Gemini 4 Argon: the output limit is the story

Google DeepMind announced Gemini 4 Argon on 30 September 2026, written up by Koray Kavukcuoglu. It is not generally available. It is going first to a set of cyber defenders through the Fairwind Program, with developers, enterprises and consumers after that.

The benchmark tables will get the attention. DeepSWE v1.1 at 77.9 per cent, first place on the Vals Index, 51.3 per cent and rank one on Zapier's AutomationBench, 91.7 per cent on LVBench, a tie for first on CWE-bench v1 at 68 per cent. Those are good numbers and they will be beaten.

The number that changes how you build is in a paragraph nobody will quote. The output token limit goes from 64,000 to 1,000,000.

1. Everyone has been optimising the wrong side of the window

For two years the competitive axis has been input context. A hundred thousand tokens, then two hundred, then a million. Every lab shipped it, every launch post led with it, and it did solve a real problem: you can now put a whole codebase or a whole contract in front of a model without retrieval gymnastics.

Meanwhile the output ceiling barely moved. Gemini sat at 64,000 tokens. That asymmetry is roughly sixteen to one, and it quietly decided the shape of every agent system built on top.

Here is why it matters. A long-horizon task is not one where the model needs to read a lot. It is one where the model needs to do a lot, and doing is output. Every tool call, every intermediate plan, every revision, every line of a migration is output. When the ceiling is 64,000 tokens, any task larger than that has to be cut into pieces, and the pieces have to be stitched back together by your code, between calls.

The stitching is where the systems we have audited go wrong. Not in the model, in the seams. Each new call starts from a summary of the previous one, and a summary is lossy by construction. The model that resumes is not the model that paused: it has your compression of what it was thinking rather than what it was thinking. Ten seams into a migration and the thing has forgotten the convention it established in seam two.

We have written about the general version of this in read and write memory and why the brain keeps two memory systems: a context you refill and a memory you write to are different mechanisms, and treating one as the other destroys information. Chunked generation is the worst case of exactly that. You refill, every seam, from a lossy source, and you pay for it twice.

A million token output ceiling does not make the model smarter. It removes the seams. The DeepMind post says this plainly, and it is the one capability claim in the announcement that is really an architecture claim: "when the model has the headroom to think deeply and generate hundreds of thousands of tokens in a single trajectory, it adds a new level of depth in reasoning to solve tough problems in one go".

2. What that costs, because somebody has to pay for it

Argon launches at 2 dollars per million input tokens and 10 dollars per million output tokens, with cached input at 95 per cent off. After the introductory period that becomes 4 dollars and 20 dollars.

Put the new ceiling and the output price in the same sentence and the consequence is immediate.

The most a single call could cost you went up by a factor of 15.6. That is not a price rise. The per-token rate is unchanged. It is a change in the size of the largest thing one request can be, and if you have ever set a per-request budget alarm, it has just stopped protecting you.

We have since priced Argon against every other current model in what the frontier costs now, where it turns out to share a price list to the cent with two models from other labs. It is the same lesson we reached pricing Moonshot's model in Kimi K3 vs Claude: what tokens actually cost: people reason about model cost on the input rate because input volume is the number they can picture, and then the bill arrives shaped by output. Output is the expensive side of the meter at every lab, usually by five times, and the headroom just expanded there and nowhere else.

The 95 per cent cache discount is worth its own line. Cached input at the introductory rate is 10 cents per million tokens, and 20 cents after. That is deeper than the industry norm of about 90 per cent, and it is a deliberate shape: it makes the long stable prefix almost free and leaves you paying for what the model generates. Which is a coherent story to tell alongside a million token output limit. The pricing and the ceiling are the same design decision seen twice.

The practical advice has not changed, it has just become urgent. Budget on output tokens. Cap them per task rather than per call, because per call no longer bounds anything. And if you run a fleet, the ceiling is now something you set, not something the API sets for you.

3. The release shape is the product

Argon is going to trusted cyber defenders first, and DeepMind are explicit about what that means: "we will be releasing Argon without cyber guardrails so they can leverage its full frontier-level cybersecurity defense capabilities".

Read that again. The same weights behave differently depending on who holds the key. The guardrail has not been removed from the world, it has moved out of the model and into the access list.

We have made this argument before and it keeps being the right one. In OpenAI's dots: the boundary is the product the claim was that what an agent is allowed to touch matters more than how clever it is. In AI agent security: the real attack surface it was that the interesting vulnerabilities live in the permissions, not the prompt. Argon is the same claim arriving from the lab side: capability is now provisioned, and provisioning is an identity problem.

The consequence for anyone building on frontier models is unglamorous and worth saying out loud. You will increasingly be deploying systems where the model's behaviour depends on a credential, a programme membership or a contractual tier. That has to be modelled explicitly: which identity made this call, what capability tier did it carry, and is that recorded. If you cannot answer those three questions from your logs, you do not actually know what your system is allowed to do. The transparency and record-keeping machinery we built for Article 50 turns out to be the same machinery you need here, for a completely different reason.

And the lesson transfers downwards. Most businesses will never hold a frontier capability tier. Every business running agents has the same structural question, which is the one we work through in AI implementation is an architecture decision: the useful boundary is not what the model can do, it is what this caller is allowed to make it do.

4. The evidence worth trusting is the internal evidence

The benchmark scores are self-reported, as they always are, and we apply the same discount to them that we applied to OpenAI's in GPT-6 Astra's system card is a build spec. A lab publishing numbers about its own model is an interested party. That applies to every lab, ours included, whenever we publish numbers.

The internal deployment results are a different kind of claim, because they are checkable against physical reality rather than against a leaderboard.

• Argon agents analysed fleet-wide profiling telemetry and applied memory optimisations across Google's data centres, freeing more than 300 TiB of memory, with an estimated 500 TiB to 1 PiB in total.
• Agents migrated C and C++ codebases to Rust at scales from tens of thousands of lines in libraries like re2 and libgav1 up to more than 800,000 lines for the Fuchsia OS Zircon kernel.
• On a quantum computing problem, the model optimised the spacetime resources of a bottleneck subroutine and beat the published baseline by 40 per cent, in minutes.

The libgav1 result is the one we would point a sceptic at. Argon agents took an existing Rust port, replaced 32,000 lines of hand-written SIMD, and did it by running rounds of profile-guided experiments and reading the compiler's output until the compiler would vectorise safe Rust automatically. The result runs 2.7 times faster than the Rust port it replaced, with identical video output.

Identical video output is the phrase that carries the weight. You cannot grade that generously. It either decodes to the same frames or it does not, and 2.7 times is measured on a clock. That is a better piece of evidence than any percentage in the tables above, and it is evidence of a specific thing: sustained, iterative, profile-guided optimisation over a long horizon. Which is precisely what a million token output ceiling is for. The capability claim and the architecture change are the same story told from two ends.

It is also the clearest demonstration we have seen of the point we made reading TypeSafe in code orchestrates. The model did not replace the compiler, the profiler or the test suite. It worked them harder than a person would, in a loop, against deterministic tools that told it the truth every iteration. The deterministic parts were not the scaffolding around the intelligence. They were what made the intelligence useful.

5. The loop they deliberately did not close

The safety section contains one sentence that we think is the most quietly important thing in the announcement.

DeepMind monitor the model's chain of thought and its actions during training runs, and send alerts to an incident response team. Then they say they took "careful precautions against feeding the findings back into training so as to not risk shaping Argon's reasoning to evade our monitoring".

That is a refusal to take an obvious optimisation, and the reasoning is exact. A monitor that reads reasoning in the clear works because the reasoning is not trying to be read. If you use the monitor's findings as a training signal, you are optimising against the monitor, and gradient descent is very good at finding reasoning the monitor does not flag. You would not get a safer model. You would get the same model with an unreadable interior and a clean dashboard.

The general form of this is older than machine learning: a measure used as a target stops measuring. What is unusual is a lab writing down that it noticed, and leaving the signal on the table. DeepMind go further and argue publicly that the industry should preserve reasoning transparency through this period. We agree, and we noted the same discipline in when the verifier moves inside the model: the moment the thing that checks the work becomes part of the thing doing the work, you have to be deliberate about what you are allowed to optimise.

This generalises below the frontier, which is why it belongs in an engineering note rather than a safety one. Every team running agents eventually builds an evaluator: a judge model, a rubric, a regression suite. The moment you start tuning the agent against your own evaluator, the evaluator stops being evidence. Keep a holdout the agent is never tuned against. Keep the judge's findings out of the training set. That is the same precaution in a smaller building, and we laid out the approval and audit version of it in governed autonomy.

The other safeguards are the expected set and worth recording: refusal behaviour for cyber and CBRN misuse under the Frontier Safety Framework, internal activation monitoring, red teaming by internal and external teams, leading results on Gray Swan's indirect prompt injection benchmark, and sandboxed training environments isolated and sealed before high-risk runs under the agent control roadmap. Prompt injection remains unsolved by anyone, Argon included, and "most resilient yet" is a relative claim on a benchmark that keeps getting harder.

6. What we would change on Monday

If you run agent workloads in production, three things follow from this release and none of them require access to Argon.

Move your budgets from calls to tasks. A per-call token cap used to be a meaningful cost control because the ceiling was low. It is now a per-request limit of up to twenty dollars, at one lab, with the others certain to follow. Budget at the level of the unit of work, and instrument output tokens specifically.

Delete scaffolding that exists only to beat an output limit. Chunked generation, resume-from-summary, continuation prompts: these are workarounds for a constraint that is being lifted. Every one of them is a seam where state leaks. Find yours and plan to remove them rather than carrying them forward out of habit.

Make capability tier a first class property of a request. Which identity, which tier, recorded alongside the result. You need it for audit under the EU AI Act anyway, and you are going to need it to reason about why the same model behaved differently for two callers.

The scores will be beaten inside six months. The output ceiling is a change in what shape of system is buildable at all, and that lasts longer.

7. Sources

1. Koray Kavukcuoglu, Google DeepMind, Gemini 4 Argon: our next era of frontier intelligence, 30 September 2026. Every figure, quotation and internal result above is from this announcement. The work described is Google DeepMind's; this note is our reading of it.
2. Google DeepMind, the Fairwind Program, the trusted cyber defender cohort Argon ships to first.
3. Google DeepMind, strengthening our Frontier Safety Framework.
4. Google DeepMind, securing the future of AI agents, the agent control roadmap referenced for sandbox hardening.
5. Google DeepMind Institute, the case for reasoning transparency, the argument underneath the monitoring precaution in section 5.
6. Vals Index, the GDP-weighted economic impact benchmark Argon leads, and Vals Finance Agent v2.
7. CWE-bench, the vulnerability remediation benchmark, v1 and v0.
8. Wiz and its Scan for Good initiative, the external cyber defence deployment cited in the announcement.

We have not run Gemini 4 Argon. We could not: it is not available to us or to almost anyone. Everything above is a reading of a published announcement, and announcements are written by the party with the most to gain from them. Where we have drawn a conclusion that goes beyond what DeepMind claim, which is most of sections 1, 2 and 6, it is our argument and should be argued with.

This note sits in our Engineering track, alongside the agentic, foundation models and governance threads. The full library is at Research.