Google's Gemini 4 Argon Reaches Trusted Cyber Defenders First, With a 1 Million-Token Output Limit

Google announced Gemini 4 Argon on September 30, 2026, a frontier model the company says it is rolling out first to a set of trusted cyber defenders through its Fairwind Program. It is not a general launch. Google says it will gather feedback from early testers before making Argon broadly available to developers, enterprises and consumers, starting with paid API customers and Google AI Ultra subscribers.

Related reading: OpenAI Moves Frontier Training Off the Live Internet and Onto a Cached Copy of the Web · Anthropic Cuts Live Internet Access for Its Internal Evaluations After Its Agents Broke the Rules.

The gating is the substance of the announcement. Frontier models usually arrive as a benchmark table plus an open API, and anyone with a billing account can use them the same day. Argon is going to a vetted group first and, for some of those users, with the standard cyber restrictions removed. The rest of Google's paying customers wait for a model the company calls its most capable.

A staged release, with government review first

Google says it is "actively engaged in the U.S. government's voluntary process for pre-release model access," the arrangement under which federal agencies examine a model before it reaches the general market. The announcement does not name the agencies involved or give a timetable for the review.

TechStartups reported on October 1 that the initial rollout is limited to cybersecurity defenders in the Fairwind Program. Security Affairs described the launch the same way, as a model Google is testing on its own infrastructure before a public release.

Pricing signals the same caution. In the introductory period Google lists Argon at $2 per million input tokens and $10 per million output tokens, with cached input at 95% off the input price. After the introductory period the rates double, to $4 and $20. That is a discount for early adopters who are also, in practice, testers.

The output limit is the headline number

Google puts Argon's output-token limit at 1 million, up from 64,000 previously. It calls the figure "industry-leading" and says it lets the model "generate hundreds of thousands of tokens in a single trajectory," according to the blog post.

Output length is a different constraint from context length, and the two are easy to confuse. A model can accept a very large prompt and still stop after a short reply; the context window governs what goes in, the output limit governs what comes out in one pass. Raising the ceiling changes what a single generation can finish: a long source file, a multi-file refactor, a report that would otherwise be assembled from a dozen separate calls.

That matters for the agentic workloads Google is targeting. An agent carrying out a long software migration, or compiling research across many documents, spends much of its budget re-establishing context when a task has to be chopped into pieces. A larger output limit reduces the number of those breaks. The open question is whether the extra length stays coherent. Long generations tend to drift from the original instruction, and Google has published no independent measurement of quality across a full million-token response.

generate hundreds of thousands of tokens in a single trajectory

That phrasing comes from Google's September 30 announcement, which reports no independent evaluation of how consistently a single long generation holds its thread.

What Google's benchmark table claims

Google's benchmark list leads with DeepSWE v1.1 at 77.9%, which the company says is state of the art on real-world, long-horizon software engineering. On CWE-bench v1, which tests vulnerability remediation, Google says Argon ties for first at 68%, building on its earlier 3.8 Flash Cyber model.

The company also says Argon leads the Vals Index, a GDP-weighted measure of economic impact across finance, coding, legal and tax work, and performs strongly on Vals Finance Agent v2 and Harvey's Legal Agent Benchmark. On AutomationBench, built by Zapier, Google reports first place at 51.3% for end-to-end execution across business functions. For long-video understanding, it cites state-of-the-art LVBench performance at 91.7%. On the Gray Swan Indirect Prompt Injection benchmark, Google says Argon is its most resilient model yet and leading on resistance to prompt injection.

Every one of those figures is Google's own. The company published them without independent replication, and because access is restricted, outside labs cannot check them yet. The pattern is familiar from recent frontier releases, and the distinction still holds: a vendor benchmark establishes what the vendor measured, not what an unaffiliated evaluator would find.

Four results from inside Google

The most concrete part of the announcement is a list of jobs Google says Argon has already done internally.

• Quantum optimization. Google says Argon beat the published baseline by 40% on spacetime resources (qubits multiplied by gates) "in a matter of minutes."
• Memory reclamation. A team of Argon agents analyzed fleet-wide profiling telemetry and freed more than 300 TiB of memory once the fix rolled out, with Google estimating total savings between 500 TiB and 1 PiB.
• Large-scale Rust migrations. Google says Argon worked on re2 and libgav1 and on the Fuchsia Zircon kernel, up to 800,000-plus lines, under automated and manual auditing. For libgav1, the company says Argon's agents replaced 32,000 lines of SIMD code with a memory-safe decoder that "runs 2.7x faster than the Rust port, with identical video output."
• Vulnerability work. Google says Argon is trained to autonomously find, validate and patch critical software vulnerabilities, a capability it describes as central to the Fairwind rollout.

These are the results most likely to be quoted, and they carry a specific limitation. They are self-reported production anecdotes, not peer-reviewed measurements. Google mentions auditing for the Rust work but does not describe an external review of the memory savings or the quantum result. A 40% improvement over a published baseline is a strong claim; it rests, for now, on Google's account of its own result.

Where the cyber guardrails come off

The most consequential line in the announcement concerns what Google is not doing. For trusted defenders and Google's internal teams, Google says it is releasing Argon without cyber guardrails.

The stated reason is that guardrails limit exactly the work defenders need to do. Google points to Wiz, the cloud-security firm, which it says is already using Argon through its Scan for Good initiative, a program that offers free protection to critical public infrastructure. Google says Argon uncovered a critical vulnerability in healthcare software used by hospitals worldwide, calling it "a severe risk that previous frontier models had missed." On Wiz's internal black-box penetration-testing benchmark, which is run without access to source code, Google says Argon outperforms 3.8 Flash Cyber at mapping the attack surface, identifying vulnerabilities and producing proof-of-concept evidence.

The capability that finds a hospital's flaw can find a flaw anywhere else, and the same model that writes a patch can describe an exploit. Google's answer is that the unguarded version goes only to vetted defenders, and that the rest of the stack carries the monitoring. Whether that line holds is a policy question as much as a technical one, and it is the part of the release most likely to draw scrutiny.

The safeguards Google describes

Google lists the protections it has built around Argon: refusal of harmful cyber and CBRN requests while preserving dual-use research; monitoring of the model's internal activations to spot misuse; automated red-teaming and adversarial training to resist indirect prompt injection; misalignment mitigations that monitor Argon's chain-of-thought and actions and stop execution when necessary; a similar monitoring system for training runs; and hardened, sealed sandboxed environments before high-risk training and evaluation.

The chain-of-thought monitoring is the most notable item. It means Google watches the model's own reasoning for signs of intent, in addition to the requests it receives. That is a shift from filtering inputs and outputs toward inspecting the process in between. Google does not say how often the monitors have stopped a run, or what they would do with a defender whose legitimate work looks like an attack.

What outside reporting adds

Bloomberg reported, as summarized by AI Weekly on October 2, that some Google employees privately doubt Argon's real-world coding ability even as management calls it frontier-class. The report is short on specifics, and Google has not answered it publicly. Because access is restricted, the doubt cannot be settled either way.

CNBC framed the launch differently on October 1, observing that Wall Street wants a breakout personal agent from Google. On that reading, the market's interest is less in a benchmark-topping model than in a consumer product that changes how people use Google's services. Argon's initial audience, cyber defenders, is about as far from a consumer agent as the company's lineup allows, which suggests the near-term commercial payoff is not the point of this release.

Caveats

• The benchmarks are Google's. None have been independently repeated, and none can be until access widens.
• The internal results are anecdotes. The quantum, memory and Rust figures come from Google's own teams and have not been externally audited.
• Independent testing is limited by design. A gated rollout keeps outside researchers from verifying the coding and security claims in the near term.
• "Without cyber guardrails" is scoped. Google directs that removal at trusted defenders and internal teams, not at general users. The company has not published the criteria it uses to qualify a defender.
• The output ceiling is a maximum, not a quality guarantee. A 1 million-token limit says how much Argon can emit, not how well a generation that long holds together.

Competing in a crowded frontier

Google positions Argon against OpenAI's GPT-6 Astra and Anthropic's Claude Opus 5.5, per AI-press coverage of the launch. All three claim top-tier results on overlapping benchmarks, which makes independent comparison harder, not easier, when access is uneven.

The nearer-term question is what the Fairwind testers report. If defenders publish concrete results from real incidents, Argon's cyber claims move from a vendor's slide to a record others can examine. If the feedback stays private, the rollout remains, for now, a promise about a model most people cannot use.

Cover: A Google Tensor Processing Unit. Photo by Zinskauf via Wikimedia Commons, CC BY-SA 4.0.