Google hands Gemini 4 Argon to cyber defenders first and undercuts frontier-model pricing
On 30 September 2026, Google unveiled Gemini 4 Argon, a frontier model shipped first to cyber-defence teams in its Fairwind program, without the guardrails that will frame the public release. At $2 per million input tokens and $10 output, with output expanded to 1M tokens, it redraws the economics of frontier models — but no one outside the tester circle can verify it yet.
30 September 2026. Google announces Gemini 4 Argon, its new frontier model, and chooses to ship it first to cyber defenders in the Fairwind program rather than to the general public. 30 September 2026. The introductory price is set at $2 per million input tokens and $10 output, with cached input tokens billed at 95% off. 30 September 2026. The output window jumps from 64K to 1M tokens, a claimed industry first. Why it matters: for the first time, a frontier lab is opening its full capability — without cyber guardrails — to a population of defenders, and doing it at a price that undercuts Anthropic and OpenAI.
A launch that inverts the usual order
The standard playbook for a frontier model is developers first, then enterprises, then consumers. Google reverses the order. Gemini 4 Argon goes to the trusted testers of the Fairwind program, cyber-defence teams that will use it to find and fix software flaws before public release. Koray Kavukcuoglu, SVP of Google DeepMind and Chief AI Architect, positions the model as built for “real-world software engineering, enterprise knowledge work like legal and finance, and cybersecurity defense.”
The sequence is not cosmetic. It signals that Google is treating cyber defence as the arena where the model must prove itself before facing public comparison with GPT-6 and Claude. The model is engaged in the U.S. government’s voluntary pre-release access process, which gates availability ahead of general release — a guardrail that most rivals do not advertise as explicitly.
Numbers that raise the pricing question
The price is the most immediate argument. $2 per million input tokens and $10 output, against $10 / $50 for Anthropic’s top-tier model and a comparable grid at OpenAI. After the introductory period, the price rises to $4 / $20 — exactly the “economy” tier already occupied by Anthropic and OpenAI. In other words, the launch price places Argon below its rivals, and the lasting price places it level with them.
The deeper difference is the 1M-token output window. Where a 64K-output model must split a long reasoning task across multiple calls, Argon can emit hundreds of thousands of tokens in a single trajectory. Google frames this as a depth lever — useful for code to migrate, an audit to run end to end, or a vulnerability-remediation campaign to execute without interruption.
A model already in production inside Google
The internal examples are the strongest part of the announcement, because they are measurable. Argon agents analysed fleet-wide profiling telemetry across Google’s data centres and applied memory optimisations that freed 300 TiB, with an estimate of 500 TiB to 1 PiB once fully rolled out. On C/C++ to Rust migration, the agents reworked tens of thousands of lines in libraries such as re2 and libgav1, up to 800K lines for the Fuchsia Zircon kernel. For libgav1, the open-source video decoder, they replaced 32K lines of SIMD code with safe Rust that the compiler vectorises on its own — yielding a memory-safe decoder 2.7× faster than the existing Rust port, with identical video output.
These numbers are unverifiable from the outside, but they carry an internal coherence that benchmarks alone cannot provide. Argon also claims leading scores — 77.9% on DeepSWE v1.1, first place on the Vals index and on AutomationBench (51.3%), 91.7% on LVBench for long-video understanding, and 68% on CWE-bench v1 for vulnerability remediation. Through Wiz and its Scan for Good initiative, the model is credited with finding a critical flaw in healthcare software used by hospitals — a vulnerability previous frontier models had missed. That single result is a more concrete proof of defensive value than any benchmark table.
The real story: a frontier model without cyber guardrails
The most consequential decision is quiet in the announcement. For trusted defenders and its own teams, Google ships Argon without cyber guardrails, to grant access to its full defensive capability. It is a deliberate, reversible choice — the public release will ship with guardrails against offensive misuse, harmful science requests and hidden-instruction injection embedded in files. But it raises the question already dividing security teams: how far should an autonomous model be allowed to find, validate and fix flaws in production code, with real privileges over infrastructure.
The precedent is not neutral. A model that remediates vulnerabilities unsupervised is also a model that can apply the wrong patch, overwrite business logic, or be turned to produce an exploit before a fix ships. Google has chosen to concentrate this capability on a restricted, vetted population, but the tension between patch speed and trust in an autonomous agent will not vanish with the public release. That tension is exactly what the Fairwind phase is meant to measure — and the fact that Google is measuring it before general release, rather than after an incident, is the most encouraging signal in the announcement.
The frontier race is also a race for trust
Beyond the numbers, the Argon announcement is a strategic move. Google was widely seen as trailing in the frontier-model race, behind OpenAI’s GPT-6 and Anthropic’s Claude. Shipping Argon first to cyber defenders, inside the U.S. government’s voluntary pre-release review process, is a way to win back ground through credibility rather than hype — and to show that the model can do more than generate text.
It is also a positioning signal. A frontier model that passes first through the hands of teams protecting critical infrastructure, ahead of even paying customers, presents itself as a defensive tool rather than a consumer product. For engineering teams the consequence is practical: Argon’s value will be measured first in code audits, language migrations and vulnerability patches — arenas where reliability is observable faster than in any reasoning benchmark.
There is a further, less comfortable reading. Concentrating the un-guardrailed version of a frontier model on a small, vetted set of defenders is also a way for Google to limit the blast radius of its own capability while it learns how the model behaves in the wild. Every incident during this phase — a botched patch, a missed vulnerability, an agent that overreaches — will be contained inside a population that is contractually and operationally aligned with Google. That is prudent, but it also means the public release will inherit whatever assumptions were baked in during a quiet, low-accountability window.
Verdict
If you are a cyber-defence team, ask for access to the Fairwind program: it is the only place where Argon’s raw, un-guardrailed capability is observable today, and where its defensive value can actually be measured. If you are an enterprise, wait. The real price will be $4 / $20 after the introduction, the public release will be framed by guardrails, and Google’s internal benchmarks are no substitute for an evaluation on your own datasets. The most reliable signal is not the DeepSWE score — it is Google’s decision to run the model on its own Fuchsia kernel before selling it, a proof of trust that is already in production.