines of SIMD code by running many rounds of profile-guided experiments, studying the compiler’s output, and producing safe Rust that the compiler would vectorize automatically. The result is a memory-safe decoder that runs 2.7 times faster than the Rust port with identical video output.

All four examples are Google’s own account, but libgav1 is an open source project, so it can be checked once the code is merged. Of all the claims, this is the one with the best chance of outside verification.

On safeguards, the post lists four areas: defending against misuse, defending against prompt injection, monitoring for misalignment, and hardening systems. One passage says more than model announcements usually do. Google says it is deploying mitigations that monitor Argon’s chain of thought and actions and stop execution when necessary. It used a similar system during training runs, while “taking careful precautions against feeding the findings back into training” so as not to risk shaping the model’s reasoning to evade monitoring. It then urges the rest of the industry to preserve reasoning transparency at this stage.

That is the same position as the line in Microsoft’s September code of conduct, “if humans can’t understand it, humans can’t oversee it”, which this site covered in its piece on pacing the frontier. Anthropic, in its Opus 5.5 announcement, said it hopes to reduce its reliance on auditing a model’s chain of thought. The three companies do not say quite the same thing about the same problem.

My read, and what would change it

I think the most notable thing about this launch is the manner of release. A company hands its newest flagship first to defenders in government and critical infrastructure as a security tool, and says plainly that the guardrails are off. Among the major vendors this is the first time it has been stated so directly. In the same week OpenAI cancelled GPT-6.1 Astra because the model did not stay within bounds. Taken together, releasing a frontier model no longer means shipping it once it is built.

I hold back on two points. Every score is Google’s own, and two weeks on nobody has been able to reproduce one. And too little of Fairwind’s controls is public. With 650 organizations holding a model without guardrails, the safety of the arrangement depends on details that are not written down.

What would change my view? When Argon appears on the API models page and independent evaluations start producing numbers, if the leads on DeepSWE and AutomationBench are close to the announcement, I would move “strongest” up from vendor claim. If the Rust rewrite of libgav1 is merged into the open source project and the performance numbers hold, the internal use cases will have evidence behind them. If Google publishes Fairwind’s vetting criteria and audit methods, my doubts about “guardrails off” would shrink a good deal. Conversely, if a version without guardrails ever leaks, the whole approach would need reassessing.

For developers there is only one thing to do now: do not build a long-term budget on the introductory price, and treat “when can I get it” as unknown.

What this rewrite corrected

• Rival scores with no traceable source were removed. The old version said Opus 5.5 scored 74.2% and GPT-6 Astra 74.1% on DeepSWE. I could not find where those figures came from.
• The current status was added. On October 13 the Gemini API models page did not list Argon. The old version said only “no date given”.
• Fairwind’s conditions and gaps were added. The program launched on September 2 and has more than 650 partners, and only two requirements of participants are public. The old version cited the 650 figure without checking the official page.
• The multiple for the output limit. The text of the post gives the two numbers, 1 million and 64K. Fifteen times is the result of dividing them, and the old version presented it as Google’s statement.
• The source of the post-introductory price. $4 and $20 are in the post’s footnote.
• New material. Google’s four internal use cases, chain-of-thought monitoring and the note about not feeding findings back into training, the AutomationBench cross-check against Anthropic’s announcement, the DeepSWE audit dispute, and the cost of filling the output limit once.