Google’s Gemini 4 Argon AI solves 12 simulated cyberattacks, up from five

What it claims

Secondhand news coverage (citing a Google DeepMind blog post and The Verge) of Gemini 4 Argon, launched October 13, 2026. The page adds a few things the summary leaves out. The 0.7% Gray Swan prompt-injection figure was measured across 15 adaptive attempts. The bio safeguards were externally jailbreak-tested. The runtime monitor can halt an agent partway through a response. Google also reports internal deployments outside security: YouTube's comments section now needs half the compute, and Argon debugged the drone physics simulator used by Wing.

How it works

The page describes the three safeguard layers at slightly more depth than the summary:

flowchart LR
  R[Request + conversation context] --> S[Small-model screening]
  R --> P[Activation probes: cyber/bio knowledge]
  S --> M[Continuous response monitor]
  P --> M
  M -->|signals combined as response develops| C{Violation?}
  C -->|no| O[Response continues]
  C -->|yes| X[Stop agent mid-response]

• The layers specifically target harmful requests that are disguised or split across long conversations.
• A separate misalignment monitor reads both the agent's actions and its internal reasoning. It blocks severe boundary violations and escalates serious cases to human responders. It runs in products, internal coding agents, training runs and capability evaluations.
• Training emphasises three behaviours: respecting system boundaries, reporting negative findings honestly, and asking for human confirmation.
• Google deliberately does not penalise internal thoughts during training. This is the policy behind the accidental-experiment result already in the summary.

Evidence

All figures are vendor-reported. The page gives baselines only where noted.

• Harmful-request violations: fell "nearly twofold" on an adversarial test set, compared with no named baseline.
• Bio jailbreaks: external testing unlocked fewer than 1% of the biological subtasks evaluated. Versions without safeguards were stronger at step-by-step lab troubleshooting.
• Gray Swan Indirect Prompt Injection: 0.7% attack success across 15 adaptive attempts, with adversarial training and real-time checks in place.
• Shortcut and cheating attempts: 2% on coding benchmarks. The page does not give the prior rate.
• Honeypot tests: no covert behaviour found, such as sabotaging safety monitoring.
• Field use: during limited access through the Fairwind Program, Wiz found a hospital-software flaw that earlier models had missed. Google also says it found "foundational" vulnerabilities that are still under responsible disclosure.

How to use it

• Access: Pro and Ultra subscribers get it through the Gemini app and AI Mode in Search. Ultra subscribers also get it through Antigravity, Google's agentic development platform.
• Pricing: $2 per million input tokens and $10 per million output tokens. These rates double when the introductory period ends at the end of November.
• Cost caveat from the article: a lower per-token price does not mean a lower per-task cost, because models use different numbers of tokens. Benchmark on your own workload before assuming savings.
• Missing details: the page gives no API model ID, context window or rate limits.

Limits

• The article is AI-assisted aggregation, not the primary source. Check the DeepMind blog post before citing any of these numbers.
• The 12 cyberattack scenarios are Google's own end-to-end tests and have no public definition.
• If you build agents on Argon, plan for responses being cut off mid-stream by the monitor, including false positives. This is especially relevant for legitimate security work outside the Fairwind Program.