Gemini 4 Argon: one million output tokens, and the question of control

What Google announced on September 30

On September 30, 2026, Google unveiled Gemini 4 Argon, its new frontier model. According to the announcement, it targets long, complex work: software engineering, enterprise knowledge work such as legal and finance, and cybersecurity defense.

The model is not yet open to the public. Google is first rolling it out to a set of trusted cyber defenders through its Fairwind Program. Google says it is taking part in the U.S. government's voluntary process for pre-release model access, and plans to expand access gradually, starting with paid API customers and Google AI Ultra subscribers. No date is given.

The announcement spread widely, often summed up by one number: one million output tokens. We read Google's text in full. Here is what it says, what the summaries add, and the question this announcement really raises for businesses: how to control what a machine produces in volumes no team can review.

What the source says, and what summaries add

Several points in the posts going around are confirmed by Google. The output limit does rise to one million tokens, up from 64,000 previously for Gemini models. The model is indeed restricted, for now, to cyber defense players. And Google does highlight its resistance to prompt injection and its cybersecurity capabilities.

Other points do not come from the source. The announcement does not compare this limit with competing models: the claim that most frontier models top out around 128,000 tokens is not in it. The idea that Argon could write "a dozen novels" in one go is an extrapolation: Google talks about deeper reasoning, not mass literary output. Finally, the test results described as "unprecedented" are the vendor's, on tests it chose.

This sorting matters. A purchasing or architecture decision based on an enthusiastic summary rests on figures nobody has checked. It is the same discipline we applied to OpenAI's DevDay announcements and to Claude Sonnet 5.5: a cited source is a source we have read.

One million output tokens: what it really changes

Most business uses produce short answers: a summary, an email, a record, a classification. For them, a one million token output limit changes nothing.

The value lies elsewhere. Google explains that this headroom lets the model reason at length and generate hundreds of thousands of tokens in a single trajectory, to solve hard problems in one go. The examples given are engineering work: migrating codebases from C and C++ to Rust, from tens of thousands of lines up to more than 800,000 lines for a system kernel, or optimizing memory across Google's data centers from their profiling data.

In other words, the output limit matters mostly for agents that work for a long time and produce a lot: rewriting code, processing a large file, producing a series of documents. That is exactly where control becomes central. An agent able to produce in one pass what a team would produce in several weeks also produces, in one pass, just as many opportunities for error.

Who can use it, and at what price

For now, almost no one. Gemini 4 Argon is reserved for the cyber defenders in the Fairwind Program and Google's internal teams. Opening to developers, businesses and consumers will follow, starting with paid API customers and Google AI Ultra subscribers, with no date announced.

The price, however, is known. Argon will launch at an introductory price of 2 dollars per million input tokens and 10 dollars output, with a 95% discount on cached input tokens. After the introductory period, whose length is not specified, the price will rise to 4 dollars input and 20 dollars output.

That last point deserves attention. A tool whose operating cost is calculated on an introductory price will see that cost double at the end of the period. With such a high output limit, a single poorly scoped task can also consume a lot of tokens. Tracking per task and per agent, as detailed in our CADRE framework, becomes essential.

A model built for cyber defense

Google trained Argon for cybersecurity defense. According to the announcement, it can autonomously find, validate and patch critical software vulnerabilities. Google cites Wiz, which uses it to protect critical public infrastructure for free, and whose trial uncovered a vulnerability exposing sensitive personal data in software used by hospitals, which previous models had missed.

One detail of the announcement says a lot about the power of these tools: for trusted defenders and its own teams, Google will release Argon without the guardrails that usually limit its cybersecurity capabilities. The same tool that finds a flaw to fix it could find it to exploit it. That is why access is restricted, and why Google insists on a phased opening.

For a business, the consequence is twofold. On one side, far more capable vulnerability-finding tools are coming, and you will need to use them on your own code before others do. On the other, automated attacks will progress at the same pace. Securing your agents and applications is no longer optional, as we explain in securing an AI agent against prompt injection.

The safeguards announced before release

Google describes four safety workstreams to complete before broad release.

• Preventing misuse. The model must refuse harmful requests in cybersecurity and in chemical, biological, radiological and nuclear domains, while allowing legitimate research. Google also monitors the model's internal activity to spot misuse.
• Resisting prompt injection. Google presents Argon as its most resilient model against indirect injections, malicious instructions hidden in a document or page the model reads. It leads Gray Swan's benchmark dedicated to this type of attack.
• Monitoring for misalignment. A system monitors the model's reasoning and actions, and stops execution when it goes beyond the user's intentions.
• Hardening test environments. The environments where the model is trained and evaluated are isolated and sealed before high-risk trials.

These measures are the vendor's, on its model. They do not replace those the business using it must take: limiting the agent's access, validating what commits the company, keeping records. A model highly resistant to injection is still a model that reads content you do not control.

The real issue: controlling what can no longer be reviewed

The question raised by this announcement goes beyond Argon. When a model can produce hundreds of thousands of lines of code or text in minutes, full human review becomes impossible. Should review then be handed to AI itself? Partly, yes, but not only, and not any old way.

Google gives the answer itself in its announcement. Its code migrations to Rust, it says, undergo rigorous automated and manual auditing, emulation testing and review before rolling out to production. Control does not rely on line-by-line review, but on a system.

In our projects, that system comes down to five principles.

• Tests before production. What the agent produces must pass a battery of tests written in advance, on real cases. A result that fails does not pass, however long it is.
• Independent automated checks. Checking figures against the source, comparing with a reference version, measuring differences. A second model can contribute, but it does not replace a deterministic rule.
• Splitting into reviewable batches. Instead of one giant output, deliveries of reasonable size, each with its scope and tests. What cannot be reviewed must not be delivered in one block. This applies to code as much as to a series of documents or customer replies, and it also makes rollback simpler when one batch turns out to be wrong.
• Targeted human review. The human does not review everything. They review what commits the company, a random sample and everything the checks have flagged.
• A record of what was done. Each output keeps the model version, the instructions and the checks passed, so you can roll back.

These are the same conditions that separate a prototype from a production tool, detailed in business POC: isolating the production prerequisites.

Getting ready now: six concrete workstreams

Argon is not available, but models that produce a lot over long runs are already here. Here is what a business using or preparing agents can do today, without waiting for the next announcement.

1. Identify the agents that produce at volume. List the tools that generate long content: code, reports, batch answers, product records. They are the ones that will benefit from new models, and the ones most exposed to unseen errors. For each, note who reviews today, and how long it really takes.

2. Set caps per task. A technical limit of one million tokens does not mean leaving it wide open. Each task can have its own output limit, maximum duration and budget. An agent that exceeds these bounds stops and reports, instead of continuing to produce and consume. This setting protects both quality and the bill.

3. Write the tests before changing models. The test set is what lets you compare one model with another on your own cases. Without it, every new announcement restarts the same debate, settled by intuition. With it, evaluating Argon when the day comes will take a few hours.

4. Keep the model swappable. A tool built around a single provider has to be partly rewritten to change. A tool where the model call stays isolated behind a simple interface can test a new model without touching the rest. It is an architecture choice to make at the start of the project, not when you want to migrate.

5. Test the security of your own code. If models increasingly able to find flaws are coming, it is better for your teams or providers to find them first. An audit of your exposed applications, and especially of agents that read external content, is a good starting point.

6. Decide who is accountable for what. For each agent, one person must be responsible for what it produces, for the checks around it and for the decision to change its model. Without a named owner, controls erode as soon as the tool works well, precisely when they matter most.

Our takeaway

Gemini 4 Argon is not yet usable by businesses, and its results remain Google's. There is therefore nothing to decide today, except one thing: get ready. A test set on your own cases, cost tracking per task and automated checks will let you evaluate Argon on the day it ships, like any other model, without depending on rankings.

The question raised by the announcement, however, is already current. Models produce faster than people can review, and the gap will widen. The answer is neither to review everything nor to hand everything to AI, but to build tools whose output is controlled by design.

If you want to know how to frame your agents' output, what must be tested, checked or reviewed by a human, our AI diagnostic starts from your real processes and control requirements.

Sources

• Google, Gemini 4 Argon: our next era of frontier intelligence, September 30, 2026

Frequently asked questions

Can we use Gemini 4 Argon today?

No, unless you are part of Google's Fairwind Program, reserved for trusted cyber defenders. Google plans to open access next to paid API customers and Google AI Ultra subscribers, with no date announced.

Is one million output tokens useful for an SMB?

Rarely in a direct way: most uses produce short answers. The limit matters for agents that work for a long time, such as a code migration or processing a large file. That is also where cost and control must be most tightly framed.

How much will Gemini 4 Argon cost?

Google announces an introductory price of 2 dollars per million input tokens and 10 dollars output, then 4 and 20 dollars after the introductory period, whose length is not specified. A budget based on the introductory price must plan for that doubling.

Can AI output be reviewed by another AI?

Partly. A second model can flag inconsistencies, but it does not replace tests written in advance, deterministic checks, or targeted human review of what commits the company.

Should we wait for Argon before starting a project?

No. A well-designed project treats the model as a parameter that can be changed. If Argon proves better on your cases when it ships, a test set and a gradual switch will let you adopt it without rebuilding everything.