Google has announced Gemini 4 Argon, a new frontier model aimed at long, complex work such as software engineering, finance, legal and especially defensive cybersecurity. The most eye-catching number is an output limit of up to 1 million tokens — a big jump from the previous 64,000. But Argon isn't widely available yet: Google is rolling it out to a select group of cyber defenders through the Fairwind program before releasing it to developers, enterprises and consumers.

1 million tokens — but output

This is the detail most easily gotten wrong. In its official 30 September announcement, Google says Argon raises the output token limit from 64K to 1 million — i.e. the OUTPUT ceiling within a trajectory, which should not be conflated with the input/context window.

The goal isn't simply to let the AI write longer answers. Google wants the model to have enough 'headroom' to sustain long reasoning-and-execution trajectories, potentially producing hundreds of thousands of tokens while handling complex problems.

This matters especially for agents. A typical chatbot can: ask → reason → answer. A coding/security agent can: read code → plan → find bugs → verify → fix → test → find new bugs → fix again. The question is no longer only 'how smart is the model', but how long it can sustain a complex task before the trajectory is cut. Argon is pushing that limit much further.

Google used Argon to fix its own systems

Some of Google's examples are notable. Argon agents analyzed telemetry across Google's data-center infrastructure to find memory-optimization opportunities; Google says the deployed changes freed over 300 TiB of memory, with total potential savings estimated at 500 TiB to 1 PiB.

In another project, Argon was used for C/C++-to-Rust migrations, ranging from libraries of tens of thousands of lines up to the 800,000+ lines of Fuchsia OS's Zircon kernel. Google notes that such important rewrites still go through automated testing, manual auditing and review before production.

A more concrete example is libgav1: Google says Argon agents reworked about 32,000 lines of SIMD code in a Rust port through many rounds of profiling and compiler analysis, and reported internally that the new Rust decoder runs 2.7x faster than the previous Rust port while keeping identical video output. What's notable isn't just 'AI writes code', but AI sustaining an engineering chain of analyze → experiment → measure → fix → retry.

Coding benchmark: Argon scores 77.9% on DeepSWE v1.1

Google says Gemini 4 Argon scores 77.9% on DeepSWE v1.1 — a benchmark of long, more realistic software-engineering tasks (cited as SOTA).

But the benchmarks don't tell a clean 'Argon wins everything' story. Public comparisons show it can lead on some benchmarks while trailing rivals on others (for example FrontierSWE v2 and Terminal-bench 4.0 give different results from DeepSWE). So the fairer reading is: Argon is competing at the frontier tier for long-horizon coding, rather than turning one benchmark into a verdict that it's the best coding model in every case.

But cybersecurity is what Google emphasizes most

Google says Gemini 4 Argon was trained specifically for defensive cybersecurity, able to find vulnerabilities, verify them and generate patches. That's a notable step beyond an AI security assistant that only 'reads code → flags this might be a problem'.

The direction Google describes is closer to a closed loop: from code → discover → validate → patch → verify. The AI takes part in the whole remediation chain, not just the alert.

Argon found a vulnerability earlier frontier models missed

Wiz now uses Argon in its Scan for Good program, focused on finding and fixing high-risk exposures in critical public infrastructure. Google says that in an early test, Argon found a critical vulnerability that could expose sensitive personal information in medical software used by hospitals worldwide — one that earlier frontier models had missed. Google didn't name the affected software, so one shouldn't speculate about a specific product or hospital.

68% on CWE-bench v1

On CWE-bench v1 — a benchmark for software-vulnerability remediation — Google reports Argon scored 68%, tying for the highest. Google also says the model found many kinds of exposure across complex codebases spanning 20 programming languages on an internal benchmark.

On Wiz's internal black-box penetration-testing benchmark, Google reports Argon also beat Gemini 3.8 Flash Cyber at exploring the attack surface, finding vulnerabilities and generating evidence to verify them. These internal results should be read correctly as claims/evaluations published by Google and its partner, not independent DETOON benchmarks.

Why hasn't Google given Argon to everyone?

The very strength in cybersecurity also creates a problem: a model good enough to find vulnerabilities can also become dangerous if misused. So Google is rolling Argon out in phases — currently to trusted cyber defenders via the Fairwind program, and Google is also taking part in the US government's voluntary pre-release access process for frontier models. Google says it will gather feedback and keep refining guardrails before opening it to developers, enterprises and consumers.

A special version for trusted defenders

One striking detail: Google says that for trusted cyber defenders and internal teams, Argon will be provided WITHOUT the usual cyber guardrails, to let them fully leverage the model's defensive capability. This doesn't mean a later public version will behave the same — on the contrary, Google is building multiple layers of protection ahead of a wider rollout.

Prompt injection also becomes a big problem

When AI only answers text, prompt injection is already an issue. When an AI agent can read email, open websites, use a browser, run code and change systems, prompt injection becomes far more dangerous. Google calls Argon its strongest model yet at resisting indirect prompt injection, based on the Gray Swan IPI benchmark it published, alongside measures like adversarial training, automated red teaming, behavior monitoring and sandbox isolation.

This shows that frontier-agent security is no longer only 'will the AI refuse a bad request?' but also 'can the AI be tricked by external data into doing something the user didn't ask for?'.

How much does Gemini 4 Argon cost?

Google announced introductory pricing: input $2 per million tokens, output $10 per million tokens, with cached input 95% cheaper than normal input. After the introductory period, pricing is expected to rise to $4/1M input and $20/1M output; Google hasn't stated a specific end date for the introductory rate.

And there's an interesting paradox: Argon can output up to 1 million tokens, so actually using the full 1 million output tokens at introductory pricing would be roughly $10 of output alone for that trajectory. So the ability to run very long doesn't mean every workload should.

When can developers use it?

Not widely yet — Google is rolling out first via Fairwind. The next plan is to expand to paid API customers, Google AI Ultra subscribers, enterprises and consumers after initial evaluation. No specific general-availability date has been announced.

Where does Argon show frontier AI is changing?

The most interesting thing isn't the 1-million number, but the kind of work Google uses to prove the model: not 'write a better email', but migrating hundreds of thousands of lines of code, optimizing data centers, financial research, legal drafting, finding vulnerabilities and generating patches — workloads with many steps, many tool calls, large context and long execution time.

In other words, the frontier-model race is gradually shifting from 'how hard a question can the AI answer?' to 'how hard a job can the AI sustain?'. Gemini 4 Argon is a clear example of that direction.

Frequently asked questions

  • What is Gemini 4 Argon? — Google's new frontier model for coding, enterprise knowledge work and defensive cybersecurity.
  • Does it have a 1-million-token context window? — Be careful: Google's detailed announcement confirms a 1-million-token OUTPUT limit (up from 64K), which shouldn't be conflated with the input/context limit.
  • What's special about cybersecurity? — Google says Argon can find, verify and patch vulnerabilities on its own.
  • Who can use it? — Initially a group of trusted cyber defenders via the Fairwind program.
  • How much does it cost? — Introductory $2/1M input + $10/1M output; after that, expected to become $4 and $20.
  • When will it be public? — Google hasn't announced a specific date; the rollout is phased.