Google announced Gemini 4 Argon on Wednesday and said it is beginning a limited rollout to trusted cybersecurity defenders through its Fairwind Program, not a general release. The decision gives selected defenders early access to a model Google says can find, validate and patch software vulnerabilities while it develops safeguards for wider use.
Google says developers, enterprises and consumers will follow, starting with paid API customers and Google AI Ultra subscribers. It has not given a date for broader access or named the organizations receiving Argon through Fairwind.
An outside test offers a narrower measure of the model’s usefulness: Vals AI ranked Argon second among 44 models on a security benchmark. That result measures performance on test tasks, not whether Argon can reliably protect software in use.
Defenders before paying customers
Google introduced Fairwind on Sept. 2 as a limited-access cyber-defense program for governments and trusted partners. Its initial offerings included Gemini 3.8 Flash Cyber and CodeMender. Argon’s rollout uses that existing program rather than opening the model to anyone who wants to try it.
Google says Fairwind participants and its internal teams receive Argon without cyber guardrails. The company also says it is developing safeguards against misuse, along with monitoring and secure testing environments, before wider access. It has not specified the access conditions or reporting obligations for Fairwind participants.
The company’s announced introductory API rates are $2 for a million input tokens and $10 for a million output tokens. Google has not said when paid API customers can use Argon.
Google also says Argon can generate up to 1 million output tokens, compared with 64,000 for earlier Gemini models. The larger stated limit describes how much text it can produce, not whether a security finding or proposed fix is correct.
What the security tests show
Vals AI’s independently run CyberBench v1.1 measures performance on finding and patching security bugs. Its published results put Argon at 77.86%, second among 44 models and 0.12 percentage points behind GPT-6 Sol. This is an external evaluation, unlike the security results Google reports from its own testing.
CyberBench is still a benchmark. Its ranking does not show how often Argon would find consequential flaws in a particular organization’s software, whether its proposed patches would pass that organization’s review or how it would perform in a live defense operation.
Google reports a 68% result on CWE-bench v1, a vulnerability-remediation test, which it says ties for first. It also says internal tests showed improvements over Gemini 3.8 Flash Cyber in vulnerability discovery and black-box penetration testing, which probes software without access to its internal workings. The results in Google’s announcement have not been independently reproduced there.
Free newsletter
Get the morning briefing
Start each day with the AI stories that matter and why — a short, free email from our newsroom.
As an example outside those scores, Google says its Wiz subsidiary used Argon in Scan for Good to identify a critical flaw in healthcare software used by hospitals worldwide. Google says the flaw exposed personal information. Its account does not include independent documentation of the finding or establish whether the vulnerability has been fixed.
That distinction matters to defenders considering early access. A benchmark result supports a claim about performance on defined tasks; Google’s reported healthcare finding points to a possible practical use. Neither establishes, on the available evidence, a verified record of Argon securing deployed systems.
Safeguards and the unanswered rollout questions
Google says Argon is its most resilient model yet against indirect prompt injection, in which instructions hidden in material a model reads redirect its behavior. It says monitoring can track the model’s activity and stop execution when needed. The company’s rollout announcement does not provide independent test results for those safeguards.
Google says it is still strengthening misuse prevention, prompt-injection defenses, monitoring and secure testing environments before wider access. Giving selected defenders a version without cyber guardrails puts weight on who is admitted to Fairwind and what oversight applies. The company has not detailed those arrangements for Argon’s initial users.
A separate episode illustrates why model testing needs care, without establishing anything about Argon itself. Axios reported on Sept. 19 that Google confirmed three incidents in May during third-party-run testing in which a Gemini model accessed companies’ systems. Axios did not identify that model as Argon; those incidents cannot be treated as Argon failures.
Google also says it is participating in a voluntary U.S. government pre-release model-access process. That is not a government certification or endorsement of Argon’s safeguards.
The practical questions now are which defenders receive access, under what conditions, and what their use reveals about finding and fixing vulnerabilities in working software. Google has supplied no date for paid API customers or Google AI Ultra subscribers, and no independent account of Argon’s results in live defense operations.