Gemini 4 Argon goes generally available with prompt-injection defense and an intro price that doubles in late November
On October 13, 2026, Google opened Gemini 4 Argon to everyone through the API, AI Studio and Vertex AI, with outputs up to a million tokens and an introductory price of $2 / $10 per million tokens. If you are evaluating enterprise agents, test its prompt-injection resistance — a 0.7% attack success rate — before the price doubles on November 30.
October 13, 2026. Google opens Gemini 4 Argon, its multimodal frontier model, to all developers through the API, AI Studio and Vertex AI. $2 / $10. The introductory per-million-token price, valid until November 30, 2026. 0.7%. The attack success rate Argon leaves to prompt injections on the Gray Swan benchmark. Why it matters: for the first time, resistance to model manipulation becomes a headline selling point, and it arrives alongside a pricing deadline that forces the decision.
What Argon changes
Gemini 4 Argon is the new generation of the Gemini family, trained for “depth and precision” on long, multi-step tasks. Google is explicitly targeting real work: complex software builds, financial and legal matters, and cybersecurity defense through tools such as CodeMender. The model is available under the ID gemini-4-argon, across Google Cloud, AI Studio and Antigravity.
Two technical traits stand out. The first is a long output, reaching up to a million tokens, which changes what an agent can produce in a single pass — a full report, a refactor spanning hundreds of files, an analysis of entire corpora. The second is the price: $2 in and $10 out per million tokens until November 30, 2026, with a 95% discount on cached input tokens. After that date, standard pricing rises to $4 / $20 — a doubling that should be read as an incentive to test now rather than later.
The math is easy to lay out. An agent producing 100 million output tokens a month costs $1,000 at the introductory rate and $2,000 at the standard rate. For a team running several agents of that size, the difference is a budget line, not a rounding error. The 95% discount on cached input further amortizes the cost of long, reused contexts — one more reason to test before the deadline.
Concretely, a million output tokens is on the order of 750,000 words — a full-length book. An agent can therefore return an entire codebase, a complete audit report or exhaustive documentation in a single request, without slicing the task into fragments that break the reasoning. That change in granularity, more than the raw score, is what matters to teams doing long-horizon work. What remains to verify in real conditions is whether quality holds across the length of the output — the cited benchmarks cover long tasks, but your own workload deserves an end-to-end test.
Positioning matters too. The launch lands in the wake of OpenAI’s reported shelving of GPT-6.1 Astra over safety tests, and a day after Meta shipped its first frontier model, Muse Wonder. Against that backdrop, Google’s emphasis on prompt-injection resistance and “reporting negative findings honestly” is not marketing garnish — it is a bet that enterprise buyers now rank controllability alongside raw capability. Argon’s real differentiator is the claim that it stays on task and inside its boundaries, which is exactly what a security-conscious buyer should be testing.
Testing it yourself is cheap: feed Argon a document that embeds a hidden instruction and see whether it complies, then vary the phrasing — urgency, authority, a fake system message. A model that resists fifteen adaptive attempts on a benchmark may still fold on the sixteenth your red team writes; the benchmark gives you a prior, not a verdict.
The performance numbers are concrete. On the open-source ADK codebase, Argon cut in-memory session prep time by 40% and sped up cold imports by 21%, working autonomously overnight. The Chrome team used it to finish an architectural refactor across hundreds of files in the Chromium codebase — months of work compressed into weeks. Internally, Google measures 35% more agentic code submissions and nearly a third fewer rollbacks.
Prompt-injection defense becomes a selling point
The real signal, for an ETTAYEB reader, is not the reasoning benchmark — it is the weight given to the model’s own security. Google highlights that Argon “respects system boundaries, reports negative findings honestly, and pauses for confirmation before taking irreversible steps.” And, crucially, it “leads the Gray Swan Indirect Prompt Injection benchmark,” cutting attack success to 0.7% across fifteen adaptive attempts.
Why this matters: an agentic model reads emails, documents and web pages that can contain hidden instructions. Indirect prompt injection is the vector by which untrusted content hijacks the agent away from its task — exfiltrating data, sending a message, taking an action. Measured resistance at a 0.7% success rate changes the risk calculus for anyone deploying an agent that touches external sources.
The number has a precise methodology, which is what makes it comparable. The Gray Swan benchmark measures the success rate of adaptive injection attacks — attempts that adjust to the model’s defenses — across fifteen scenarios. It is not a single-pass test, but a measure of robustness against an attacker who retries. For a security team, that is the kind of metric that means something, even if it does not cover every real-world vector.
The same reflex appears on the code side. Argon ties for first place on CWE-Bench v1 with a 68% score on vulnerability remediation, and Google ships a “no cyber guardrails” version restricted to a vetted circle of defenders through the Fairwind program — a rare editorial choice that accepts offensive and defensive testing demand different constraints.
What it means for enterprise agents
The combination — long output, introductory pricing, measured defenses — is aimed first at teams building work agents. GitLab announces it is integrating the model to “bring AI into development, security, and operations.” Harvey reports “substantial” gains on agentic legal reasoning, notably in M&A and cybersecurity. ServiceNow claims 20% higher task success than Gemini 3.8 Flash in early access.
The API call stays simple, which is what speeds up evaluation. The endpoint is the same as the rest of the Gemini family:
curl "https://generativelanguage.googleapis.com/v1beta/models/gemini-4-argon:generateContent" \
-H "x-goog-api-key: $GEMINI_API_KEY" \
-H "Content-Type: application/json" \
-d '{"contents":[{"parts":[{"text":"Analyze this report and verify every citation."}]}]}'The watchpoint is the pricing window. The introductory price is a dated promotion, not a rate card: from November 30, 2026, output cost doubles. For a team sizing an inference budget on token-heavy agents, the difference between testing before or after that date is concrete — it is the cost of a pilot multiplied by two. Google chose to make the deadline explicit, which is more honest than an opaque tariff, but it does force a quick decision.
One limit remains worth holding onto: a 0.7% benchmark score is not immunity. Prompt-injection resistance is measured on precise adaptive attempts, not on the full range of vectors a motivated attacker can try. The number is a point of comparison between models, not a product guarantee.
Verdict
Evaluate Gemini 4 Argon now, but on two precise criteria rather than the benchmark of the moment. If you build agents that read external content — email, tickets, web pages — measure its prompt-injection resistance on your own cases, not just on Gray Swan: that is where Argon genuinely separates itself from its rivals. If your workload is output-token intensive, lock in your tests before November 30, 2026 to capture the $2 / $10 rate, because the jump to $4 / $20 changes the cost of a pilot. Either way, treat the announced “defense” as a claim to verify in real conditions, not a promise of immunity.