Gemini 4 Argon lifts the output limit to 1M tokens, starting with trusted defenders

On September 30, Google announced Gemini 4 Argon, positioned as a frontier model for real-world software engineering, enterprise knowledge work such as legal and finance, and cybersecurity defense. One of its signatories is Koray Kavukcuoglu, SVP of Google DeepMind and Chief AI Architect at Google. The most visible change is on the output side: the limit rises from 64K to 1 million tokens, which Google calls the industry's highest. It also does not ship all at once — it first goes to trusted cyber defenders through the Fairwind Program and expands in stages.

What a million output tokens buys you

Input windows and output limits are different things. A long input window means the model can read a great deal at once; a long output limit means it can write a great deal at once — including its own reasoning. For long-horizon work the bottleneck is often the output side: if a single pass tops out at 64K, a several-hundred-step investigation, refactor or analysis has to be split across calls, with intermediate results shuttled back and forth, which both loses thread and inflates context cost. Google notes that when the model has the headroom to generate hundreds of thousands of tokens in a single trajectory, it adds a new level of depth in reasoning to solve tough problems in one go.

Benchmarks and Google's own use

Multimodality is what ties these workflows together. Google says Argon is uniquely strong when knowledge work requires visual understanding: it can drive professional chart analysis, identify details from long videos, and take action based on a series of documents. That is part of why it ranks highly in document-heavy, chart-heavy settings like legal and finance — beyond the benchmarks, real work is usually not a single exchange but a stack of material, an analysis, and something that has to be handed over.

Among the published results, the headline is 77.9% on DeepSWE v1.1, a benchmark that measures real-world, long-horizon software engineering tasks, which Google calls a new state of the art. It also ranks first on the Vals Index, which weights sectors by their contribution to US GDP, leads on Vals Finance Agent v2 for multi-step financial research and on Harvey's Legal Agent Benchmark, and places first on Zapier's AutomationBench with 51.3%. On visual understanding it reaches 91.7% on LVBench for long video, and 68% on CWE-bench v1 for vulnerability remediation, tying for first place.

Google's internal use shows what the long output limit is for. In quantum computing research, Argon was used to optimize the spacetime resources of subroutines — qubits times gates — beating a published baseline by 40% in a matter of minutes on one example. A team of Argon agents analyzed fleet-wide profiling telemetry, autonomously identified and applied memory optimizations across Google's data centers, freeing over 300 TiB of memory once rolled out, with an estimated 500 TiB to 1 PiB in total savings. Most tellingly, it is working on large C and C++ to Rust migrations: from tens of thousands of lines in core libraries like re2 and libgav1 up to 800,000-plus lines for the Fuchsia Zircon kernel.

The libgav1 case deserves its own mention. Argon took an existing Rust port and replaced 32,000 lines of SIMD code by running many rounds of profile-guided experiments, studying the compiler's output and producing safe Rust so the compiler would vectorize it automatically. The result is a memory-safe video decoder that runs 2.7x faster than the Rust port with identical video output, bringing it closer to the optimized C++. Google stresses that such rewrites go through rigorous automated and manual auditing, emulation testing and review before reaching production.

Cybersecurity: defenders first

On the cyber side, Argon was trained to autonomously find, validate and patch critical software vulnerabilities. For trusted defenders and Google's own internal teams, the company says it is releasing Argon without cyber guardrails so they can use its full frontier-level defensive capability. One early example comes from Wiz's Scan for Good initiative, a programme that protects critical public infrastructure for free by finding and remediating high-risk exposures: Argon uncovered a critical vulnerability exposing sensitive personal information across healthcare software used by hospitals worldwide — a risk that previous frontier models had missed.

Further detail points the same way. On Google's internal comprehensive vulnerability benchmark, which spans 20 programming languages, Argon uncovered a wide range of exposures across complex codebases. On Wiz's internal black-box penetration testing benchmark — which analyses live web systems without source code — it outperformed 3.8 Flash Cyber at discovering the attack surface, identifying vulnerabilities and producing proof-of-concept evidence to validate them. On CWE-bench v1 it ties for first with 68%, building on 3.8 Flash Cyber's frontier performance on v0.

Phased release and four lines of defense

On timing, Google says it is taking part in the US government's voluntary process for pre-release model access while gradually widening access, gathering feedback from early testers and iterating on guardrails before making Argon available to developers, enterprises and consumers as soon as possible. Availability starts with paid API customers and Google AI Ultra subscribers. On price, the introductory rate is $2 per million input tokens and $10 per million output tokens, with cached input billed at a 95% discount to input; after the introductory period it returns to $4 and $20. Per the brief, it has been available globally since October 13 across the API, AI Studio, the Gemini app, Search's AI Mode and Antigravity.

Before widening access, Google says it is strengthening frontier safeguards in four areas. The first is defending against misuse: to prevent Argon from being used for cyber or chemical, biological, radiological and nuclear attacks, the model is designed to refuse harmful requests while preserving legitimate, dual-use scientific research; this launch also strengthens techniques for monitoring the model's internal activations, with internal and external red teams stress-testing robustness using manual and automated methods.

The second is defending against prompt injection. Argon is Google's most resilient model yet against indirect prompt injections, which hide malicious instructions or context in material the model reads in order to hijack its behaviour — attacks that require layered defenses and constant vigilance. Through automated red teaming and adversarial training, Google says Argon leads on Gray Swan's Indirect Prompt Injection benchmark.

The third is monitoring for misalignment: to stop Argon from stepping outside the user's intent to get a task done, Google monitors its chain of thought and actions and halts execution when necessary. A similar system monitors training runs and alerts a dedicated incident response team, with care taken not to feed those findings back into training lest the model's reasoning evolve to evade the monitoring; Google also urges the industry to preserve reasoning transparency in this period of rising capability. The fourth is hardening systems: following its agent control roadmap, sandboxed environments are isolated and sealed before high-risk training or evaluation begins, with the practices shared with partners.

Taken together: output length decides whether a model can go the distance, and in high-risk domains like cybersecurity, giving trusted defenders the first run and opening to the public in stages is becoming the new normal for frontier launches. Google's framing is that Argon is hardened using real-world evaluation and feedback from cyber defenders and trusted testers before it reaches developers, enterprises and consumers. Capability and access being designed together is the part of this release worth remembering.