Gemini 4 Argon: Google's next frontier model

Google has introduced Gemini 4 Argon, but most people cannot use it yet. In its September 30 announcement, written by Koray Kavukcuoglu, Google DeepMind’s SVP and Chief AI Architect, the company says Argon is “rolling out to a set of trusted cyber defenders through our Fairwind Program.” Developers, enterprises and consumers come later, “as soon as possible,” starting with paid API customers and Google AI Ultra subscribers. This article covers what Google says about the model. The performance figures are Google’s own.

What is available, and when

Only the trusted-defender group has access today. Google says it is taking part in the U.S. government’s voluntary process for pre-release model access while it widens access gradually, and that it will keep gathering feedback from early testers while it iterates on guardrails. The post gives no date for general availability.

The planned pricing is an introductory $2 per million input tokens and $10 per million output tokens, with cached input tokens at 95% off the input price. A footnote says that after the introductory period the price becomes $4 and $20. Those are prices for a launch that has not happened yet. Argon’s output limit is 1M tokens, up from 64K; the post does not state an input context window.

Benchmarks: where Argon leads and where it does not

Google’s post puts Argon next to GPT-6 Astra, Claude Fable 5.1 and Claude Opus 5.5 in one table. Reading the whole table is more useful than the headline “state of the art” claims.

Argon leads or ties on 14 of the 19 rows and trails on five:

Benchmark	Gemini 4 Argon	Best other model in the table
DeepSWE v1.1 (long-horizon software work)	77.9%	74.2% (Opus 5.5)
AutomationBench (Zapier)	51.3%	42.5% (Opus 5.5)
Vals Index	68.9%	67.0% (Opus 5.5)
LVBench (long video)	91.7%	87.5% (GPT-6 Astra)
GraphWalks, 256k to 1M tokens	84.2%	71.8% (GPT-6 Astra)
FrontierSWE v2	55.0%	65.5% (GPT-6 Astra)
Terminal-bench 4.0	57.4%	66.4% (Opus 5.5)
Terminal-Bench Science 0.1	57.6%	68.1% (GPT-6 Astra)
PostTrainBench	45.3%	49.3% (Opus 5.5)
OSWorld-2.0 (offline subset, partial score)	69.2%	72.6% (GPT-6 Astra)

The widest gaps are in knowledge work and long context. On the Harvey legal benchmark Argon scores 19.6% against 6.7% at best for the others, which also shows how low the absolute scores are. Coding is split: Argon leads on DeepSWE and Vibe Code Bench but trails on FrontierSWE v2 and Terminal-bench 4.0. The main table leaves out models from other labs such as Grok and DeepSeek, though the CWE-bench and prompt-injection charts below include them. The post links a methodology page that we did not read.

What else Google claims

Work inside Google. Google says thousands of its employees already use Argon. It gives three examples, all its own reports:

• In one quantum-computing task it beat a published baseline by 40% in minutes.
• A team of Argon agents analyzed fleet-wide profiling data and applied memory optimizations that Google says will free more than 300 TiB once rolled out, with estimated total savings of 500 TiB to 1 PiB.
• Agents are migrating C/C++ code to Rust, from core libraries such as re2 and libgav1 up to more than 800K lines in the Fuchsia Zircon kernel. For the libgav1 video decoder, Google says agents replaced 32K lines of SIMD code in an existing Rust port and produced a memory-safe decoder that runs 2.7 times faster than that port with identical video output. Google adds that these rewrites are being audited and tested before reaching production.

Cyber defense. Google says it trained Argon to “autonomously find, validate, and patch critical software vulnerabilities.” Against its predecessor Gemini 3.8 Flash Cyber, it reports 85.8% against 71.0% on real-world vulnerability discovery across 20 languages and 70.9% against 58.2% on Wiz’s penetration-test benchmark. Both are pass@1 and come from Google’s chart.

Wiz, via its Scan for Good initiative, is using Argon to protect critical public infrastructure; Google says it found a critical vulnerability exposing sensitive personal information in healthcare software used by hospitals worldwide, which previous frontier models had missed. The post gives no details or fix status for that finding.

On CWE-bench v1, which tests fixing security vulnerabilities, Google says Argon “ties for first place” at 68%. Its own leaderboard shows what that means:

Three models share 68%: Grok 4.7, Argon and GPT-6 Astra, with Claude Opus 5.5 at 67%. The chart breaks ties by pass@4 and lists Grok 4.7 ahead of Argon. It also labels the agent harness each model ran in: Argon in Antigravity, Astra in Codex, the Claude models in Claude Code, Grok and most others in opencode. A score here therefore reflects a model and its harness together.

Without cyber guardrails, for some users

One sentence deserves attention: for trusted defenders and Google’s own teams, “we’ll be releasing Argon without cyber guardrails so they can leverage its full frontier-level cybersecurity defense capabilities.” Google’s answer to the dual-use problem is therefore access control first and model behavior second, which is also how the wider release is being staged.

The safeguards Google describes

Before broad release Google says it is strengthening four areas:

• Misuse: the model is designed to refuse harmful requests, including for cyber and CBRN, while preserving legitimate dual-use research. Google says it is improving monitoring of the model’s internal activations and that the safeguards were tested by internal and external red teams.
• Prompt injection: Google calls Argon its most resilient model yet against indirect prompt injection. In its Gray Swan chart, the attack success rate after 15 attempts is 0.7% for Argon, 1.0% for both Claude Opus 5.5 and Claude Fable 5.1, 8.5% for GPT-6 Astra, 31.5% for GLM 5.3 and 52.7% for Kimi K3. Lower is better.
• Misalignment: monitors watch Argon’s chain-of-thought and actions and stop execution when necessary. A similar system monitors training runs and alerts an incident response team. Google says it avoids feeding those findings back into training so it does not teach the model to evade monitoring, and urges the industry to preserve reasoning transparency.
• Hardening systems: in line with its agent control roadmap, Google says it is isolating and sealing sandboxed environments before high-risk training or evaluations begin.

The last two safeguards read differently after this week. In the week OpenAI apologized to Australia and skipped a Senate hearing, which we put in order in our timeline of OpenAI’s agent incidents, Google is describing the same controls as things it is putting in place: chain-of-thought monitoring, stopping runs, sealed sandboxes. OpenAI’s August report similarly says its Astra-class models may have cyber-critical capabilities. Google’s post does not say it has had an incident of this kind, and we have no evidence of one.

What to watch

• Access: how the Fairwind group is chosen, and when paid API customers get Argon.
• Independent results: every number above is Google’s, run on Google’s chosen benchmarks and harnesses, and some rest on partner or internal benchmarks. The five rows where Argon trails are as informative as the 14 where it leads.
• The defender findings: the healthcare vulnerability is described without detail.
• Price: the $2 and $10 figures are introductory and will double.

Editorial review: September 30, 2026 (AI). Prepared from Google’s announcement, read in full the same day, including its benchmark table and charts, and from OpenAI’s August report. All performance and cost figures are Google’s and were not independently verified. Charts and key art are Google’s, reproduced with credit and a link to the source; the linked methodology page was not reviewed.