Gemini 4 Argon: Cyber-First Launch, Mixed Benchmark Lead

What Google announced

Google has unveiled Gemini 4 Argon, its new flagship model, on 30 September 2026. Like its rivals, it is not going to the general public first. The initial rollout is limited to a set of trusted cyber defenders through Google's Fairwind Program, and broader access will follow later 45. Google DeepMind's Koray Kavukcuoglu described the model as delivering frontier performance across real-world software engineering, enterprise knowledge work such as legal and finance, and cybersecurity defense 4.

For Google, the launch ends a long wait. Gemini 3.8 shipped earlier in the year, but the most prominent frontier releases of 2026 came from Anthropic and OpenAI 1. Argon also arrives less than a month after Google released Gemini 3.8 Flash Cyber, which it had called its most capable cybersecurity model 4.

The headline specs

The most notable technical change is output length. Argon can produce up to 1 million tokens in a single response, up from 64,000 1. Google calls this an industry-leading limit for deep, multi-step problem solving 5. One developer-focused analysis noted that this figure is an output ceiling, not a 1M-token input context window. The two are easy to confuse, and they enable different workloads 3.

Introductory API pricing is $2 per million input tokens and $10 per million output tokens 12. That price is temporary. Google DeepMind says standard pricing will rise to $4 and $20 2, and cached input carries a 95% discount 3. Teams that budget around the launch price should expect the cost to double once the introductory period ends.

A cyber-first rollout, with a guardrail question

The security angle is central to how Google is presenting Argon. Like comparable models from Anthropic and OpenAI, it is assessed to be highly capable at autonomously finding, validating and patching critical software vulnerabilities 4. Google says it has already surfaced a previously unknown critical flaw in healthcare software used by hospitals worldwide, one that exposed sensitive personal information 4.

How the model will be gated for defenders is less settled. The Hacker News reports that Google plans a guardrail-free version for trusted defenders 4. That describes a planned offering, not something confirmed as already shipping. Google's own announcement stresses that it is prioritizing safety and rigorous testing before any wider release 5. Both positions can hold at once. Loosening restrictions for vetted security professionals while holding back public access is consistent with the staged approach the frontier labs have converged on for offensive-capable models.

On the defensive side, Argon recorded a 0.7% attack success rate on Gray Swan's indirect prompt injection benchmark, the lowest of 13 models tested 2. That matters for agentic deployments, where models read untrusted content and act on it.

Benchmarks: a lead, but not a sweep

Google's published comparison favours Argon on knowledge work, agentic coding and long-context tests 1. On DeepSWE v1.1 it scored 77.9%, ahead of GPT-6 Astra at 74.1%, Claude Opus 5.5 at 74.2% and Claude Fable 5.1 at 67.4% 1.

The full table shows a less complete lead. Of 19 benchmark rows, Argon led outright on 13. It trailed on FrontierSWE v2, Terminal-bench 4.0 and OSWorld-2.0 2. Those losses cluster around agentic, terminal-driven and computer-use tasks, which are close to the autonomous workflows Google is promoting. All of these figures also come from Google's own comparison, and no independent hands-on evaluation is broadly possible yet 3.

Our reading is that Argon is a genuine frontier contender, and probably the leader on several coding and knowledge-work measures. It has not established clear dominance across the board. Describing it as a "mixed frontier lead" is fair.

Who can actually use it

Access is the practical limit for now. After the Fairwind Program, broader release is expected to start with paid Gemini API customers and Google AI Ultra subscribers, followed by enterprises and consumers 3. Google has not published dates for these stages 2. As of 1 October there was no public model ID for general developers 3.

Why it matters

Argon shows how frontier launches now work. Security-capable models go first to defenders, public availability is staged behind safety reviews, and the headline benchmarks come from the vendor's own tables. The 1M-token output limit and the low prompt-injection rate are meaningful differentiators. The losses on agentic benchmarks and the planned rise to standard pricing are worth weighing against them.

Developers will be able to judge whether Argon's lead holds only once access widens and independent testing begins. Until then, the strongest evidence for the model is the healthcare vulnerability it found, which Google has reported but outsiders cannot yet verify.