Google announced Gemini 4 Argon on September 30, 2026, its most powerful model to date, and almost nobody can use it. The model shipped first to a vetted cohort of cybersecurity defenders through Google's Fairwind Program, with paid API customers and Google AI Ultra subscribers queued behind them and no public release date. Argon matters less for what it can do on a coding benchmark than for how it reaches the market: it is one of the clearest examples yet of frontier AI moving from open consumer launches to trust-gated, tiered distribution, where access to the most capable systems is decided by who you are and what you are allowed to do with them.
What Google actually announced
Argon is the first model in Google DeepMind's Gemini 4 generation and the first Gemini to carry a codename instead of the Pro, Flash and Flash-Lite tier labels the company has used for years. Koray Kavukcuoglu, SVP of Google DeepMind, introduced it as a frontier model built for long-horizon work: real-world software engineering, legal and financial knowledge work, and defensive cybersecurity (DataCamp).
The headline capability change is output length. Google raised Argon's output token limit to 1 million tokens, up from a previous cap of 64,000. The input context window was not published. Some outlets have reported a 1 million token input window, but NeuralTrust notes it could not match that figure to a Google source and treats it as unconfirmed. The output ceiling alone is a step change: it lets the model carry a plan across a long, tool-heavy task without truncating its own work.
Google told Reuters that Argon is "our most performant model yet built for complex workloads, and we see it comparable to frontier models like (OpenAI's) Astra and (Anthropic's) Opus on key coding and cyber benchmarks" (Reuters). The company also said it has joined the Trump administration's voluntary pre-release review process for advanced models.
The launch is real, but it is not a drop-in model= string. On September 30 there was no published public API model ID, and Argon was absent from OpenRouter, Vertex AI, the Gemini CLI, Cursor and GitHub Copilot (DataCamp). Engineering teams cannot move production traffic to it yet. Security teams are the exception.
The Fairwind Program: who gets Argon first
Fairwind launched on September 2, 2026, as what Google called "a limited access program for governments and trusted partners to use our cyber defense tools." It started with Gemini 3.8 Flash Cyber paired with Google's CodeMender agent. Google says it has more than 650 participating partners globally, with priority for governments and national cyber authorities, critical infrastructure operators such as healthcare, telecommunications, energy and financial networks, and core technology platforms. Academic labs focused on defensive benchmarking can also apply (WorkOS).
Argon is now the program's exclusive model, usable standalone or inside CodeMender. Access narrows at every ring: the wider market waits for a guardrailed release, more than 650 vetted partner organizations sit inside that, and within each partner only specific internal teams can reach the model. As WorkOS put it, the population narrows at every ring and each ring is a check somebody has to implement.
The guardrails-off build is the real story
The detail that separates this launch from a standard staged rollout is that the defenders receiving Argon first get it without its cyber guardrails. From Google's announcement: "For trusted defenders and our own internal teams at Google, we'll be releasing Argon without cyber guardrails so they can leverage its full frontier-level cybersecurity defense capabilities."
Unguardrailed Argon and guardrailed Argon are the same model with different refusal behavior. Cyber Kendra framed the tension plainly: Google's safety section says Argon is designed to refuse requests that help with cyberattacks, while the same post confirms those refusals are switched off for the first recipients. Granted to the wrong tenant, that is a frontier-grade vulnerability discovery engine with the refusals turned off.
The performance stakes are high. According to figures Cyber Kendra reported, Argon scores 85.8% on vulnerability discovery against 71.0% for Gemini 3.8 Flash Cyber, and 70.9% on penetration testing against 58.2%. Google says the model tied for first on CWE-bench v1 at 68%. Wiz is among the first partners, deploying Argon through its Scan for Good initiative, which provides free security scans of critical public infrastructure. In an early test, the model identified a vulnerability exposing personal information in healthcare software used by hospitals worldwide, one that previous frontier models had missed (Quartz).
Tulsee Doshi, Gemini model product lead, told CNBC: "We really believe that a model of this caliber and this level of frontier performance is meaningfully important for defenders."
Pricing and the output-token jump
Google set an introductory price of $2 per million input tokens and $10 per million output tokens, rising to $4 and $20 after the introductory period. Cached input tokens carry a 95% discount, landing at $0.10 per million. Google has not said how long the introductory price lasts (NeuralTrust). At standard rates, Argon matches Claude Opus 5.5 on sticker price.
Sticker price is only part of the bill. Artificial Analysis measured a cost per average task of $1.99 for Argon, against $3.26 for GPT-6 Astra and $5.98 for Claude Opus 5.5. The same run shows Argon used 110 million tokens to complete the index against a median of 82 million, so the model's verbosity eats into its apparent savings. Google also has not said how reasoning tokens are billed, which matters for agentic workflows where reasoning tokens dominate the bill.
Benchmarks: where Argon leads and where it trails
Google's vendor-reported numbers put Argon ahead on DeepSWE v1.1 at 77.9%, the Vals Index at 68.9%, AutomationBench at 51.3%, Harvey's Legal Agent benchmark at 19.6%, and long-context retrieval on GraphWalks (256K to 1M) at 84.2%. It also reports 91.7% on LVBench for long video understanding (DataCamp).
The pattern is specific. Argon leads on long-horizon software tasks, legal and finance work, long-context retrieval and business automation. It trails where agents work in a terminal or across a large codebase: a roughly 10.5-point gap to GPT-6 Astra on FrontierSWE v2 (55.0% versus 65.5%) and a 9-point gap to Claude Opus 5.5 on Terminal-Bench 4.0 (57.4% versus 66.4%). Reuters confirmed the model did not lead on every measure, finishing behind rivals on two of the four coding benchmarks cited in Google's own release documentation.
Independent boards tell a mixed story. Artificial Analysis scores Argon 52.6 on its Intelligence Index, below Claude Opus 5.5 at 57.6 and roughly level with GPT-6 Astra at 52.7. Vals ranks it first of 41 models on its index at 68.9%. The honest summary is a strong but uneven model. Crucially, no third party had reproduced Google's benchmark table at launch, and Google says Argon leads Gray Swan's indirect prompt injection benchmark without publishing a score, so enterprises should run their own tests rather than trust the headline claims.
What Argon is already doing inside Google
Google is not waiting for external adoption to prove the model's utility. It says internal teams have applied Argon to memory optimization across the company's data centers, freeing more than 300 terabytes of memory, and to migrating large codebases from C and C++ to Rust. Quantum computing researchers have also used it to optimize algorithm efficiency, beating a published baseline by 40% in one case (Quartz).
Those are concrete, verifiable-in-principle workloads: memory reclamation, language migration and algorithmic optimization. They are also exactly the long-horizon, tool-heavy tasks Argon was positioned around, and Google is using them as an internal proof point while the model stays gated.
Reading Fairwind as an access-control spec
The most reusable artifact from this launch may not be Argon itself but Fairwind's governance page, which reads like an authorization specification for capability. Google runs background checks on applying organizations to verify their security history and record of ethical operations. Participating organizations agree to user-level authentication, phishing-resistant MFA, and applicable access controls. They may only grant Argon access to internal cybersecurity, incident response or penetration testing teams, and must track employee access and use. Partners cannot share, redistribute or sell access, and the grant covers only authorized threat simulation, reverse engineering and malware analysis for defensive and academic research (WorkOS).
Every clause maps onto an identity primitive: organization verification, org-level MFA enforcement, role-scoped permissions, audit logs with real actor context, entitlements bound to the verified organization, and scope restrictions on what the entitlement authorizes. Google does not present it that way, but the gate in front of each model call has to check that the organization is verified, holds the right entitlement, authenticated with a phishing-resistant factor, and belongs to an allowed team.
The design has gaps, and they are the familiar ones. Vetting is point in time: a partner that passes diligence this month and suffers a ransomware attack next year still holds its grant, and Google has not described what triggers a re-review. Organization granularity does not match misuse granularity, which is why Google stacks per-user MFA, team restriction and usage tracking on top of the org check. And the perimeter is opaque: Google has not published a list of Fairwind participants, so a partner cannot evaluate the trust boundary it just joined. Argon does support zero data retention when accessed through Gemini Enterprise, which gives enterprises a compliance lever.
Why this matters for the frontier model market
Gemini 4 Argon lands against a backdrop of months of delays. Google scrapped internal candidates for a Gemini 3.5 Pro model after they failed to show a sufficient improvement over the Flash series, and has confirmed it no longer plans to release Gemini 3.5 Pro at all. The delays came alongside leadership changes at Google DeepMind, where co-founder Demis Hassabis stepped aside as chief executive and several Gemini model leaders departed. Google has also shifted its messaging from touting cutting-edge capability to highlighting cost advantage (Reuters).
Against that, Argon's launch model is the more consequential signal. Instead of a broad consumer debut, Google chose defenders first, trusted partners next, and everyone else once the guardrails hold. That inverts the usual pattern, where the newest model is the most freely available and only enterprise features are gated. If it holds, frontier capability becomes something you qualify for rather than something you sign up for, and the qualification criteria become a de facto policy layer over who gets to use the most powerful systems.
For developers and engineering teams, the practical advice is to plan for a gated Argon rather than assume a public API route is imminent. There is no stable model ID, endpoint contract or SDK migration guide yet. Teams that expect to consume frontier models through paid API tiers should watch how Google handles the transition from Fairwind to general availability, and whether the guardrailed build performs as well as the unguardrailed one the defenders receive. The gap between those two builds, and who is allowed to cross it, is the part of this launch worth tracking.