Google shipped its strongest model, then declined to sell it

FACT (CONFIRMED, Google primary — blog.google, "Gemini 4 Argon: our next era of frontier intelligence", 2026-09-30, authored by Koray Kavukcuoglu, SVP Google DeepMind and Chief AI Architect). Google announced Gemini 4 Argon and stated it "is rolling out to a set of trusted cyber defenders through our Fairwind Program." The post states the model "is built to sustain deep reasoning across complex, long-horizon workflows" and targets "real-world software engineering, enterprise knowledge work like legal and finance, and cybersecurity defense."

FACT (CONFIRMED, Google primary). The phased access arrangement, quoted:

"Safely releasing frontier capabilities at this level requires a phased approach. We are actively engaged in the U.S. government's voluntary process for pre-release model access while we gradually expand access. We'll continue to gather feedback from early testers as we iterate on guardrails before making Argon available to developers, enterprises, and consumers as soon as possible."

FACT (CONFIRMED, Google primary). Pricing, quoted: "Argon will launch at an introductory price of $2 per million input tokens and $10 per million output tokens, with cached input tokens priced at 95% off input token price." Footnote: "After the introductory period expires, the price of $4 per 1M input tokens and $20 per 1M output tokens will apply." The end date of the introductory period was not stated.

FACT (CONFIRMED, Google primary). On guardrails, quoted: "For trusted defenders and our own internal teams at Google, we'll be releasing Argon without cyber guardrails so they can leverage its full frontier-level cybersecurity defense capabilities."

FACT (CONFIRMED, Google primary). Rollout order, quoted: "we're grateful for the initial cohort of cyber defenders and trusted testers whose real-world evaluations and feedback will help us strengthen our systems before we release to developers, enterprises, and consumers, starting with paid API customers and Google AI Ultra subscribers."

FACT (CONFIRMED, Reuters, 2026-09-30 20:04 UTC, Kenrick Cai). Reuters independently confirmed the announcement, the phased access, and that "Google said it was providing the model to select cybersecurity partners and was participating in the Trump administration's voluntary process for pre-release model access. It did not provide a timeline for the model's public release." Reuters also established two facts not in Google's post:

• Argon is physically larger than Google's previous Pro line — "The new model, 'Argon', is larger in size than Google's previous line of advanced 'Pro' models, a company spokesperson said."
• Google cancelled Gemini 3.5 Pro. "Google no longer plans to release Gemini 3.5 Pro, which CEO Sundar Pichai originally said would be released in June, according to the company spokesperson."
• Argon "remained behind on certain other metrics, including two of the four coding-related benchmarks Google included in the release."

FACT (CONFIRMED, Reuters, quoted spokesperson). "It's our most performant model yet built for complex workloads, and we see it comparable to frontier models like (OpenAI's) Astra and (Anthropic's) Opus on key coding and cyber benchmarks."

FACT (CONFIRMED, Bloomberg, 2026-09-30, Julia Love and Davey Alba, retrieved via Yahoo Finance syndication). Reporting from inside Google: "While Gemini 4 has performed well on benchmarks the industry uses to gauge model efficacy, it does less well when employees actually put it to work … The model struggles to handle certain coding tasks." One person said "Gemini isn't particularly adept at front-end design." Two people said the model appeared affected by "benchmaxxing." Google told Bloomberg "it would be inaccurate to say that Gemini 4 is underperforming in areas such as coding," and one employee said there is "large consensus" internally that Argon is at the frontier. Bloomberg also noted Argon is "a very large model … Typically big models are expensive to run, potentially putting pressure on Google's margins," and that "a wave of star AI researchers have left Google," with Demis Hassabis having stepped into a chairman role in August and ceded day-to-day DeepMind operations to Kavukcuoglu.

FACT (CONFIRMED, Google primary — governance detail from the Fairwind program page). The Fairwind Program launched 2026-09-02 with Gemini 3.8 Flash Cyber and now states: "A set of Fairwind Program partners get exclusive access to Gemini 4 Argon." The program reports "over 650 partners globally" and imposes: background checks on applicant organisations; phishing-resistant MFA; access restricted to internal cybersecurity, incident-response or penetration-testing teams; permitted tasks limited to "dual-use tasks, including authorized threat simulation, reverse engineering, and malware analysis for defensive and academic research purposes"; and "we do not allow partner organizations to share, redistribute, or sell access to our frontier models."

FACT — the change to the generation ceiling. Google's post: "we are significantly expanding the model's output token limit to an industry-leading 1M tokens, up from the previous 64K tokens." That is roughly a 15–16× increase in single-response output capacity.

FACT — the change to the access model. Google's prior frontier cyber offering, Gemini 3.8 Flash Cyber, shipped on 2026-09-02 into the same Fairwind Program. What changed on 2026-09-30 is that the company's overall strongest model — not a specialised cyber derivative — is now the gated artefact. The gate is no longer attached to a niche cyber SKU; it is attached to the flagship.

FACT — the change in Google's own product surface. Argon is already in production inside Google: C/C++→Rust migrations from re2 and libgav1 up to 800K+ lines for the Fuchsia Zircon kernel; fleet-wide memory optimisation freeing over 300 TiB (est. 500 TiB–1 PiB total); and a quantum subroutine optimisation that "beat the published baseline by 40% in a matter of minutes." On libgav1, agents "replaced 32K lines of SIMD code," producing "a memory-safe video decoder that runs 2.7x faster than the Rust port, with identical video output."

FACT — the change to the competitive set, per Reuters. The release ends a seven-plus-month gap in Google's frontier line and comes after Google "overhauled its DeepMind AI lab" with Hassabis stepping aside. Reuters notes the delays "have caused the company to fall behind Anthropic and OpenAI," and that Google "in recent months has shifted its messaging from touting Gemini's cutting-edge capabilities to highlighting its cost advantage." Argon's $2/$10 intro price matches that repositioning.

INTERPRETATION. The release does two things at once that are usually decoupled: it raises a hard generation ceiling by an order of magnitude, and it withholds that capability from the general developer population. Most frontier launches are capability-increases with access held roughly constant. This one is a capability increase with access made more restricted than the previous generation's equivalent.

FACT (COMPANY CLAIM — architecture is not disclosed). Google disclosed no architecture, parameter count, training-corpus composition, or knowledge cutoff for Argon. The only structural disclosure is the output ceiling and the fact that the model is "larger in size than Google's previous line of advanced 'Pro' models" (Reuters, per spokesperson). No model card, no public model ID, and no API documentation for Argon existed at the time of this research.

FACT (COMPANY CLAIM — evaluation conditions). Google's benchmark table runs Argon "at the highest thinking settings," generally at pass@1 without majority voting or parallel test-time compute, with smaller benchmarks averaged over multiple trials. Google's own methodology notes that several Argon rows are self-computed by Google rather than taken from a third-party leaderboard — including DeepSWE v1.1 (mini-swe-agent harness), Terminal-Bench 4.0, Terminal-Bench Science, and OSWorld-2.0 — and that on PostTrainBench, LABBench 2 and GraphWalks "Google ran every model itself." Competitor numbers are quoted from vendor reports or public leaderboards. This is a material comparability caveat: on the rows that matter most for the coding narrative, Google's model and Google's harness were measured together.

FACT (COMPANY CLAIM — reasoning behaviour). The stated mechanism for the output ceiling is headroom for a single reasoning trajectory: "When the model has the headroom to think deeply and generate hundreds of thousands of tokens in a single trajectory, it adds a new level of reasoning to solve tough problems in one go." Argon extends the long-running agentic loop pattern introduced with 3.8 Flash, where models "recursively evaluate and refine the underlying models."

FACT (COMPANY CLAIM — safety stack). Google describes four safeguard areas: (a) misuse refusal for cyber and CBRN requests per its Frontier Safety Framework, including monitoring "internal activations"; (b) prompt-injection resilience via automated red-teaming and adversarial training; (c) misalignment monitoring of chain-of-thought and actions, with execution halted when necessary; and (d) hardened sandboxed agent environments ("isolating and sealing them before high-risk training or evaluations begin"). Google also asks the industry to "preserve reasoning transparency."

FACT (COMPANY CLAIM — internal cyber measurements, from the Fairwind program page charts). Real-world vulnerability discovery: Argon 85.8% vs Gemini 3.8 Flash Cyber 71.0%. Wiz black-box penetration-test benchmark: Argon 70.9% vs 3.8 Flash Cyber 58.2%. Gray Swan IPI attack success rate at k=15: Argon 0.7%, the lowest on the chart.

INDEPENDENT EVIDENCE (Vals AI). Independent measurements of the same model on 22 benchmarks, run "with reasoning effort set to 'high' and temperature set to 1.0." Notably, the Vals Index run consumed 142.01M output tokens across the suite with a total run duration of 46m33s — hard evidence that the long-generation regime is real and is already being exercised by third parties, not just Google.

INTERPRETATION. A 1M output ceiling is not the same capability as a 1M context window, and the confusion is the single most common misreading of this release. Context is what the model can read; output is how long a single uninterrupted trajectory can run. The second is an agent-loop budget. It lets a model plan, write, run, inspect, and revise inside one response instead of handing state back and forth through a harness — which removes orchestration overhead but also removes every checkpoint at which an external system could intervene.

INTERPRETATION — the architectural shift is about loop shape, not prompt size. For two decades developers have worked around output caps by decomposing work: split the refactor into dozens of calls, generate the report section by section, stitch and re-stitch, then repair the seams. A 1M output ceiling removes most of that for single-pass jobs. It converts a multi-turn orchestration problem into a single-generation problem. That is a genuinely different engineering discipline, and it is the first change of that magnitude in the commercial frontier.

INTERPRETATION — the cost of that shift is the loss of intervention points. Long single trajectories mean the human or the harness cannot inspect intermediate state. Google itself concedes the point: its C/C++→Rust migrations to 800K+ lines are "undergoing rigorous automated and manual auditing, emulation testing, and review before rolling out to production." A larger output ceiling does not remove the verification burden; it raises the cost of a wrong answer by orders of magnitude because the diff is bigger.

INTERPRETATION — the access gate is the more consequential signal. Coupling the strongest release to a cyber-defender-first cohort is a governance pattern with two distinct components that should not be conflated:

1. Capability gating: the unguardrailed version is contractually confined to vetted defenders (background checks, MFA, internal-team-only access, no redistribution). This is arguably safety-positive — defenders get a real edge.
2. General-access delay: the strongest model is withheld from the developer population with no date. This is a competitive choice as much as a safety one. Google needs days-to-weeks of Fairwind feedback before opening up; rivals will note that the same capability was not offered to them.

INTERPRETATION — the benchmark picture is "top group, clear on some axes, not the leader." This is the most under-reported aspect. Three independent operators reproduce Google's wins on knowledge work and automation; a fourth places Argon below Anthropic's top models on a composite index. The honest summary is: Argon leads on long-horizon business-workflow automation and financial/legal research; it is competitive-but-not-leading on terminal coding and science; and it is not the most efficient frontier model per unit of work done.

INTERPRETATION — pricing is a positioning weapon. Argon's list price ($4/$20) exactly matches Claude Opus 5.5 and sits ~60% below GPT-6 Astra's ($10/$50). Combined with Google's earlier public pivot to cost messaging, this looks like Google competing on unit economics while conceding the capability crown is contested.

FACT (COMPANY CLAIM — demonstrated internally at Google).

• C/C++ → Rust migration at kernel scale, from re2 and libgav1 up to 800K+ lines of the Fuchsia Zircon kernel.
• libgav1: 32K lines of SIMD code replaced with auto-vectorising safe Rust; result 2.7× faster than the previous Rust port with identical video output.
• Fleet-wide memory optimisation across data centres: 300+ TiB freed, 500 TiB–1 PiB estimated total.
• Quantum algorithm optimisation beating a published baseline by 40% in minutes.
• Wiz: "the model uncovered a critical vulnerability exposing sensitive personal information across healthcare software used by hospitals worldwide, identifying a severe risk that previous frontier models had missed."

INTERPRETATION — what genuinely becomes newly possible once Argon is available.

• Single-pass whole-codebase reasoning where the repository is small enough to fit the context and the transformation is large enough to need a 100K+ token answer. This is the clearest new capability class.
• Consistent long artefacts — a 300-page report, a full migration plan, a complete test suite — produced in one pass with internal consistency, rather than assembled from stitched sections.
• Deep-research agents that iterate within one trajectory (search → read → synthesise → revise) instead of round-tripping through a harness.
• Autonomous vulnerability discovery, validation and patching at production scale, for the ~650 organisations in Fairwind.
• Long-video and document reasoning beyond text: LVBench 91.7% (COMPANY CLAIM); Bloomberg's insider specifically flagged "making sense of inputs beyond text, such as extracting metadata from video" as a genuine strength.

INTERPRETATION — what does not become newly possible. Nothing in the release changes terminal-based coding leadership: Terminal-Bench 4.0 (Argon 57.4% per Google's table; Vals independently reports 57.58% at #5 of 43) is behind Opus 5.5. Front-end design, per Bloomberg's sources, is a weak spot. Science/maths also trails (Terminal-Bench Science 57.6% vs Astra 68.1%).

1. Is the 1M output limit universal, tier-specific, or endpoint-specific? The 262K figure on Vals' model page is the most concrete reason to doubt the headline. This is the single most important unresolved technical question.
2. When does paid API access open, and what is the introductory-price end date? Google gave neither. Pricing is published; availability is not.
3. Does the unguardrailed build share weights with the guarded build? Google describes "releasing Argon without cyber guardrails" to Fairwind partners, implying a variant. Safeguard-layer architectures for that are not public, and the security properties of the shared base matter.
4. What is Argon's actual output speed? Artificial Analysis has published no speed or latency for the one provider it tracks. At peer rates a 1M response is 2–6 hours; Argon may be materially faster, and nobody outside Google has said.
5. What happens to the third-party benchmark gap when the guarded public build arrives? Fairwind testers get the unguardrailed model. Paid API customers will not. Whether published leaderboards remain comparable is unresolved.
6. What is the Fairwind enforcement record? No published audit results, incident data, or revocation policy for 650+ organisations holding an unguardrailed frontier cyber model.
7. Does the reported front-end weakness survive to the public build? Bloomberg's sourcing is about internal use. If it persists, the competitive gap with Anthropic's coding products is structural, not a launch artefact.
8. What did the cancelled Gemini 3.5 Pro cost, and is Argon its replacement or a different branch? Reuters and Bloomberg both confirm abandonment; neither characterises the technical relationship.
9. Does a 1M ceiling make verification the bottleneck? Nobody has published long-generation quality at 1M tokens. Coherence at 100K is not coherence at 1M, and a late failure wastes the whole trajectory.

FACT (stated by Google). Access expands "as soon as possible," starting with paid API customers and Google AI Ultra subscribers. No date given. Google is engaged in the US government's voluntary pre-release model access process. Fairwind partners are the first cohort and will shape guardrails before broad release.

FACT (stated by Google). Introductory pricing is $2/$10 with cached input at 95% off, reverting to $4/$20 after the introductory period. The end date of the introductory period was not published. (Google has published a date for 3.8 Flash's introductory price — 2026-12-31 — which sets a reasonable expectation but is not a commitment for Argon.)

PREDICTION (moderate confidence). Paid API and AI Ultra access opens within weeks to a few months of 2026-09-30. Rationale: pricing is already published, the rollout order is already stated, and Google faces competitive and internal pressure to ship broadly. If it slips materially past that, treat it as a signal about safeguard work rather than capacity.

PREDICTION (moderate confidence). The 1M-vs-262K discrepancy resolves as tier- or endpoint-specific rather than as an error. Artificial Analysis's provider label "(1M output)" suggests a distinct high-output tier exists. Expect the public documentation to distinguish a standard ceiling from an extended one.

PREDICTION (high confidence). Rival output ceilings move. Google has set a capability that is cheap to copy in a specification and expensive to copy in serving economics. Expect at least one competitor to announce a comparable ceiling within one to two quarters, and expect output-token price to become a marketed differentiator.

PREDICTION (high confidence). "Set an explicit output cap" becomes standard advice within weeks, because a 1M ceiling is trivially expensive to misuse and vendors will not police it for you. Third-party commentary on this release is already converging on that point.

PREDICTION (moderate confidence). Independent benchmark divergence persists and widens. Three operators already disagree about where Argon ranks. Expect divergence to grow once Argon is on a stable public endpoint with published reasoning settings, because the current numbers were produced under inconsistent conditions at maximum effort.

PREDICTION (low-moderate confidence). Fairwind expands past 650 organisations, and the expansion is the mechanism by which Argon's unguardrailed build accumulates its independent safety record. The gate is temporary by design; the interesting artefact to watch is not the model but the governance regime Google is piloting around it.

Watch items. (1) Publication of Argon's API docs, model card and model ID. (2) The introductory-price end date. (3) Any Fairwind safety incident or enforcement disclosure. (4) Whether the reported front-end/coding weakness persists into the public build. (5) Any update to CWE-bench v1, which the operator has flagged for harder tasks and a rotating held-out set.

The number everyone will quote — 1 million output tokens — is the part we understand least. Google says 1M, up from 64K, roughly 8× the nearest frontier competitor. One independent evaluator that actually ran the model lists 262k. Artificial Analysis labels its single provider "(1M output)". Nobody has published a token rate, a timeout contract, or a model card. So the honest position is a range, not a claim.

But the number is not the story. The story is that Google shipped its strongest model and then declined to sell it.

Every previous frontier launch has been a capability increase against roughly constant access. This one raised the generation ceiling by an order of magnitude and made the flagship's availability narrower than its own specialised cyber derivative's was four weeks earlier. Argon went first to ~650 vetted defenders under contract, unguardrailed, with the next tier — paying customers — left undated. Google is simultaneously piloting a capability-gating regime and harvesting an unusually high-fidelity private evaluation environment from it.

And the benchmark story is more interesting than "Google wins." Three independent operators reproduced Google's headline claims: 68% tied-first on CWE-bench v1 (Collinear), #1 on the Vals Index at 68.90% (Vals), #1 on AutomationBench at 51.29% (Zapier). A fourth — Artificial Analysis — put Argon at 53 on its composite index, level with GPT-6 Astra and behind Claude Opus 5.5. Vals ranks Argon only fifth of 74 on Harvey's Legal Agent Benchmark, which Google described as "leading." Google self-computed several of the rows where it leads. Bloomberg reported internal scepticism about real-world coding and named front-end design as a weakness; Google disputes it.

Three lessons worth carrying forward.

1. Access design is now a first-class part of a model release. Anyone evaluating this should ask not only "how good is it" but "who can reach it, under what controls, and when."
2. A bigger output ceiling moves the bottleneck, it does not remove it. Google's own 800K-line migrations needed "rigorous automated and manual auditing, emulation testing, and review." A million-token capability without a real test suite is a million-token diff nobody can check. And one maxed-out response costs $10 at intro, $20 at list — before input, before thinking tokens, and Argon is verbose.
3. "Tied for first" is a different claim from "first." On the one benchmark where Google's cyber framing rests, Argon ties three models at 68% — at $6.63 per rollout, the most expensive on the board, for one point over a model costing $0.79. For most defenders, that is not a close call.

The genuinely new capability is not the ceiling. It is single-pass work at scale — a migration, an audit, a document set finished in one trajectory rather than stitched from dozens of calls. That is real, it is architecturally different, and it is worth planning for. Just plan against a 262K–1M range, a price with no end date, and an access gate that has not opened yet.