Google's Gemini 4 Argon ties the AI frontier on points. It's shipping first to cyber defenders, guardrails off

Google released its newest flagship model, Gemini 4 Argon, on September 30 -- and the first people with real access to it are not Google AI Ultra subscribers or paying API customers. They're vetted cybersecurity defenders inside more than 650 organizations enrolled in Google's Fairwind Program, and Google is handing them a version of Argon with its own cyber guardrails switched off.

The Fairwind Program itself isn't new -- Google built it earlier this year to get vetted "high-priority defenders" (governments, healthcare providers, telecoms) early access to frontier capability before general release. Argon is simply the newest, and most capable, model Google has decided belongs there first. Google says that in testing, Argon caught a critical vulnerability in hospital software used worldwide that earlier frontier models had missed -- though it has not named the software, the vendor, or published a CVE confirming the find.("Trusted defender" is Google's own vetting category -- it doesn't denote any formal government certification.)

On Artificial Analysis's Intelligence Index -- the independent benchmark aggregate tracked on the Scoreboard, as opposed to a vendor's own claims -- Argon scores 53 points at its high-reasoning setting. That ties it with OpenAI's GPT-6 Astra and Anthropic's Claude Fable 5.1, puts it one point ahead of GPT-6.1 Sol, and leaves it five points behind the category leader, Claude Opus 5.5, at 58. Google's own launch language calls Argon "our next era of frontier intelligence" -- on the one number every lab's flagship gets held to, Argon actually arrives in a three-way tie for second.

Argon's sharper edge shows up somewhere narrower: on AA-Omniscience, Artificial Analysis's hallucination test, Argon scored a 15% error rate -- the lowest of any model above 45 points on the Index, against GPT-6 Astra's 51% and GPT-6.1 Sol's 54%. For a model Google is deliberately routing toward cybersecurity defense -- patch validation, vulnerability triage, decisions where a confident wrong answer is actively dangerous -- a measured hallucination rate a third of its nearest tied competitor's may matter more than the tied headline score.

Argon's price looks aggressive on its face: $2 per million input tokens and $10 per million output tokens during Google's introductory period, rising to $4/$20 once that ends, with a 95% discount on cached input. That undercuts GPT-6 Astra's $10/$50 list price outright. But Artificial Analysis's own task-level accounting complicates the "cheaper" framing: Argon used an average of 62,000 output tokens to complete the same benchmark tasks that GPT-6 Astra finished in about 27,000. A roughly 2.3x gap in tokens consumed per task erodes most of the per-token price advantage before a customer's actual bill gets calculated.

Google's own benchmark claims for Argon go further than the independent Index: the company says Argon scored 77.9% on DeepSWE v1.1, a long-horizon software-engineering benchmark, and tied for first at 68% on CWE-bench v1, a vulnerability-remediation test. Argon's output limit also jumped to 1 million tokens, up from the 64,000-token ceiling on Google's prior generation -- headroom a model doing multi-step vulnerability triage across a large codebase actually needs, rather than a number chosen to look good on a spec sheet. None of those three figures comes from an independent evaluator the way the Intelligence Index score does.

What's actually established, versus what Google says

Argon's security design leans on several layers Google describes in its own launch materials: internal activation monitoring meant to flag misuse, chain-of-thought monitors that watch Argon's own reasoning and actions and can halt execution mid-task, and sandboxed environments for the highest-risk evaluations. Google also says Argon leads Gray Swan's independent benchmark for resisting indirect prompt injection -- attacks that hide instructions inside content a model reads rather than commands a user types -- though the company cites that result in its own announcement rather than linking Gray Swan's published leaderboard entry directly.

“Frontier performance in complex workflows across real-world software engineering, enterprise knowledge work like legal and finance, and cybersecurity defense.” -- Koray Kavukcuoglu, SVP, Google DeepMind

Argon's staged rollout fits a pattern that looks increasingly like the norm for the riskiest tier of frontier releases, not the exception. Anthropic's Claude Mythos 5.1 shipped in September restricted to the company's own cybersecurity and life-sciences trusted-access programs, with no independent score yet because most evaluators still can't query it at all. Google handing its newest flagship to outside defenders with the guardrails *removed*, rather than holding it back from everyone, is the more unusual bet of the two: it wagers that the defensive upside of wide, early, unrestricted access outweighs the risk of putting an uncaged frontier model into more than 650 outside organizations' hands before the general public gets any version of it at all. Whether that bet pays off is not yet knowable from the outside -- it depends entirely on what those 650-plus organizations actually do with an uncaged frontier model, and Google has given no indication it plans to publish a running account of that.