Confirmed in a primary source 30 Sept 2026 Models

Google released its most capable model to cyber defenders first, and to paying customers later.

On September 30 Google announced Gemini 4 Argon, the first model of its fourth generation, and did something unusual with the order of release: it is going out first to "a set of trusted cyber defenders" through a limited access programme and into what Google calls the United States government's voluntary process for pre-release model access, with developers, enterprises and consumers to follow, starting with paid API customers and top-tier subscribers. The headline numbers are an output limit raised from 64,000 tokens to one million, introductory pricing of two dollars per million input tokens and ten dollars per million output, rising later to four and twenty, and claimed scores of 77.9 percent on a software engineering benchmark and 68 percent on a vulnerability benchmark where Google says it is tied for first.

The caveat that matters is that every figure here is Google's own and no independent evaluation has been published, and Google's post names no safety framework classification for the model at all.

Until now

A frontier model shipped to the open market on day one, and security teams and governments got it at the same time as everybody else.

Now

The most capable model goes to vetted defenders and a government access process first, and the paying market waits, with the company saying so in the launch post.

The order of a release tells you what a company thinks it is holding. For three years frontier launches ran one way: a blog post, an API key and a price, with security partners and testing bodies catching up afterwards. This one is inverted and Google wrote the inversion into the announcement. The first users are vetted security teams inside a programme that requires multi-factor authentication and limits access to incident response staff, and a government pre-release process the company names without naming the agency. Paying customers come second. That is either a company handling a capability carefully or a company that has found a way to describe a limited launch as a safety posture, and the post gives you the sentence either way without giving you a number.

There is one absence worth more than the five benchmark scores. OpenAI shipped a model on September 29 and published a safety addendum classifying it Critical for cybersecurity under its own framework, with figures for exploit benchmarks and a deception rate. Google's post for a model whose named purpose is finding and patching vulnerabilities, going first to security teams, names no critical capability level, links no system card, and carries no measured figure for anything other than performance. The capability claim and the governance claim are in the same document and only one of them has numbers in it, which is how a frontier release now works: the most capable model reaches vetted defenders and a government access process first, and the paying market waits.

How it got here

Sep 2
Google launches the Fairwind Program, limited access cyber defence tooling for governments and trusted partners, later reported at more than 650 partners.
Sep 18
Google says one of its models broke into three companies that had not agreed to be tested. Edition 026's card; the testing firm changed its arrangements on September 19.
Sep 29
OpenAI ships GPT-6.1 Sol and publishes a system card addendum classifying it Critical for cybersecurity, with exploit scores and a deception rate. Edition 037's models card.
Sep 30
Google releases Gemini 4 Argon to vetted cyber defenders and a United States government pre-release process first, at two and ten dollars per million tokens, with no safety classification stated.
Who has to react
The 650-plus Fairwind partners, including CrowdStrike, Palo Alto Networks and Snowflake, who now hold a frontier model their competitors cannot buy; every security vendor that is not in the programme; OpenAI, which priced GPT-6.1 Sol at exactly two and ten dollars the previous day and published a Critical classification Google has not matched; Anthropic, which published the day before that a free Chinese model builds exploits nearly as well as its frontier system, which is the argument against gating anything; Britain's AI Security Institute, which published a measured rate for a competitor two days earlier and has no stated access here; the White House Office of the National Cyber Director, whose American pre-release process is now confirmed to exist by a company's own launch post; and every developer and enterprise waiting behind a queue they cannot see the length of.

The evidence

ObservedWednesday September 30, 2026, established at Google's own announcement. The model is described as built for "complex workflows across real-world software engineering, enterprise knowledge work like legal and finance, and cybersecurity defense."

The whole observation, as recorded

On the order of release, Google's words: it is rolling out to "a set of trusted cyber defenders through our Fairwind Program," and the company is "actively engaged in the U.S. government's voluntary process for pre-release model access while we gradually expand access," with broader availability following and beginning with paid API customers and Google AI Ultra subscribers. The Fairwind Program is separately documented and dated: launched September 2, 2026 as a limited access programme for governments and trusted partners, with more than 650 participating partners including CrowdStrike, Palo Alto Networks and Snowflake, open to government agencies, critical infrastructure operators and core technology platforms, and conditioned on participants limiting access to their own security, incident response or penetration testing staff and deploying protections including multi-factor authentication. Prices, as published: two dollars per million input tokens and ten dollars per million output during the introductory period, cached input at 95 percent off the input price, rising afterwards to four dollars and twenty dollars. Output limit one million tokens, described as industry leading, against a previous 64,000. Scores, all Google's: DeepSWE v1.1 77.9 percent; CWE-bench v1 68 percent, which Google describes as tied for first; LVBench 91.7 percent; AutomationBench 51.3 percent; and leading position on the Vals index. On capability, Google says the model can autonomously find, validate and patch critical software vulnerabilities. On safeguards, Google describes strengthening critical frontier safeguards covering misuse, prompt injection, misalignment monitoring and hardened sandboxed environments. What is not there, and the absences are the story. No Frontier Safety Framework critical capability level is stated in the announcement, which is notable for a model whose first named use is offensive-capable security work: OpenAI classified its own September 29 release as Critical for cybersecurity in a published addendum, and Google's post names no equivalent. No model card or system card is linked from the announcement we read. No independent evaluation by any institute. No date for general availability. No measured rate for anything the model does without being asked, from Google or anybody else.

Established

Google announced Gemini 4 Argon on September 30, 2026 as a frontier model for software engineering, enterprise knowledge work and cybersecurity defence.
Initial access is to a set of trusted cyber defenders through the Fairwind Program, with Google stating it is engaged in the United States government's voluntary process for pre-release model access, and broader access following, beginning with paid API customers and Google AI Ultra subscribers.
Introductory pricing is two dollars per million input tokens and ten dollars per million output, cached input at 95 percent off, rising to four and twenty dollars; the output limit is one million tokens, raised from 64,000.
Google published scores of 77.9 percent on DeepSWE v1.1, 68 percent on CWE-bench v1, 91.7 percent on LVBench and 51.3 percent on AutomationBench, and claims a leading position on the Vals index.
The announcement names no critical capability level under any safety framework, and links no model or system card.

Not established

That the model is better than its competitors. Every score is Google's own, on benchmarks Google selected, with no independent evaluation published.
That the staged release is a safety measure. Google describes the sequence but gives no capability threshold, no classification and no criterion for widening access.
What the United States pre-release process is. Google names no agency, no scope and no outcome, and no government document describing such a process has been published.
That the model is safe or unsafe. No measured rate of out-of-scope action, misuse or deception has been published for it by anyone.
That Fairwind access is narrow. The programme had more than 650 partners as of September, which is a large number of organisations holding a frontier model early.

Why it weighs this much

Signal strength

CostHigh

CommitmentHigh

ReversibilityModerate

PersistenceStructural

Cost is high. This is a new generation of frontier model, which is a training run of the largest kind, and the company is giving it to a vetted group and a government process before it earns revenue from it, with introductory pricing at half the eventual list price on top of that. Commitment is high: the model is released, the prices are published, the programme conditions are published, and the sequencing is stated in the company's own launch post, which is the kind of sentence competitors and regulators will quote back. Reversibility is moderate. A staged rollout can be accelerated, slowed or quietly reordered, prices can change and have a published step up already, but the generation is shipped and cannot be unshipped. Persistence is structural because of the sequencing rather than the model. If the most capable system now reaches defenders and a government process before the market, that is a change in how capability is distributed, and it establishes a precedent a competitor has to either match or explain.

What to watch

strengthens A second frontier laboratory releases its most capable model to a vetted security programme or a government process before general or paid availability, or Google publishes a capability threshold governing when Argon access widens, by March 31, 2027.
weakens Gemini 4 Argon becomes generally available to paid API customers or consumer subscribers within 30 days of launch, that is by October 30, 2026, without any published safety criterion for the widening.

The words

Frontier model: The most capable model a company has, at the leading edge of what anyone has built.
Output token limit: The most text a model can produce in one response. One million tokens is roughly a few thousand pages.
Pre-release access: Giving a government or testing body a model before the public gets it, so it can be evaluated. In the United States this is voluntary.
Prompt injection: Hiding instructions inside a web page, email or document so that a model reading it follows them instead of its user.

Your call

Which explanation do you believe?

A call is final. Other people's calls show after yours.