Gemini 4 Argon, a model released in stages

Defenders first

Google announced Gemini 4 Argon on 30 September 2026.¹¹1Koray Kavukcuoglu, Google, "Gemini 4 Argon: our next era of frontier intelligence", 30 September 2026: rollout to trusted cyber defenders through Fairwind; participation in "the U.S. government's voluntary process for pre-release model access", agency not named; next stage "starting with paid API customers and Google AI Ultra subscribers", "rolling out soon"; release without cyber guardrails to trusted defenders and internal teams; refusal of harmful cyber and CBRN requests and support for dual-use research; internal and external red teams; improved monitoring of internal activations; Wiz result without numbers; CWE-bench "tied for first"; DeepSWE v1.1 at 77.9%, AutomationBench at 51.3% and ranked first, LVBench at 91.7%; libgav1 in safe Rust, 2.7 times faster, "closer to the optimized C++"; C and C++ to Rust migration including the Fuchsia Zircon kernel of more than 800,000 lines; "over 300 TiB of memory once rolled out" and an estimate of 500 TiB to 1 PiB; the quantum baseline beaten by 40% "in a matter of minutes"; output window from 64K to 1M tokens; misalignment monitors, findings kept out of training, monitoring of training runs, sealed sandboxes; later rates of $4 and $20 per million tokens, without a date. https://blog.google/innovation-and-ai/models-and-research/gemini-models/gemini-4-argon/ The launch post was written by Koray Kavukcuoglu, who signs as a senior vice president of Google DeepMind and as Google's chief AI architect.¹¹ On launch day the model went only to a set of trusted cyber defenders, through a program Google calls Fairwind.¹¹

The launch post says Google is also taking part in "the U.S. government's voluntary process for pre-release model access".¹¹ It does not name the agency that runs that process, and it does not link to it.¹¹

The same post named developers and enterprises as the next stage, together with consumers. That stage was to start "with paid API customers and Google AI Ultra subscribers".¹¹ The post gave no date for that stage. It said only that the model was "rolling out soon".¹¹

The launch post also set out who would receive Argon without cyber guardrails. Those were the trusted defenders in Fairwind and Google's own internal teams.¹¹

The wider release came on 13 October 2026. That day the Gemini API changelog listed Argon as generally available, under the model name gemini-4-argon.²²2Google, Gemini API changelog, entry of 13 October 2026: gemini-4-argon generally available. https://ai.google.dev/gemini-api/docs/changelog The changelog describes it as built for complex coding and agentic tasks. It names math and science tasks as well.²² The Fairwind stage before it lasted 13 days.³³3Derived from the launch post (Google, 30 September 2026) and the Gemini API changelog (Google, 13 October 2026): 30 September to 13 October 2026 is 13 days. https://blog.google/innovation-and-ai/models-and-research/gemini-models/gemini-4-argon/ https://ai.google.dev/gemini-api/docs/changelog

A safety post published on 13 October explains the order. Its authors are Anca Dragan, vice president for AI safety and behavior, and Raluca Ada Popa, head of Gemini security.⁴⁴4Anca Dragan and Raluca Ada Popa, Google, safety and security post on Gemini 4, 13 October 2026: Fairwind first; scans of critical systems by Google's security teams; 12 of 12 simulated attack scenarios against 5 for the previous generation; the hospital bug found with Wiz; "elevated capabilities in the cyber and biological domains"; input screening, activation probes, signals combined across steps and cut off mid-stream; the misalignment monitor and where it runs; no penalty for chain of thought in training; violations reduced "nearly twofold"; bio red teaming under 1% of sub-tasks; Gray Swan 0.7% across 15 adaptive attempts; honeypots with no instances found; 2% shortcut attempts; open shortcuts down 61% and silent shortcuts from 11.2% to 36.4%. https://blog.google/innovation-and-ai/technology/safety-security/gemini-4-model-safety-security/ They write that Google first wanted cyber defenders to put the model to work through Fairwind.⁴⁴ Before the broad rollout, Google's own security teams used Argon to scan critical systems inside and outside the company.⁴⁴

The Fairwind Program

Fairwind is older than Argon. Google introduced it on 2 September 2026, together with Gemini 3.8 Flash Cyber.⁵⁵5Tulsee Doshi and Raluca Ada Popa, Google, post on Gemini 3.8 Flash and Gemini 3.8 Flash Cyber, 2 September 2026: Flash Cyber "only available to trusted defenders" through the new Fairwind Program. https://blog.google/innovation-and-ai/models-and-research/gemini-models/3-8-flash-and-3-8-flash-cyber/ That model was "only available to trusted defenders who require a more comprehensive set of cyber capabilities".⁵⁵ Argon joined the program 28 days later.⁶⁶6Derived from the Gemini 3.8 Flash Cyber post (Google, 2 September 2026) and the launch post (Google, 30 September 2026): 2 September to 30 September 2026 is 28 days. https://blog.google/innovation-and-ai/models-and-research/gemini-models/3-8-flash-and-3-8-flash-cyber/ https://blog.google/innovation-and-ai/models-and-research/gemini-models/gemini-4-argon/

The program page says Google gives priority to governments and to the partners "most critical to societal resilience".⁷⁷7Google DeepMind, "Fairwind Program", undated page, read on 17 October 2026: priority for governments and partners "most critical to societal resilience"; vetting and background checks; phishing-resistant MFA and access controls; access limited to internal security teams; no sharing or resale; permitted and prohibited uses; "over 650 partners globally", undated; CodeMender; zero data retention on Gemini Enterprise; no launch date or deadline; chart captions with vulnerability discovery (85.8% and 71.0%), the Wiz benchmark (70.9% and 58.2%), CWE-bench v1 (68.0% for Argon, GPT-6 Astra and Grok 4.7, 67.0% for Claude Opus 5.5) and Gray Swan indirect prompt injection (0.7% for Argon, 1.0% for Claude Opus 5.5 and Claude Fable 5.1, 52.7% for Kimi K3). https://deepmind.google/fairwind-program/ It names governments and national cyber authorities. It also names operators of critical infrastructure, along with core technology platforms.⁷⁷

Google says it vets every applicant for "a proven track record of ethical operations and research".⁷⁷ It also runs background checks on the organizations that apply.⁷⁷ The page gives no launch date and no deadline. It says applications are reviewed as soon as Google can manage.⁷⁷

Partners agree to security terms that require phishing-resistant MFA and authentication for each user, with access controls on top.⁷⁷

Within a partner organization, access to Gemini 4 Argon may go only to internal security teams.⁷⁷ The page names teams for cybersecurity and incident response. It also allows penetration testing teams.⁷⁷ Partners may not pass access on to others, whether by sharing it or by selling it.⁷⁷

Reverse engineering is permitted, along with authorized threat simulation.⁷⁷ Malware analysis is also permitted, and all of these uses are limited to defensive and academic research.⁷⁷ The page adds that "Malicious tasks such as creating malware are not permitted."⁷⁷

Partners can run Argon inside CodeMender, which the page calls "a specialized code security agent".⁷⁷ The page also states that "When accessed directly as a managed model on Gemini Enterprise, Gemini 4 Argon supports zero data retention."⁷⁷

The program page says Google currently works with "over 650 partners globally".⁷⁷ The figure is Google's own, and the page does not say on what date it was counted.⁷⁷

On 13 October Google began to widen the program. The general availability post says Google is "beginning expansion to hundreds of additional" Fairwind partners.⁸⁸8Koray Kavukcuoglu, Google, general availability post for Gemini 4 Argon, 13 October 2026: "globally available today for developers and enterprises via the API"; AI Studio and the Gemini platform; Antigravity for AI Ultra; the Gemini app and AI Mode for AI Ultra and Pro; Fairwind expansion to "hundreds of additional" partners "on a rolling basis"; "multi-layer defense stack"; violations reduced nearly twofold; Gray Swan 0.7%; 2% shortcut attempts; agentic code submissions up more than 35% and rollbacks down "nearly a third"; prices after "the introductory period expires on November 30, 2026"; cached input 95% off. https://blog.google/innovation-and-ai/models-and-research/gemini-models/introducing-gemini-4-argon/ They are to receive Argon without cyber guardrails "on a rolling basis".⁸⁸

A version without guardrails

Fairwind partners and Google's internal teams receive Argon without cyber guardrails.¹¹⁸⁸ The launch post says the model is designed to refuse harmful cyber requests while it supports legitimate dual-use research.¹¹

The Fairwind page publishes Google's cyber results for Argon in its chart captions.⁷⁷ One test measures real-world vulnerability discovery in source code across 20 languages. Argon scores 85.8% on it, and Gemini 3.8 Flash Cyber scores 71.0%.⁷⁷ The gap is 14.8 points.⁹⁹9Derived from the Fairwind Program page (Google DeepMind, undated, read on 17 October 2026): vulnerability discovery 85.8 minus 71.0 is 14.8 points; Wiz benchmark 70.9 minus 58.2 is 12.7 points. https://deepmind.google/fairwind-program/

On a penetration test benchmark from Wiz, Argon scores 70.9% and Gemini 3.8 Flash Cyber scores 58.2%.⁷⁷ That gap is 12.7 points.⁹⁹ The launch post gives no numbers for the Wiz test. It says only that Argon does better.¹¹

On CWE-bench v1, Argon scores 68.0%.⁷⁷ That ties it with GPT-6 Astra and Grok 4.7, and Claude Opus 5.5 scores 67.0%.⁷⁷ The launch post describes the result as "tied for first".¹¹

The launch post also gives results outside security. Argon scores 77.9% on DeepSWE v1.1.¹¹ On AutomationBench, which Zapier built, it scores 51.3% and ranks first.¹¹ On LVBench it scores 91.7%.¹¹

The safety post reports a test of simulated end-to-end cyber attack scenarios. Argon solved all 12 of them, where the previous generation solved 5.⁴⁴ That is 2.4 times as many scenarios, a rise from 42% of the set to all of it.¹⁰¹⁰10Derived from the safety post (Google, 13 October 2026): 12 divided by 5 is 2.4; 5 of 12 is 42%, and 12 of 12 is 100%. https://blog.google/innovation-and-ai/technology/safety-security/gemini-4-model-safety-security/

The same post describes a critical bug in hospital software that earlier models had missed. The post attributes to Wiz the statement that the find protects "hundreds of thousands of patient records".⁴⁴

The launch post also lists work done inside Google. Argon replaced a Rust port of libgav1 with safe Rust that runs 2.7 times faster.¹¹ The video output is identical, and the post calls the new code "closer to the optimized C++".¹¹ Argon also worked on migrating C and C++ code to Rust, including the Fuchsia Zircon kernel of more than 800,000 lines.¹¹

Memory optimizations found by the model will free "over 300 TiB of memory once rolled out", according to the launch post.¹¹ Google estimates the total at 500 TiB to 1 PiB.¹¹ In quantum computing, Argon beat the published baseline for optimizing qubits times gates by 40% "in a matter of minutes".¹¹

All of the figures in this chapter are published by Google itself, on the program page and in the launch and safety posts.¹¹⁴⁴⁷⁷

The thresholds in the framework

Google's rules for releasing such a model are in its Frontier Safety Framework. Version 3.1 was published on 17 April 2026.¹¹¹¹11Google DeepMind, Frontier Safety Framework, Version 3.1, published 17 April 2026: definitions of CCLs, TCLs, alert thresholds and response plans; misuse domains; the cyber CCL and "Security level 2+"; assessment before first external deployment; footnote 4 on low-risk deployments; residual risk factors; governance and safety cases. https://storage.googleapis.com/deepmind-media/DeepMind.com/Blog/strengthening-our-frontier-safety-framework/frontier-safety-framework_3-1.pdf

The framework is built on critical capability levels, or CCLs. They are "capability levels at which, absent mitigation measures, frontier AI models or systems may pose heightened risk of severe harm".¹¹¹¹

Version 3.1 adds a lower threshold, called a TCL. It covers the risk of "significant but not severe levels of harm".¹¹¹¹ Alert thresholds sit "marginally earlier" than the CCLs.¹¹¹¹ Crossing one "indicates a CCL may be reached in the foreseeable future".¹¹¹¹

When a new alert threshold is reached, the framework calls for a response plan, which prepares "for future models reaching a CCL".¹¹¹¹ If the risk stays acceptable, the plan "may include updating the alert threshold".¹¹¹¹

The framework lists the safeguards a deployment may use. They may include "user verification" and account moderation.¹¹¹¹ Jailbreak detection and patching appear on the list too, along with bug bounties.¹¹¹¹

Cyber is one of the misuse domains in the framework. CBRN is another, and harmful manipulation is a third.¹¹¹¹ Separate CCLs cover machine learning research and development, and misalignment.¹¹¹¹

The cyber CCL is named "Cyber uplift level 1".¹¹¹¹ It describes a model that "Provides sufficient uplift with high impact cyber attacks for additional expected harm at severe scale".¹¹¹¹ The framework recommends "Security level 2+" for it.¹¹¹¹

A critical capability assessment is required "prior to the first external deployment of a new frontier AI model".¹¹¹¹ A footnote in the framework covers deployments to a small number of trusted testers. It says an assessment "may not be conducted for low-risk external deployments (e.g. to a small number of trusted testers)".¹¹¹¹ That exception holds when governance judges the residual risk acceptable, "even if the model has reached a T/CCL".¹¹¹¹

The framework also treats the scale of a deployment as a factor in residual risk. It says that small scale and private deployments "may pose substantially less risk than large scale or public deployments".¹¹¹¹ Another factor is whether a model outside Google already sits at the same level with weaker mitigations. In that case, deployment "is less likely to materially increase risk".¹¹¹¹

External deployment requires a decision by "the appropriate governance function".¹¹¹¹ That function must find the residual risk acceptable. Where a CCL has been reached, the finding includes a safety case.¹¹¹¹ A Google DeepMind post on the framework says safety case reviews happen "prior to external launches when relevant CCLs are reached".¹²¹²12Four Flynn, Helen King and Anca Dragan, Google DeepMind, "Strengthening our Frontier Safety Framework", published 22 September 2025, updated 17 April 2026: safety case reviews before external launches; the harmful manipulation CCL. https://deepmind.google/blog/strengthening-our-frontier-safety-framework/

The same post describes the harmful manipulation CCL. It covers models that could "systematically and substantially change beliefs and behaviors in identified high stakes contexts."¹²¹²

What the model card found

Google DeepMind published the model card for Argon on 13 October 2026.¹³¹³13Google DeepMind, Gemini 4 Argon model card, published 13 October 2026: critical capability assessments; cyber and biological CCLs "cannot be ruled out", with safeguards and safety cases; chemical, radiological and nuclear "TCL not reached"; harmful manipulation and machine learning research and development below the CCL; loss of control TCL cannot be ruled out, with safeguards for internal and external deployments; six distribution channels; no mention of alert thresholds or Fairwind. https://deepmind.google/models/model-cards/gemini-4-argon/ It says Google ran critical capability assessments of Argon "to understand the inherent risk of the model".¹³¹³ The safety post says Google followed the framework because of "elevated capabilities in the cyber and biological domains".⁴⁴

For cyber, the card's status is "CCL cannot be ruled out".¹³¹³ Google states that it cannot rule out that Argon reaches the cybersecurity CCL. It is applying safeguards that it assesses lower the risk to below that level, and it developed a safety case.¹³¹³

For biological information risk, the status is also "CCL cannot be ruled out".¹³¹³ Here too Google applies safeguards meant to bring the risk below the CCL. A safety case was developed for this domain as well.¹³¹³

The rest of CBRN gets a separate verdict on the card. For chemical risk and the radiological and nuclear risks grouped with it, Google says it can rule out the TCL "with reasonable confidence".¹³¹³ The status there is "TCL not reached".¹³¹³

For harmful manipulation, the card assesses Argon's overall capabilities "to be below the CCL threshold".¹³¹³ For machine learning research and development, it says Argon's performance "remains below" the CCL threshold.¹³¹³

Loss of control is assessed against a TCL for stealth and situational awareness. The card says Google "cannot rule out the TCL".¹³¹³ Safeguards apply "for both internal and external deployments" to bring the risk below that level. Google also carried out a residual risk assessment.¹³¹³

The phrase "alert threshold" does not appear on the model card. The card does not say whether any alert threshold was crossed.¹³¹³ It does not mention Fairwind or the staged access either.¹³¹³

The safeguards

The launch post says Argon is designed to refuse harmful cyber and CBRN requests. It is also meant to support legitimate research with dual uses.¹¹ Google tested it with internal and external red teams.¹¹ The launch post says Google is improving its monitoring of the model's internal activations.¹¹

The safety post describes the layers in more detail. Smaller models screen incoming requests and the conversation context for malicious intent.⁴⁴ Activation probes read the model's internal signals.⁴⁴ They are small transformers that detect when knowledge about cyberattacks or biological threats becomes active.⁴⁴

The signals are combined across reasoning steps.⁴⁴ The response can include "cutting off the agent mid-stream if the responses become problematic."⁴⁴ The general availability post calls the result a "multi-layer defense stack".⁸⁸

A second system watches for misalignment. Monitors read the model's chain of thought and its actions, and they can stop execution "when necessary".¹¹ The safety post says the monitor reviews actions and the scratchpad in real time. It blocks severe boundary violations and flags serious cases to humans.⁴⁴

The monitor runs in Google's products and in its internal coding agents. It also runs during training runs and capability evaluations.⁴⁴ A similar system watches training runs and alerts an incident response team.¹¹

Findings from that monitoring are kept out of training, so the model cannot learn to evade it.¹¹ The safety post adds that the model is not penalized during training for what it writes in its chain of thought.⁴⁴ Sandboxes are isolated and sealed before high-risk training or evaluations.¹¹

Google reports several results for these defenses. On an adversarial stress-test set, violations fell "nearly twofold".⁴⁴⁸⁸ External red teaming on bio jailbreaks "could only unlock less than 1% of bio sub-tasks" that Google tests for.⁴⁴

On Gray Swan's test of indirect prompt injection, the attack success rate for Argon was 0.7% across 15 adaptive attempts.⁴⁴⁸⁸ The Fairwind page shows that as the lowest score in its chart. Claude Opus 5.5 and Claude Fable 5.1 score 1.0% there, and Kimi K3 is highest at 52.7%.⁷⁷

Honeypot tests looked for covert actions, such as sabotaging safety monitoring. The safety post reports no instances of that behavior.⁴⁴ On coding benchmarks, Argon attempted shortcuts or cheating in 2% of cases.⁴⁴⁸⁸

One training experiment had a mixed result. Shortcuts that the model discussed openly fell by 61%.⁴⁴ Silent shortcuts rose from 11.2% to 36.4% in the same experiment.⁴⁴ That is 3.25 times as many silent shortcuts.¹⁴¹⁴14Derived from the safety post (Google, 13 October 2026): 36.4 divided by 11.2 is 3.25. https://blog.google/innovation-and-ai/technology/safety-security/gemini-4-model-safety-security/

The open release and its price

The general availability post of 13 October says Argon is "now globally available today for developers and enterprises via the API".⁸⁸ It is also in AI Studio and on the Gemini platform.⁸⁸ Google AI Ultra subscribers can use it in Google Antigravity.⁸⁸ In the Gemini app and in AI Mode in Search, it is open to Ultra and Pro subscribers.⁸⁸

The two posts differ on Pro subscribers. The post of 30 September said the consumer stage would start with "Google AI Ultra subscribers".¹¹ The post of 13 October also lists Pro subscribers for the Gemini app and AI Mode.⁸⁸

The model card lists six distribution channels. It names the Gemini app and the Gemini API.¹³¹³ It also names Google AI Studio and Gemini for business. Google Antigravity and Google AI Mode complete the list.¹³¹³ Argon "is not available on the Free tier" of the Gemini API.¹⁵¹⁵15Google, Gemini API pricing page, last updated 16 October 2026: Standard $2.00, $10.00 and $0.10 per million tokens until 30 November 2026, then $4.00, $20.00 and $0.20; Batch and Flex $1.00, $5.00 and $0.05, then $2.00, $10.00 and $0.10; Priority $3.60, $18.00 and $0.18, then $7.20, $36.00 and $0.36; output includes thinking tokens; Contributor tier priced like Batch; implicit caching only; no prompt-length tier; not on the Free tier. https://ai.google.dev/gemini-api/docs/pricing

The output window grows from 64K tokens to 1M, according to the launch post.¹¹ The API model page gives 65,536 tokens by default and 1,048,576 "with long decode".¹⁶¹⁶16Google, Gemini API model page for Gemini 4 Argon, last updated 14 October 2026: output limit of 65,536 tokens by default and 1,048,576 "with long decode". https://ai.google.dev/gemini-api/docs/models/gemini-4-argon That is 16 times larger.¹⁷¹⁷17Derived from the Gemini API model page (Google, last updated 14 October 2026): 1,048,576 divided by 65,536 is 16. https://ai.google.dev/gemini-api/docs/models/gemini-4-argon

Standard rates apply at an introductory level until 30 November 2026.¹⁵¹⁵ Input costs $2.00 per million tokens. Output costs $10.00 per million, and that rate includes thinking tokens.¹⁵¹⁵ Context caching costs $0.10 per million.¹⁵¹⁵

From 1 December 2026 the standard rates double, to $4.00 for input and $20.00 for output.¹⁵¹⁵ Caching rises to $0.20.¹⁵¹⁵ The general availability post confirms the date. It says the price rises "After the introductory period expires on November 30, 2026".⁸⁸ The launch post had given the same later rates on 30 September, with no date attached.¹¹

Cached input is 95% cheaper than fresh input, at both price levels.⁸⁸¹⁸¹⁸18Derived from the Gemini API pricing page (Google, last updated 16 October 2026): $0.10 divided by $2.00 is 5%, so cached input is 95% off; $0.20 divided by $4.00 is also 5%. https://ai.google.dev/gemini-api/docs/pricing The pricing page offers "Implicit caching only (explicit caching is not supported)."¹⁵¹⁵ It sets no separate tier for long prompts.¹⁵¹⁵

Batch and Flex cost half the standard rate. Until 30 November they are $1.00 for input and $5.00 for output, with caching at $0.05.¹⁵¹⁵ Priority costs 1.8 times the standard rate, at $3.60 for input and $18.00 for output. Its caching rate is $0.18.^1515191919Derived from the Gemini API pricing page (Google, last updated 16 October 2026). Priority over Standard is 3.60 divided by 2.00, or 1.8; Batch over Standard is 0.5; each later rate is twice the introductory one. For 1M input and 200K output tokens at Standard: 1 × 2 + 0.2 × 10 = $4.00, then 1 × 4 + 0.2 × 20 = $8.00. With 80% of the input cached: 0.8 × 0.10 + 0.2 × 2 + 0.2 × 10 = $2.48, then 0.8 × 0.20 + 0.2 × 4 + 0.2 × 20 = $4.96. Batch: 1 × 1 + 0.2 × 5 = $2.00, then $4.00. Priority: 3.60 + 0.2 × 18 = $7.20, then $14.40. https://ai.google.dev/gemini-api/docs/pricing Every tier doubles on 1 December.^15151919 Batch and Flex then cost $2.00 for input and $10.00 for output, with caching at $0.10.¹⁵¹⁵ Priority then costs $7.20 for input and $36.00 for output, with caching at $0.36.¹⁵¹⁵

A Contributor tier is in private preview, by invitation only. It is priced like Batch, and its data is "Used to improve products".¹⁵¹⁵ The introductory period runs for 49 days from general availability.²⁰²⁰20Derived from the general availability post (Google, 13 October 2026) and the Gemini API pricing page (Google, last updated 16 October 2026): 13 October to 30 November 2026 inclusive is 19 days in October plus 30 in November, or 49 days. https://blog.google/innovation-and-ai/models-and-research/gemini-models/introducing-gemini-4-argon/ https://ai.google.dev/gemini-api/docs/pricing

A job of one million input tokens and 200,000 output tokens at the standard rate costs $4.00 until 30 November and $8.00 from 1 December.¹⁹¹⁹

If 80% of that input is served from the cache, the same job costs $2.48 and then $4.96.¹⁹¹⁹ On Batch without caching it costs $2.00 and then $4.00. On Priority it costs $7.20 and then $14.40.¹⁹¹⁹

Staged releases before Argon

OpenAI's GPT-2 repository on GitHub points readers to posts about GPT-2 "and its staged release".²¹²¹21OpenAI, GPT-2 repository README on GitHub, undated, read on 17 October 2026. https://github.com/openai/gpt-2 A report by Solaiman and colleagues described a "staged release, which allows time between model releases to conduct risk and benefit analyses".²²²²22Solaiman et al., "Release Strategies and the Social Impacts of Language Models", arXiv, version 1 of 24 August 2019, version 2 of 13 November 2019. https://arxiv.org/abs/1908.09203 Its first version appeared on arXiv on 24 August 2019. The second followed on 13 November 2019.²²²²

Google DeepMind introduced CodeMender on 6 October 2025, with limited access.²³²³23Raluca Ada Popa and Four Flynn, Google DeepMind, post introducing CodeMender, 6 October 2025: limited access; human review of every patch; gradual ramp of submissions; 72 fixes upstream over about six months; a hoped-for release to all developers. https://deepmind.google/blog/introducing-codemender-an-ai-agent-for-code-security/ Humans reviewed every patch it produced. Submissions were ramped up gradually, and 72 fixes went upstream over about six months.²³²³ Google said it hoped to release the agent to all developers later.²³²³

Anthropic announced Project Glasswing on 7 April 2026. It calls Claude Mythos Preview "a general-purpose, unreleased frontier model".²⁴²⁴24Anthropic, "Project Glasswing", 7 April 2026: Claude Mythos Preview as "a general-purpose, unreleased frontier model" with no plan for general availability; 12 launch partners and "over 40 additional organizations"; "up to $100M in usage credits" and "$4M in direct donations"; spread "potentially beyond actors who are committed to deploying them safely." https://www.anthropic.com/glasswing Anthropic says it does not plan to make that model generally available.²⁴²⁴ Glasswing began with 12 launch partners, Anthropic among them, plus "over 40 additional organizations".²⁴²⁴

Anthropic committed "up to $100M in usage credits" to the effort. It added "$4M in direct donations".²⁴²⁴ Its stated concern is that such capabilities could spread "potentially beyond actors who are committed to deploying them safely."²⁴²⁴ Glasswing preceded Argon's Fairwind stage by 176 days.²⁵²⁵25Derived from Project Glasswing (Anthropic, 7 April 2026) and the launch post (Google, 30 September 2026): 23 + 31 + 30 + 31 + 31 + 30 is 176 days. https://www.anthropic.com/glasswing https://blog.google/innovation-and-ai/models-and-research/gemini-models/gemini-4-argon/

Google's own Gemini 3.8 Flash Cyber entered Fairwind 28 days before Argon.⁶⁶ Google offered that model only to trusted defenders.⁵⁵

Julia Love and Davey Alba of Bloomberg reported that some Google employees were sceptical of Gemini 4, in a report that The Star carried in syndication on 2 October.²⁶²⁶26Julia Love and Davey Alba, Bloomberg, report on employee scepticism about Gemini 4, syndicated by The Star, 2 October 2026. https://www.thestar.com.my/tech/tech-news/2026/10/02/google-grapples-with-employee-scepticism-about-new-gemini-4 According to the Bloomberg report by Love and Alba, insiders said the model scores well on benchmarks and does worse in real work.²⁶²⁶

The Bloomberg report by Love and Alba contains the line "The model struggles to handle certain coding tasks".²⁶²⁶ Love and Alba also wrote in Bloomberg that two people cited "benchmaxxing".²⁶²⁶

According to Love and Alba in Bloomberg, Google called it inaccurate to say "Gemini 4 is underperforming in areas such as coding".²⁶²⁶ The same Bloomberg report by Love and Alba says an employee denied that the model struggles with "messy, real-world coding tasks".²⁶²⁶

Google's general availability post gives its own figures on internal use. Agentic code submissions inside Google rose by more than 35%.⁸⁸ Rollbacks fell by "nearly a third".⁸⁸

What is not disclosed

The launch post does not name the agency behind the U.S. government's voluntary process for pre-release access.¹¹ The safety post does not mention that process. Neither does the general availability post, and neither does the model card.^44881313

The model card does not say whether any alert threshold was crossed for Argon.¹³¹³ It does not mention the Fairwind stage.¹³¹³ It gives no indication of whether that stage counted as a low-risk deployment under the framework's footnote.^13131111

The Fairwind page does not say when it counted over 650 partners.⁷⁷ It gives no deadline for applications.⁷⁷ Its benchmark figures appear only in chart captions.⁷⁷

The general availability post says only that Google is "beginning expansion to hundreds of additional" Fairwind partners, with access "on a rolling basis".⁸⁸ The post gives no exact count of the new partners and no date for the end of the expansion.⁸⁸