Gemini 4 Argon Removes Cyber Guardrails for Select Defenders

Google’s Gemini 4 Argon launches with cyber restrictions removed for a selected group — and the announcement does not describe how that group is chosen.

The statement that Argon ships without cyber guardrails to trusted defenders is Google’s own, in its own launch post. This publication has not seen the Fairwind Program’s selection process and does not suggest it is inadequate. The $2 and $10 per-million-token prices are introductory; footnote 1 gives $4 and $20 afterwards, with no expiry date stated. The one-million figure is an output limit, not a context window. Nothing here is investment advice.

What Happened

On Wednesday, September 30, 2026, Google DeepMind senior vice-president Koray Kavukcuoglu published the Gemini 4 Argon launch post on blog.google. One sentence carries most of the weight of the entire announcement.

That is Google’s own wording in Google’s own announcement. For the general release, the post says Argon “is designed to refuse harmful requests” covering cyber and chemical, biological, radiological and nuclear misuse, under Google’s Frontier Safety Framework. Both statements sit in the same document. Neither contradicts the other.

What has changed is where the control sits. The guardrail-free version is distributed through what Google calls the Fairwind Program. Wiz is the only named participant. The post publishes no membership criteria, no participant count, no application route, and no description of who decides or whether appeals exist.

On benchmarks, Google reports a new state of the art on DeepSWE v1.1 at 77.9 percent, first place on Zapier’s AutomationBench at 51.3 percent, and state of the art on LVBench at 91.7 percent for long video understanding. On CWE-bench v1, which measures remediating security vulnerabilities, Argon ties for first place at 68 percent — a tie, not an outright win. All of these are Google reporting its own model. None has been independently reproduced here.

The output token limit has expanded to one million, up from 64,000. That is what the model can generate in a single trajectory — not the size of the context window. The post makes no claim about context window size. Google says thousands of its own staff already use Argon for long-horizon work across software engineering, legal, and finance.

The Structural Read

The standard frontier-lab pattern constrains what a model does. Refusal training, activation filters, and output classifiers all sit at the capability level. Any user who reaches the model hits the same wall.

Argon breaks that pattern in a specific and logical way. A defensive tool that refuses to reason about exploits is not much use to the person whose job is patching them. The restriction that protects the public is exactly the restriction that makes the product useless to a defender. Google is candid about that trade-off, and candour deserves credit.

The consequence is structural. The safety property now rests entirely on who is admitted to the Fairwind Program. Not on refusal training, not on activation monitoring — on a list. That is a legitimate design choice. It is also the one thing the announcement does not describe.

This publication cannot assess a vetting process it has not seen, and does not suggest the process is inadequate. The observation is narrower: the thing now doing the safety work is the one thing the announcement does not describe.

One commitment in the safety section is genuinely unusual and deserves to be stated plainly. Google says it monitors Argon’s chain of thought and actions and stops execution when necessary. It then says it takes “careful precautions against feeding the findings back into training so as to not risk shaping Argon’s reasoning to evade our monitoring.” That is a deliberate decision to forgo a training signal in order to keep the model’s reasoning legible.

Google goes further and encourages the rest of the industry to preserve reasoning transparency. It is the most substantive line in the safety section.

The rest of the safety picture is specific: monitoring internal activations for misuse, red teaming by internal and external teams, leading results on Gray Swan’s indirect prompt injection benchmark, and sandbox hardening before high-risk training runs. Google also says it is engaged in the US government’s voluntary process for pre-release model access. Wiz used Argon through its Scan for Good initiative and, Google says, uncovered a critical vulnerability exposing personal information in healthcare software used by hospitals worldwide that previous frontier models had missed. No CVE identifier, vendor, date, or patch status is given for that vulnerability.

What It Sets Up

Three things follow, and the first is the most practical.

A security team costing Argon should anchor on $4 per million input tokens and $20 per million output, the standing rate in footnote 1. The $2 and $10 figures carry no published expiry date, so the rate confirmed to persist is the safer basis for a budget than the one confirmed to end.

The second is a product architecture rather than a product. One model, two permission tiers, and guardrails functioning as access policy rather than capability constraint. Whether other labs adopt that shape is not something this publication can say, but the shape itself is now demonstrated.

The third is a governance precedent. A frontier model with its cyber restrictions removed, distributed through a private list with no published criteria, arrives while Google is engaged in the United States government’s voluntary pre-release process. The open question is not whether Google’s vetting is adequate, which nobody outside can judge. It is whether private vetting is the right unit of analysis.

The Bottom Line

Google deserves credit for publishing the trade-off in plain language: a defensive tool that won’t reason about exploits is not a defensive tool. Argon resolves that tension by moving the safety boundary from the model to a list of admitted users. That is a coherent design. What it requires — and what the launch post does not supply — is transparency about who controls the list, how they are chosen, and who checks the checkers. Until that is public, the most consequential safety mechanism in Argon’s architecture is also the least visible one.

Source: Koray Kavukcuoglu, Google DeepMind — Gemini 4 Argon launch post, blog.google, September 30 2026. Nothing in this article constitutes investment advice.