Google introduced Gemini 4 Argon the September 30, 2026 by reserving initial access to selected cybersecurity professionals by the Fairwind Program. The model shows progress on several assessments of software engineering, by agent-based work and cybersecurity, but a significant portion The results are still calculated or published by Google. Above all, the announcement marks a new phase in the governance of border models: the most sensitive capabilities can be distributed based on the user’s identity, mission, and guarantees, prior to a broader rollout.
Google is organizing a two-part launch
Gemini 4 Argon is Google DeepMind’s new state-of-the-art model. The company intends it for time-consuming software engineering tasks, professional workflows in fields such as law and finance, multimodal analysis, and cybersecurity. However, the launch does not mean the model is generally available. The first version is being distributed to a select group of cybersecurity professionals enrolled in the Fairwind program, while Google continues its evaluations and strengthens its safeguards.[1][3]
This restriction is described as temporary. Google plans to eventually open access to developers, businesses, and individuals, starting with paying API customers and Google AI Ultra subscribers. The company has not yet provided a specific timeline. The title of the announcement should therefore not be interpreted as the creation of a model that will remain permanently inaccessible to the public, but rather as a phased rollout, with the first phase prioritizing verified cybersecurity organizations.[1][8]
The announced price is already an indication of its positioning. During an introductory period—the end date of which has not been specified—the API will cost $2 per million tokens for incoming requests and $10 for outgoing requests, with a 95% discount for cached incoming requests. Google then specifies a rate of $4 for incoming requests and $20 for outgoing requests. These amounts are not sufficient to estimate the cost of an agent, as a long-running task can involve multiple calls, tools, checks, and intermediate outputs.[1]
This announcement builds on the strategy launched with Gemini 3.8 Flash Cyber, which was already reserved for defenders admitted to Fairwind. There is a key difference: Flash Cyber was a specialized, cost-effective variant, whereas Argon is positioned as a general-purpose edge model. Differentiated access is therefore not new in and of itself. It takes on a new scale by applying to Google’s most advanced model, capable of addressing multiple professional domains beyond code security.[10]
The new feature combines agentic endurance and general abilities
Google particularly highlights Argon’s ability to maintain a workflow across a large number of steps. A code agent can explore a repository, modify multiple files, run tests, analyze errors, and then resume its work. A research agent can combine documents, tables, and visual data before producing a summary. Performance is therefore no longer limited to a single response: it depends on the ability to pursue a goal, use tools, and correct intermediate steps.
The announcement raises the output limit to one million tokens, up from 64,000 previously. This is a generation limit, not to be confused with the context window alone. This capacity can support very long trajectories, but it also increases the duration, cost, and margin for error. A larger output does not guarantee the relevance of each step, overall consistency, or the success of the mission. Above all, it gives the system greater latitude to reason, act, and revise.[1]
Google reports several internal uses. Argon engineers are said to have contributed to migrations of C and C++ codebases to Rust, including Fuchsia’s Zircon kernel, which exceeds 800,000 lines of code. Other agents are said to have identified optimizations that freed up more than 300 Tio of memory in the company’s data centers, with an estimated potential ranging from 500 Tio to 1 Pio. These examples illustrate the nature of the targeted tasks, but they remain case studies published by the vendor and do not constitute independent evaluations.[1]
Technology Reference Framework
Controlled access is based on identity, permissions, and traceability
Fairwind does not function as a simple commercial waiting list. Google states that it works with more than 650 partners worldwide, but notes that only a select few are granted exclusive access to Gemini 4 Argon. The program prioritizes public cybersecurity agencies, operators of critical infrastructure, essential technology platforms, and certain academic laboratories dedicated to defensive evaluation.[3]
Applicant organizations undergo a review that focuses, in particular, on their security track record and ethical practices. Once admitted, they may grant access only to their internal cybersecurity, incident response, or penetration testing teams. They must implement single-factor authentication, phishing-resistant multi-factor authentication, access controls, and usage monitoring. Sharing, reselling, and redistributing the model are prohibited.[3]
Not all dual-use tasks are prohibited. Fairwind allows threat simulation, reverse engineering, and malware analysis when conducted within an authorized defensive or academic context. The malicious creation of harmful software remains prohibited. Google also notes that direct access to the managed model in Gemini Enterprise can support a zero-retention data policy, an important consideration for organizations handling sensitive code or incidents.[3]
This mechanism transforms access into a security component. The organization’s identity, the user’s role, the stated purpose, the available tools, and activity logs become just as important as the denials generated by the model. This architecture can reduce certain abuses, but it does not eliminate them. A legitimate account can be compromised, an authorized person can exceed their mandate, and an approved organization can implement insufficient controls. Approval must therefore be understood as the beginning of ongoing governance, not as a definitive certification.
Why This Choice Matters Beyond Cybersecurity
In cybersecurity, speed plays a particularly important role. An unknown vulnerability creates a race between its discovery, its fix, and its exploitation. By giving defenders a head start, Google aims to enable responsible organizations to secure their systems before comparable capabilities become more widespread. Argon can be used on its own or with CodeMender, Google’s agent designed to coordinate the identification and remediation of vulnerabilities.[3][4]
Google reports that Wiz is already using Argon as part of the Scan for Good initiative. The model reportedly identified a critical vulnerability that exposed personal information in healthcare software used by hospitals. This example illustrates the potential benefit of automated scanning followed by coordination with system administrators. However, it does not provide information on the total number of targets examined, the volume of false positives, or the human effort required for validation and remediation.[1]
The access model also raises a question of equity. Governments, large platforms, and critical infrastructure operators have easier access to the teams, procedures, and budgets needed to meet Fairwind’s criteria. Small communities, local hospitals, nonprofit organizations, and small publishers, however, may be particularly vulnerable. Google offers these entities CodeMender with public templates and other security products, but they do not necessarily have the same level of capacity.[3]
The decision to allocate capacity thus becomes a form of private governance. The provider defines the admission criteria, permitted uses, priority organizations, and the timing of access. This flexibility can enable a faster response than formal regulation. It also concentrates significant power in the hands of the company developing the model. Transparency regarding criteria, rejections, revocations, and incidents is therefore essential for assessing the legitimacy of the system.
What the results actually allow us to conclude
The published results show measurable improvement across several tasks. They do not demonstrate overall superiority. Google’s evaluation document specifies that Argon scores are obtained using the highest reasoning setting, unless otherwise noted. Most correspond to a single run, while the smaller benchmarks are averaged over multiple runs. The figures for competing models generally come from their vendors and therefore are not always based on a strictly identical protocol.[2]
DeepSWE v1.1 is a challenging benchmark consisting of 113 original tasks covering 91 repositories and five programming languages. Its problems are written specifically for evaluation and are not included in public repositories, which reduces the risk of caching known fixes. Argon’s score of 77.9% is, however, calculated by Google using its own system. The public ranking consulted did not necessarily show the same value yet, so it is advisable to wait for an official integration and comparable reproductions.[2][9]
The cyber results call for the same caution. CWE-bench v1 is the most directly comparable metric, since it comes from the benchmark’s public rankings. Argon scores 68% there, tying with GPT-6 Astra and Grok 4.7 in the published table. The gains from Wiz’s real-world vulnerability discovery and penetration testing are more difficult to replicate, as the datasets are internal and the full environments are not publicly available.[2][4]
Finally, the lack of a complete model card limits interpretation. As of October 4, 2026, Google DeepMind’s public catalog of model cards listed Gemini 3.8 Flash but not yet Gemini 4 Argon. The evaluation paper provides useful details on the benchmarks, but much less information on the data, known limitations, detailed safety assessments, or distribution terms. A follow-up publication would be necessary to assess the model’s true scope.
Controlling access is not enough to manage risk
Google says it is strengthening four categories of protections ahead of the general release: prevention of harmful uses, resistance to indirect injections, detection of misaligned behavior, and hardening of execution environments. The company states that it uses internal and external testing teams, as well as a system capable of monitoring Argon’s reasoning and actions to halt execution when it deviates from the user’s intent. This approach is part of the Frontier Safety Framework, which distinguishes between monitored and critical capability levels in order to tailor assessments and risk mitigation measures.[1][5]
These mechanisms address real risks. An agent analyzing a web page, a ticket, or an issue may encounter a malicious instruction hidden within the data. A user authorized to run tools can then turn a misinterpretation into action. Security therefore depends on several layers: environment isolation, least privilege, separation of duties, approval of critical operations, logging, and the ability to quickly revoke permissions.
However, monitoring reasoning raises its own questions. Google has not yet released enough information to determine what data is being recorded, how alerts are evaluated, how many false positives are generated, or how an organization can challenge a suspension. Operational transparency should not reveal the mechanisms to the point of making it easy to circumvent them, but it should allow authorized users and competent authorities to assess their effectiveness.
In the United States, Google states that it is participating in the government’s voluntary early access process. The presidential executive order of June 2, 2026, calls for the creation of a framework allowing developers to provide secure access to certain foundation models up to thirty days before they are released to other trusted partners. The text specifies that it does not establish a mandatory government license or a prior authorization procedure. It is therefore a voluntary cooperation mechanism, not a public certification of Gemini 4 Argon.[6]
In the European Union, the requirements for general-purpose AI models have been in effect since August 2, 2025. These requirements pertain, in particular, to technical documentation, copyright, and the publication of a summary of training data. Models posing a systemic risk are subject to additional requirements regarding notification, assessment, risk mitigation, incident reporting, and cybersecurity. The publicly available information alone does not allow for a conclusion regarding Argon’s precise legal status, particularly because Google does not disclose the training data required for such a determination.[7]
A final issue concerns the hardware footprint. An output of up to one million tokens and long computation paths potentially require more processing power. Google does not disclose energy consumption or carbon footprint per mission in the documents reviewed. It would therefore be premature to quantify Argon’s environmental impact. Organizations should nevertheless assess the full cost of a task, limit unproductive loops, and reserve high levels of effort for problems that warrant it.
What to Watch for Now
The first issue will be that of independent reproduction. Scores for software engineering, professional work, and cybersecurity will need to be validated using comparable test suites, documented budgets, and variance metrics. For security patches, it will be necessary to examine whether the root cause has been corrected, as well as regressions, false positives, and robustness against variants of the vulnerability.
The second question will concern the phased rollout. We will need to verify whether the version offered to API customers and Google AI Ultra subscribers has the same capabilities as the one distributed to Fairwind partners without cybersecurity safeguards. The differences between models, rejection policies, and available tools must be clearly stated. Without this transparency, the single name “Gemini 4 Argon” could mask multiple levels of capability that are difficult to compare.
The third question will focus on Fairwind’s governance. The number of partners alone is not sufficient to evaluate the program. Key indicators will include admission criteria, processing times, audits, incidents, revocations, and effective access for organizations with fewer resources. A defensive advantage has collective value only if it helps protect critical infrastructure without creating excessive dependence on a small number of suppliers.
Gemini 4 Argon thus represents both a measurable technological advancement in the published protocols and an expansion of controlled access to frontier models. The available evidence does not yet allow us to establish general superiority or proven security in all environments. The most lasting change may be institutional: as capabilities become more sensitive, the central question will no longer be merely what a model can do, but who can use it, with what rights, what obligations, and what external oversight.
To learn more
For more in-depth information on the distribution of sensitive capabilities, agent governance, and the transformation of cyber defense, check out these additional analyses from the aivancity blog.
Sources
[1] Google. (September 30, 2026). Introducing Gemini 4 Argon. View source
[2] Google DeepMind. (October 2026). Gemini 4 Argon Model Evaluation: Approach, Methodology, and Results. View the report
[3] Google DeepMind. Fairwind Program. Accessed October 4, 2026. View source
[4] Google DeepMind. Gemini 4 Argon with cybersecurity defense capabilities. Accessed October 4, 2026. View source
[5] Google DeepMind. (April 17, 2026). Strengthening our Frontier Safety Framework. View source
[6] White House. (June 2, 2026). Promoting Advanced Artificial Intelligence Innovation and Security. View source
[7] European Commission. General-purpose AI obligations under the AI Act. Accessed October 4, 2026. View source
[8] Peters, J. (September 30, 2026). Google announces Gemini 4 and says only trusted cyber defenders can have it right now. The Verge. View the article
[9] Huang, W. et al. (July 2026). DeepSWE: Measuring Frontier Coding Agents on Original, Long-Horizon Engineering Tasks. View the study
[10] Google. (September 2, 2026). Introducing Gemini 3.8 Flash and 3.8 Flash Cyber. View source