Google Limits Gemini 4 Argon to Trusted Cyber Defenders at Launch

A frontier launch with the doors half closed

Google announced Gemini 4 Argon on 30 September, positioning it as the company's most capable model for real-world coding, enterprise knowledge work, and cyber defense. The announcement from Koray Kavukcuoglu at Google DeepMind arrives a day after OpenAI's DevDay and shortly after OpenAI scrapped a planned Astra upgrade over safety findings, and it follows neither of the usual launch playbooks: most people cannot buy Argon yet.

Initial access goes to a set of trusted cyber defenders through Google's Fairwind program, alongside the US government's voluntary pre-release access process. Google says the staged rollout exists so it can verify the model is not misaligned and strengthen frontier safeguards against misuse and prompt injection before wider availability, which will begin with paid API customers and Google AI Ultra subscribers.

The benchmark claims are aggressive. Google reports a state of the art 77.9 percent on DeepSWE v1.1 for real-world software engineering, the top spot on the Vals Index across finance, coding, legal, and tax work, and an output limit raised to 1 million tokens from the previous 64,000. Introductory pricing is 2 dollars per million input tokens and 10 dollars per million output tokens, rising to 4 and 20 dollars after the introductory period.

Why security defenders got the first keys

The launch audience is not a marketing choice. Cyber defense is where Google claims Argon is most distinct: the company says the model can autonomously find, validate, and patch critical software vulnerabilities, and it ties for first on a vulnerability remediation benchmark at 68 percent. Wiz's Scan for Good program, an early Fairwind participant, already used it to surface a critical vulnerability in hospital healthcare software.

Here is the detail that will start arguments in security teams. Trusted defenders and Google's internal teams get a version of Argon without cyber guardrails, so the model's full offensive-capable capability is available for defensive work. Google is effectively betting that vetted defenders are a safer custodian of unfiltered capability than a guarded model is useful to them. For everyone else, the guarded version applies the Frontier Safety Framework's refusals for harmful cyber requests.

The safety plumbing is the real announcement

Google's post spends more words on controls than on benchmarks, which is itself notable for a flagship launch. Four layers are described: refusal training plus red-teaming for misuse, prompt injection defenses Google says lead Gray Swan's indirect injection benchmark, misalignment monitoring that watches the model's chain of thought and actions and can halt execution, and hardened sandboxed environments for high-risk training and evaluation. Google also asks the industry to preserve reasoning transparency, so model thoughts stay available for diagnosing misalignment.

That language lands one day after OpenAI's DevDay and its own scrapped Astra release, and it reads as a response to the same pressure: regulators, the public, and now the White House accord all expect frontier labs to show their safety work. For people who run models locally, the honest takeaway is that the strongest new model of the week is the hardest to get, and its rollout is now a test of whether staged access and misalignment checks become the standard way frontier capability ships.