Gemini 4 Argon Goes to Cyber Defenders First, Developers Later

Google DeepMind announced Gemini 4 Argon on September 30, 2026, and did something unusual with it: rather than opening the model to developers on day one, the company says it is shipping first to a limited group of vetted cyber defenders through what it calls the Fairwind Program. The pitch is long-horizon reasoning for software engineering, legal and financial knowledge work, and vulnerability remediation. The notable engineering claim is a jump in output token limit from 64K to 1 million.

What is actually new

The headline architectural change Google describes is headroom. Argon can generate up to 1 million output tokens in a single trajectory, up from 64K in prior models, which the company frames as giving the model room to reason through a hard problem in one pass rather than being chopped into orchestrated subtasks. Google calls this an industry-leading output limit. The post does not disclose the input context window, model size, architecture details, or training compute.

Pricing was disclosed, which is unusual for a model nobody outside a small cohort can use yet. Google lists an introductory rate of $2 per million input tokens and $10 per million output tokens, with cached input tokens discounted 95 percent off the input rate. A footnote says prices rise to $4 and $20 respectively once the introductory period ends. No date was given for when that period expires.

For teams doing cost modeling, the output side matters more than usual here. A model marketed on its ability to emit hundreds of thousands of tokens per task, billed at $10 to $20 per million output tokens, has a very different cost profile than a chat assistant. A single maximal-length generation would run into the double digits in dollars. Google did not publish guidance on typical token consumption for the long-horizon workflows it is promoting.

The benchmark slate

Google reports state of the art on DeepSWE v1.1 at 77.9 percent, a test of real-world long-horizon software engineering. On Zapier's AutomationBench, which measures end-to-end execution across business functions, the company says Argon ranks first with 51.3 percent — worth noting that a leading score barely above a coin flip suggests the category of cross-application business automation remains genuinely hard. On LVBench, covering long video understanding, Google claims 91.7 percent and state of the art.

The company also says Argon leads the Vals Index, which weights finance, coding, legal and tax performance by each sector's share of U.S. GDP, and reports leading results on Vals Finance Agent v2 and Harvey's Legal Agent Benchmark. Specific numbers for those three were not given. On CWE-bench v1, measuring vulnerability remediation, Google says Argon ties for first at 68 percent — a tie, not a lead, and the post does not say what it ties with.

All of these figures are self-reported and unverified by third parties at time of writing. Google does not name the competing models it is measuring against on any of these benchmarks, which makes "leading" and "state of the art" difficult to size.

Internal deployments as the real evidence

The more interesting material is Google's description of what Argon has done inside the company, where thousands of employees are reportedly using it. Three examples stand out.

In quantum computing research, Google says Argon helped optimize the spacetime resources — qubits times gates — of bottleneck subroutines, and in one case beat a published baseline by 40 percent within minutes. The baseline, the subroutine, and whether the result has been independently reproduced were not disclosed.

In infrastructure, a team of Argon agents analyzed fleet-wide profiling telemetry and autonomously applied memory optimizations across Google data centers, which the company says will free over 300 TiB of memory once rolled out, with estimated total savings of 500 TiB to 1 PiB. The gap between "freed" and "estimated" is doing some work in that sentence.

The Rust migration work is the most concrete. Google says Argon agents are converting C/C++ codebases to Rust, ranging from tens of thousands of lines in libraries like re2 and libgav1 up to more than 800,000 lines for the Fuchsia Zircon kernel. For libgav1, the company's open-source video decoder, agents replaced 32,000 lines of SIMD code by running profile-guided experiments and studying compiler output, producing safe Rust that the compiler auto-vectorizes. The result, Google says, runs 2.7 times faster than the prior Rust port with identical video output, approaching the optimized C++ version. Google is explicit that these rewrites undergo automated and manual auditing, emulation testing, and review before production — a useful admission that agent output on critical systems still requires a human gate.

The cybersecurity bet

Google says it trained Argon specifically for defensive security and will release it to trusted defenders and internal teams without cyber guardrails, so they can use full-strength offensive-adjacent capabilities for defense. That is a significant policy choice and the clearest reason for the staged rollout. Dual-use is not a hypothetical here: a model that can autonomously find, validate, and patch critical vulnerabilities can also autonomously find them for other purposes.

The named customer is Wiz, using Argon in its Scan for Good initiative for free remediation work on critical public infrastructure. Google says the model surfaced a critical vulnerability exposing personal information in healthcare software used by hospitals worldwide, one that previous frontier models missed. The vendor, the CVE, and the disclosure timeline were not provided. Google also cites gains over its earlier 3.8 Flash Cyber model on an internal vulnerability benchmark spanning 20 programming languages and on Wiz's black-box penetration testing benchmark.

Safety posture and what is missing

Google says it is participating in the U.S. government's voluntary pre-release model access process and is strengthening four areas before broad release: misuse defenses for cyber and CBRN under its Frontier Safety Framework, including monitoring internal activations; indirect prompt injection resistance, where it claims leading results on Gray Swan's IPI benchmark; misalignment monitoring that watches chain-of-thought and actions and halts execution when needed; and hardened, sealed sandboxes for high-risk training and evaluation.

One detail deserves attention from anyone building agents: Google says it deliberately avoided feeding misalignment monitoring findings back into training, to avoid teaching the model to evade the monitor, and urges the rest of the industry to preserve reasoning transparency. That is a real methodological commitment with a real cost, and it is the kind of thing that is easy to quietly abandon under competitive pressure.

What the announcement does not include: a model card, published safety evaluation results, the size of the Fairwind cohort, selection criteria for trusted defenders, or any date for general availability. Google says broad access will start with paid API customers and Google AI Ultra subscribers "as soon as possible."

What to watch

• Whether DeepSWE v1.1, AutomationBench, and CWE-bench v1 results hold up under independent replication once outside developers get API access.
• How long the introductory price lasts, and whether real-world token consumption on long-horizon tasks makes the $4/$20 standard rate economical for agent workloads.
• Whether Google publishes a model card and Frontier Safety Framework evaluation results before, or only after, general availability.
• Details on the healthcare vulnerability found via Wiz — vendor disclosure, patch status, and whether the "missed by previous frontier models" claim is substantiated.
• Whether other labs follow Google's stated commitment to keep misalignment monitoring findings out of the training loop, or treat it as a competitive disadvantage.