Google Restricts Gemini 4 Argon as Its Cyber Capabilities Move Beyond Code Assistance

Controlled access for a model built to find and repair flaws

Google announced Gemini 4 Argon on September 30, 2026, introducing it as the first model in the Gemini 4 generation and a system designed for complex, long-running workflows.

Cybersecurity is central to the launch. Google says Argon was trained to autonomously find, validate, and patch critical software vulnerabilities. The company is also positioning the model for software engineering and enterprise knowledge work, including legal and financial tasks.

Argon is not generally available.

Initial access is restricted to selected cyber defenders participating in Google’s Fairwind Program and to Google’s internal teams. According to The Verge’s report on the announcement, Google is also participating in the US government’s voluntary process for pre-release access to advanced models.

The company plans to expand access gradually while gathering feedback and strengthening safeguards. No public release date has been provided.

After the cybersecurity testing phase, Google intends to begin wider availability with paid API customers and Google AI Ultra subscribers, according to Ars Technica. That remains a planned rollout rather than a current commercial release.

Fairwind launched in early September as a limited-access program for governments, Google Cloud customers, and cybersecurity partners. SecurityWeek reports that it had more than 650 participating partners at launch and initially combined Gemini 3.8 Flash Cyber with CodeMender, Google’s harness for finding, verifying, and fixing vulnerabilities.

An unnamed hospital-software flaw demonstrates the stakes

The most consequential security result disclosed with Argon involves healthcare software used by hospitals worldwide.

Google says the model identified a critical vulnerability that exposed sensitive personal information. The company described the risk as severe and said previous frontier models had missed the flaw.

Wiz is using Argon through Scan for Good, an initiative that identifies and remediates high-risk exposures in critical public infrastructure without charging affected organizations. Google and SecurityWeek connect Wiz’s use of Argon with the healthcare finding.

However, the affected software was not named in the reporting. SecurityWeek also says the announcement did not state whether the vulnerability had been remediated.

The supplied reports do not associate the flaw with a CVE identifier or provide technical indicators. That is a limitation of the published material, not evidence that no CVE or indicators exist elsewhere.

As a result, hospital operators cannot determine from this disclosure alone whether their environments are affected. They would need at least a product name, affected versions, a vendor advisory, or other technical information before beginning targeted patching or exposure assessment.

The case nevertheless illustrates the workflow Google is trying to automate. Argon is intended to progress from identifying a suspicious condition to validating its security impact and producing a repair, rather than stopping at code analysis or remediation suggestions.

One undisclosed vulnerability cannot establish how consistently the model performs across unfamiliar systems. It does, however, show why access to autonomous vulnerability research capabilities is being treated differently from an ordinary chatbot launch.

Security benchmarks show progress—and significant caveats

Google compared Argon with Gemini 3.8 Flash Cyber on internal evaluations. On the company’s vulnerability benchmark, Argon reportedly identified a broad range of exposures in complex codebases spanning 20 programming languages.

Wiz also evaluated the models through an internal black-box penetration-testing benchmark. That assessment targeted live web systems without providing source-code access.

Argon reportedly surpassed Gemini 3.8 Flash Cyber in attack-surface discovery, vulnerability identification, and production of proof-of-concept evidence. The final capability is especially sensitive: defenders can use proof-of-concept material to validate severity, but comparable functionality could also lower the effort required to operationalize a flaw.

On CWE-bench v1, a vulnerability-remediation benchmark developed by Collinear AI, Argon scored 68%. SecurityWeek says it tied for first with OpenAI GPT-6 Astra and xAI Grok 4.7. MarkTechPost also reports the 68% result, although its comparison table identifies only GPT-6 Astra as a co-leader.

The discrepancy concerns the listed competitors, not Argon’s reported score. MarkTechPost also notes that rival models ran inside their own agent harnesses, so the results may reflect differences in orchestration and tooling as well as model capability.

The wider engineering results were mixed. Argon reportedly scored 77.9% on DeepSWE v1.1, compared with 74.2% for Claude Opus 5.5, 74.1% for GPT-6 Astra, and 67.4% for Claude Fable 5.1. On AutomationBench, it reached 51.3%, ahead of Claude Opus 5.5 at 42.5%.

Argon did not lead every test. Its FrontierSWE v2 score was 55.0%, behind GPT-6 Astra at 65.5%, Claude Opus 5.5 at 62.3%, and Claude Fable 5.1 at 56.3%. On Terminal-Bench 4.0, Argon’s 57.4% also trailed all three comparison models.

These figures were reported by MarkTechPost as coming from Google’s published comparison. The cited material does not provide independent validation of those benchmark claims.

A one-million-token response limit expands agent workflows

Argon can reportedly generate as many as one million tokens in a single response, up from 64,000 tokens in earlier Gemini models.

Google says the larger limit allows users to complete more demanding tasks in a single step. In practical terms, developers may be able to run some large refactoring, analysis, or reporting workflows without dividing the output across as many separate turns. That operational implication is analysis, rather than a specific rationale attributed to Google.

The input context window has not been disclosed. Input context and output capacity are separate limits, so the one-million-token output figure does not establish how much source code, telemetry, or documentation Argon can examine at once.

Google says it is already using Argon for large-scale internal engineering. One project used fleet-wide telemetry to help save approximately 300 TiB of memory across Google’s data centers. MarkTechPost reports more than 300 TiB freed and projects between 500 TiB and 1 PiB, although that projection appears only in its coverage.

Argon agents are also being used to migrate C and C++ codebases to Rust. The reported work includes thousands of lines in the re2 and libgav1 libraries and more than 800,000 lines in the Fuchsia OS Zircon kernel.

For the libgav1 port, agents reportedly replaced 32,000 lines of SIMD code. The resulting decoder was said to operate 2.7 times faster while producing identical output. These remain reported internal results rather than independently reproduced measurements.

Guardrail-free use is limited to vetted participants

Trusted Fairwind defenders and Google’s internal teams receive Argon without cyber guardrails, according to MarkTechPost and SecurityWeek.

That arrangement applies to the restricted testing group. It does not describe the configuration Google says it is preparing for broader distribution.

For a wider rollout, Google says Argon will refuse requests that could enable cyberattacks or chemical, biological, radiological, and nuclear attacks. The company also says the model should continue supporting legitimate dual-use scientific research.

Additional reported measures include monitoring internal activations for possible misuse and improving resistance to indirect prompt injection. Google also says it will monitor Argon’s chain-of-thought and actions for misalignment, with the ability to stop execution when necessary.

The company further says it is isolating and sealing sandbox environments before high-risk training or evaluations begin. The reporting does not specify whether or how those sandbox measures govern tools, network connectivity, credentials, or actions during other deployments.

Organizations evaluating similarly capable agents should separately define restrictions for tool use, network access, credential handling, logging, and executable actions. Those are defensive deployment recommendations, not controls confirmed for Argon in the cited reports.

Google’s safeguards remain reported design and deployment measures. The supplied sources do not contain independent testing that demonstrates their effectiveness against malicious users, compromised external content, or other adversarial conditions.

Pricing is published, but deployment details remain incomplete

Reported introductory API pricing is $2 per million input tokens and $10 per million output tokens. Cached input receives a 95% discount, bringing its introductory price to $0.10 per million tokens.

After the introductory period, MarkTechPost says prices will increase to $4 per million input tokens and $20 per million output tokens. No end date for the introductory pricing has been provided.

For defenders outside Fairwind, there is no Argon deployment to configure yet. The healthcare disclosure also lacks the product and version information needed for targeted remediation or threat hunting.

The immediate questions are therefore about access and operational governance: which users will be admitted, what tools the model may invoke, how autonomous actions will be reviewed, and how proof-of-concept generation will be controlled.

Argon’s restricted launch reflects the dual-use problem at the center of frontier cyber models. The same system that can accelerate vulnerability discovery and patch development may also make validation and exploitation easier. Google’s phased release will be judged not only by benchmark scores, but by whether its controls remain effective once access expands beyond a vetted group.