Google stayed quiet for seven months and came back not faster but bolder
On September 30, Google released Gemini 4 Argon, its first frontier model in more than seven months. The most memorable thing that day was not how many benchmarks it topped, but how it was released: Google handed the unguarded version to vetted "trusted defenders" first.
This is not a small-model trial. Argon targets real-world software engineering, legal and finance knowledge work, and cyber defense. It raises the output cap from 64,000 tokens to 1 million, with a 1-million-token input context. For the first time, heavyweight workflows can swallow hundreds of thousands of tokens of a complex task in a single pass.
The hard numbers first
On the long-horizon software engineering benchmark DeepSWE v1.1, Argon scored 77.9 percent, a strong published result. On the vulnerability-remediation benchmark CWE-bench v1 it hit 68 percent, tied for first with GPT-6 Astra and Grok 4.7, with Anthropic's Opus 5.5 just one point behind at 67 percent. On Zapier's AutomationBench it led at 51.3 percent. The most counterintuitive line: against indirect prompt-injection attacks, Argon's success rate was only 0.7 percent, the lowest among the compared models.
Pricing follows a "cheap now, double later" pattern. The introductory rate is 2 dollars per million input tokens and 10 dollars per million output, matching Astra. After the introductory period it rises to 4 and 20, exactly doubling. Cached input gets a 95 percent discount. So it looks affordable today, but the long-run cost steps up sharply once the window closes.
The real news is the release strategy, not the board
Argon reaches trusted cyber defenders first through the Fairwind Program, which only launched in early September and already has over 650 participating partners. The crucial line: for this cohort and Google's internal teams, Argon ships without its cyber guardrails. Its ability to autonomously find, validate, and patch critical vulnerabilities went first to defenders Google considers its own side.
Google's logic is double-edged. The same ability to find a flaw lets a defender patch it or an attacker exploit it, so the gate is who you are rather than what you ask. Wiz, the subsidiary Google acquired in March, used Argon in its Scan for Good initiative to find a severe flaw in healthcare software exposing sensitive personal information across hospital systems worldwide.
Three cold showers before you follow the launch posts
First, 68 percent is a three-way tie, not a solo win. Google chose the benchmarks, the comparison models, and the settings; independent replication usually narrows the lead. And the models ran through different agent harnesses, so the scores compare model-plus-harness, not models alone.
Second, that healthcare vulnerability is a single anecdote. Google did not publish the count of findings, the false-positive rate, or the software involved, and the patch status is unclear. Read it as illustrative, not statistical.
Third, the price hike is real. The 2/10 introductory rate matches Astra, but the 4/20 switch afterward is a hard step, and the cache discount cannot save you forever. Long tasks already burn large token counts, so budget at the doubled rate.
A million-token output is a double-edged sword
A million-token output sounds generous, but long tasks re-read context every turn, so the token bill grows linearly or worse with task length. Google disclosed internally that Argon agent teams freed over 300 TiB of memory and ported up to 800,000 lines of C/C++ to Rust, which shows both the kind of long work it does and how hungry it is for tokens. Treat a per-task token ceiling as a hard metric, not just the sticker price.
What this means for you
If you run critical infrastructure or maintain widely used open-source code, ask Google about Fairwind eligibility now rather than waiting for general availability. The more realistic read is that attackers will have comparable models within months, and the defender's head start is only a temporary window. Treat "autonomous vulnerability finding" as a standing threat to defend against, which matters more than tracking leaderboard positions.