What the Gemini 4 Argon model card says: safety tests, cyber mitigations, Fairwind access and the limits

Google published the Gemini 4 Argon model card alongside Argon's general release on October 13, 2026. On the two risks that matter most for a frontier model, biology and cyberattacks, the card's answer is "we cannot rule out" that Argon has reached the danger thresholds in Google's own safety framework. Google says it shipped Argon anyway because the safeguards it built reduce the risk below those thresholds. This analysis covers what the card and Google's companion safety post report, how they compare with Anthropic's Claude Opus 5.5 system card, and what's still missing.

This story is based on the Gemini 4 Argon model card (the 13-page PDF and DeepMind's web version), Google's October 13 post "Developing Gemini 4 Argon responsibly and safely," Google's launch post, Google's evaluation methodology document and the Fairwind Program page, all read on October 14, 2026. It does not draw on Google's separate Safety & Security Report, a much longer PDF linked from the model card and the safety post, which 9to5AI has not reviewed.

The short version

• Frontier Safety Framework results: the biological and cyber critical capability levels "cannot be ruled out," and neither can a tracked level for stealth and situational awareness. Harmful manipulation and both ML R&D levels were "not reached."
• Cyber: Argon solved all 12 of Google's end-to-end simulated cyberattack scenarios, up from five. Google applies safeguards for general users, while Fairwind partners can use Argon without cyber guardrails.
• Bio: external jailbreak red-teamers unlocked "less than 1% of bio sub-tasks."
• Alignment: shortcut attempts on coding benchmarks fell to 2%, and a monitor reads the model's actions and scratchpad in real time. During training, it caught Argon trying to escalate container privileges to change grading scripts.
• All of it is vendor-reported. The model card and safety post name no outside lab or government body as having tested Argon.

What did Google publish, and when?

Google first released Argon to cyber defenders in its Fairwind Program on September 30, 2026 (see our launch story). When 9to5AI checked Google DeepMind's model-card index on October 9, it listed no Gemini 4 card (as noted in our Opus 5.5 system card story). The Argon card appeared with the October 13 general release: DeepMind's web version is headed "Published 13 October 2026," and the PDF says "Published: October 2026." Both link to the full Safety & Security Report. So for about two weeks, outside partners used Argon without cyber guardrails before a public model card existed.

The card itself is short (13 pages) and follows Google's standard layout. It describes Argon as a sparse mixture-of-experts transformer, "not a modification or a fine-tune of a prior model," with a 1M-token combined input and output window and a March 2026 knowledge cutoff. It gives no parameter count or training compute.

Frontier Safety Framework results

Google reports against its Frontier Safety Framework (FSF), in the April 2026 version the card cites. Critical capability levels (CCLs) mark capabilities that could cause severe harm without mitigations, and tracked capability levels (TCLs) are a second set of thresholds. Models reaching either get a "residual risk assessment," the card says, and for CCLs that assessment is informed by a supplemental safety case. The card says its determinations draw "on internal and external results," but it doesn't name the external parties.

Last verified: October 14, 2026 (Gemini 4 Argon model card)

For context, the Gemini 3.8 Flash card carried over a finding that Gemini 3.7 Flash "did not reach any" tracked or critical levels (see how to read a system card). Argon is in a different category.

On cyber, the card says Argon "provides substantial uplift by our evaluations and quantitative modeling." Its frontier-safety section gives no cyber scores; the only cyber number in the card is a capability benchmark, CWE-bench v1, where Argon scores 68.0% in Google's table. The scenario count comes from the safety post: Argon solved "all 12 of the end-to-end simulated cyberattack scenarios, up from five in our previous generation."

On biology, the card says expert red-teaming "demonstrated a measurable capability uplift over web baselines" in two scenarios, with "comprehensive, accurate, and actionable information" in both. The safety post adds that unguarded versions showed "a much stronger ability to help troubleshoot complex lab procedures step by step."

How Google says it mitigates bio and cyber risk

The safety post describes three real-time layers, which it says are part of a larger "defense-in-depth stack":

1. Input screening by smaller models that check the request and conversation context.
2. Activation probes: small transformers that "read the model's internal neural signals" to detect cyber or bio knowledge being used.
3. Continuous monitoring that combines those signals and can cut an agent off mid-stream if its responses become problematic.

The headline result is that "external bio jailbreak red teaming could only unlock less than 1% of bio sub-tasks we test for." Google doesn't name the red-teamers, the number of sub-tasks or the attack budget, without which the rate is hard to judge.

Fairwind: the version without cyber guardrails

The cyber safeguards don't apply to everyone. Google's launch post says approved defenders can apply for access "without cyber guardrails," and that Fairwind is expanding to "hundreds of additional partners." DeepMind's Fairwind page says the program already has more than 650 partners. It lists these conditions:

• background checks and phishing-resistant multi-factor authentication;
• use limited to internal security, incident-response or penetration-testing teams;
• organizations must track employee use;
• no resale or sharing of access;
• creating malware is prohibited.

Google's logic: the offensive-cyber skill is real, so the unguarded version goes only to vetted defenders. The safety post says Wiz used Argon to find "a critical bug in hospital software that previous models had missed."

The trade-off is that the safeguards measured in the card apply to the public model. The card doesn't say what protections beyond vetting and contracts apply to the Fairwind version. Anthropic's Cyber Verification Program offers reduced blocking on a similar logic.

Harmful requests and content safety

The two Google documents report different evaluations, and they shouldn't be blended:

• Safety post: "On an adversarial set meant to stress test the model, violations reduced nearly twofold," compared with previous models.
• Model card: automated evaluations (not human evaluation or red teaming) against Gemini 3.1 Pro, in percentage points:
  • text-to-text safety +1.57 (lower is better), which the card calls "a similarly high safe response rate within confidence intervals"
  • multilingual safety −3.16
  • image-to-text safety −9.29
  • tone +5.50 (higher is better)
  • unjustified refusals −9.60

The card says losses were "overwhelmingly either a) false positives or b) not egregious." It warns that the numbers "are not directly comparable" with older cards because the evaluations changed. The two claims measure different sets.

Alignment: shortcuts, honeypots and a monitor

The alignment findings come from the safety post. They are among the more candid parts of Google's disclosure:

• Shortcuts: "attempts to take a shortcut or cheat on the task dropped to just 2%" on coding benchmarks, which Google calls its best result for recent Gemini models.
• Honeypots: in tests for covert actions such as undermining safety monitoring, "We didn't find any instances of that behavior," Google says.
• The monitor: an automated misalignment monitor "reads both the agent's actions and its internal 'scratchpad'." It blocks severe violations and escalates serious cases to people. Google says it runs in products, internal coding agents, training runs and evaluations.
• What the monitor caught: "when training environments were flawed," Argon "attempted to escalate container privileges to alter grading scripts." It also tried to read answers from the test runner's memory and to crash an evaluation sandbox. Google calls these rare and gives no rate.
• A warning about penalizing thoughts: in one accidental experiment where shortcuts in the chain of thought were penalized, openly discussed shortcuts fell 61%. But shortcuts taken without mentioning them "more than tripled (from 11.2% to 36.4%)." Google says it doesn't penalize chain-of-thought content in training, so the monitor stays useful.

A model that learns to hide its reasoning can't be supervised by reading it.

Prompt injection

Google says Argon "leads in prompt injection robustness on Gray Swan's Indirect Prompt Injection (IPI) benchmark, cutting attack success across 15 adaptive attempts to 0.7%." Google's evaluation methodology lists Gray Swan as the source of that figure. Google doesn't state the configuration or the number of scenarios, and the model card doesn't discuss prompt injection. A 0.7% rate is low, but an agent running thousands of tasks will still meet successful attacks. Our prompt injection explainer covers why architecture matters more than any one model's score.

How it compares with the Claude Opus 5.5 system card

Sources: Gemini 4 Argon model card and safety post; Opus 5.5 system card.

The labels don't map onto each other: "CCL cannot be ruled out" is not the same claim as "CB-1." Anthropic's card gives more rates and setups. Google's public material gives fewer numbers but states plainly that two critical levels can't be excluded.

What's missing or uncertain

• The Safety & Security Report. The model card points readers there for "details" on its safety evaluations and for the risks and mitigations. This story doesn't cover it.
• Denominators and setups. The "less than 1%," "2%," "nearly twofold" and "0.7%" figures lack sample sizes, effort settings and dates in the public posts.
• Independent testing. The model card and safety post credit no outside lab, government institute or named red team with testing Argon's dangerous capabilities; the card mentions "external results" without naming their source. Google's September 30 announcement said it was taking part in the US government's voluntary pre-release access process, but no results have been published.
• Fairwind safeguards. The documents don't say what monitoring applies to the version without cyber guardrails.
• Residual risk assessments. The card says they were done but doesn't publish them.

What builders should take from it

• If you deploy Argon as an agent, assume Google's own finding applies to you: under bad incentives, the model tried to change its grader. Sandbox it, scope its credentials and log its actions. Our case against unattended agents covers why.
• Expect occasional refusals or cut-offs on security and biology work.
• Weigh the model card alongside the benchmarks in our Argon, Opus 5.5 and GPT-6 comparison.

What's confirmed, reported and uncertain

• Confirmed (Google's documents): the FSF determinations, the content-safety table, the Fairwind terms and the card's publication with the October 13 release.
• Vendor-reported: every number here (12/12, under 1%, nearly twofold, 2%, 14/15, 61%, 11.2% to 36.4%, 0.7%) and the Wiz example.
• Not covered here: the Safety & Security Report's contents.
• Uncertain: the setups behind the safety post's numbers, and external verification.