Gemini 4 Argon ships to testers, not users, at $10 per million tokens
Google’s new model reaches cyber defenders first; everyone else waits, as output limits jump 16-fold.
By The Signal · · 5 min read
Gemini 4 Argon is not available today, and Google has not said when it will be. What launched on November 18, 2025, is a set of benchmark scores and a pricing sheet — $2 per million input tokens, $10 per million output tokens — for a model that right now runs for a small group of cybersecurity testers inside Google's Fairwind Program, plus Google's own staff.
The output limit jumped from 64,000 tokens to 1 million
That figure is the one worth sitting with. A token limit sounds like a technical footnote, but it's the ceiling on how much a model can generate in a single uninterrupted run — how long it can keep working on one problem before it has to stop and hand control back. Going from 64,000 tokens to 1 million is roughly a 16-fold increase, and Google frames it as the mechanism behind Argon's other gains: more headroom to "think deeply," in the company's phrase, before producing an answer.
Picture a shipping manifest. A 64,000-token limit is a short haul contract — the truck has to unload, get a new contract, and reload before it can go further. A million tokens is one continuous route, no handoffs. For a model doing a large codebase migration or drafting a long legal document, those handoffs are where context gets lost and errors creep in. Removing them is the actual engineering story behind Argon's headline numbers, more than any single benchmark score.
Argon tops four benchmarks, each measuring something different
Google reports Argon as state of the art on DeepSWE v1.1 (77.9%), a test of long-horizon software engineering; first on the Vals Index, which weights finance, coding, legal and tax tasks by their contribution to US GDP; first on Zapier's AutomationBench (51.3%), which measures end-to-end business-task execution; and state of the art on LVBench (91.7%), a long-video-understanding test. Android Authority's review of the same release notes Argon's most pronounced edge shows up in Harvey's Legal Agent Benchmark, which scores long-horizon legal research and drafting.
Four benchmarks, four different things measured, and no single number that captures "how good" Argon is overall — because that number doesn't exist for any frontier model. Benchmarks are proxies, chosen and in some cases commissioned by the companies that score well on them. Vals Index, for instance, is run by Vals AI, a startup that builds evaluation products for exactly this purpose; Harvey's benchmark comes from a legal-AI vendor with its own commercial interest in which models look capable. None of this means the scores are fabricated. It means they're measuring tasks designed by people with a stake in the measurement, and a score of 77.9% on a software-engineering test says nothing about Argon's performance on the other 22.1% — the part where it's wrong.
Access expands by trust tier, not by payment
Here's the part that separates Argon from an ordinary product launch: Google isn't gating access by subscription level first. It's gating by vetting. The earliest access goes to cyber defenders inside the Fairwind Program, and for that group, Google says it will release Argon "without cyber guardrails" — stripping the safety restrictions that normally limit what the model will do with vulnerability data, so defenders can use its full capability to find, validate and patch software flaws.
Wiz, a cloud-security company, is already running Argon through its Scan for Good initiative, which looks for high-risk exposures in public infrastructure for free. Google says the model has already surfaced at least one critical vulnerability in that work. Only after this phase — once Google decides Argon is "sufficiently robust," in Android Authority's phrasing — does access move to Google AI Ultra subscribers, the company's top-priced consumer tier. Free-tier Gemini users are last in line, with no date attached.
This sequencing matters because it inverts the usual logic of AI releases, where the paying customer is first and the cautious rollout comes later, if at all. Google is also participating in the US government's voluntary pre-release access process for frontier models — a framework that lets federal agencies review capable models before wide release, without any binding legal requirement to do so. Argon is moving through that process now, which is part of why "soon" is the only timeline on offer.
The guardrail trade-off cuts both ways
The strongest objection to this approach is that removing cyber guardrails for trusted defenders is exactly the kind of decision that looks fine until it doesn't. A model trained to autonomously find, validate and patch vulnerabilities is also, by construction, a model trained to find vulnerabilities — full stop. The defensive and offensive capability are the same capability, pointed in a direction Google controls through access lists rather than through anything built into the model itself. Google's own announcement acknowledges this indirectly, noting ongoing work to strengthen "resistance to being used for nefarious purposes" and to prevent distillation — the practice of using a frontier model's outputs to train a cheaper copycat. Those are hedges against two different failure modes: misuse by an authorized user, and theft of the model's capability by someone who was never authorized at all. Neither hedge is a technical guarantee; both are policies that depend on the access list holding.
The price is fixed before the output is
What happens next is straightforward and already scheduled: wider testing, then Google AI Ultra, then — eventually — everyone else, including unpaid Gemini users, with no promised date. The pricing is locked in before most people can test the thing it's pricing: $2 per million input tokens, $10 per million output tokens, with cached input tokens — reused context that doesn't have to be reprocessed from scratch — priced at a 95% discount. For API customers running Argon's new million-token outputs at full length, output cost is the number to watch, since it's five times the input rate and scales with exactly the long, uninterrupted runs Argon was built to sustain.
The constraint nobody states plainly in Google's announcement is that "soon" has no enforcement mechanism attached. Cyber defenders get the model now because their access serves Google's own vulnerability-finding interests, including inside Google's infrastructure. Paying subscribers come next because they fund the rollout. Free users come last because they cost Google compute with no offsetting revenue — and a company that hasn't named a date for that tier hasn't committed to one.