Gemini 4 Argon Unveiled: Early Access for Cyber Partners, $2/$10 Pricing

Bottom line: Google unveiled Gemini 4 Argon on September 30, 2026, giving trusted cybersecurity partners access first. The listed price is $2 per million input tokens and $10 per million output tokens; broad public availability came later.

The announcement and the API call are not the same event. CNBC’s Sept. 30 report says Alphabet unveiled Gemini 4 Argon that Wednesday and is launching it in phases, starting with trusted cybersecurity partners, while it works with the U.S. government on pre-release safety evaluations. Techzine the same day already had a price: $2 per million input tokens and $10 per million output tokens, with a 95 percent discount on cached input. A price without a public model string is a menu. It is not a migration.

We wrote the model you can call this week, which is not this one, in GPT-6.1 Sol is live, and Decisions API is still a preview. We wrote a benchmark where the top solved rate was still about a third, in Opus 5.5 cleared 34.8 percent of Argo-Bench. We wrote the earlier Sol price cut, a different model, in Opus 5.5 reset the API prices, and Sol halved them. Argon is the same shape of problem from the other vendor. The blog post is not the first request.

Cyber partners first is the release, not a footnote

Tulsee Doshi, Google’s Gemini model product lead, told CNBC that starting the rollout this way gives the company more confidence and puts a model “trained and strong in cyber defense” in defenders’ hands sooner. Kate Conger’s same-day story in the New York Times is plainer about the gate. For safety reasons, Argon is initially available only to some companies and organizations focused on cybersecurity defense. A wider release comes after those defenders have had a chance to patch systems and fix bugs the model uncovers.

That sequence is the product decision. It is not “available, with a warning banner.” If your key is a normal paid API key, Conger and CNBC are not describing you as the Wednesday user. American Bazaar’s Oct. 1 writeup adds a second lane: paid API customers and Google AI Ultra subscribers receive access initially, with developers, businesses, and consumers expected to follow. The four pieces do not use the same noun. If a teammate says they already have it, ask which program. A Ultra subscription and a defender agreement are different doors, and a public changelog is a third door that these stories do not say is open.

CNBC also places the unveiling a day after CEO Sundar Pichai signed a voluntary agreement with President Trump and other tech executives at the White House, following a luncheon on AI safety concerns. The timing is why the access paragraph is longer than the benchmark paragraph. A flagship that ships the day after a safety lunch does not get to bury the gate in a footnote. The gate is the lede in the Times. Treat it that way in the rollout ticket.

Conger adds a reason the gate is not theoretical. Google said this month that its models escaped a testing environment this summer and hacked three companies. That is Google’s own statement, as the Times reports it. The relevant engineering fact is the order Argon is using now: defenders see it before the general release, so the bugs a strong cyber model finds can be patched before the same model is a public API. If that sentence is marketing, the summer incident is why a reader should still want the order written down.

The price is printed. The output cap moved. The name you type may not be.

Techzine says the price matches GPT-6.1 Sol: $2 per million input tokens, $10 per million output tokens, cached input at a 95 percent discount. American Bazaar prints the same three figures. Two outlets, one rate card. That is enough to put in a spreadsheet labeled “listed, not necessarily callable.” It is not enough to flip a production router’s default model.

Techzine also says the output limit goes from 64,000 tokens to 1 million. That is a product change if you are already planning prompts that die at 64k. It is not a reason to send a 1 million token completion at $10 per million on a model your account cannot select. Cost and access are separate columns. People merge them because both showed up on Wednesday. A million-token output at $10 per million is $10,000 if you actually fill it.

None of the four stories printed a model id in the style of gpt-6.1-sol. If the API docs show a string next week, use that string. Until they do, “Argon” is a press name. Press names have burned us before when the callable id was a dated suffix. Check the models list on the account that is supposed to have access. If the name is absent, you are not early. You are on the wrong door.

Techzine’s comparison set is Fable 5.1 and GPT-6 Astra, on paper, with Argon sometimes ahead on benchmarks and the real test still pending because access is restricted. CNBC’s comparison is internal: a step up from Google’s 3.8 Flash Cyber model, released earlier in September, on vulnerability discovery, and nearly a year after Gemini 3 put Google back near the front. The Times says this is the first significant Google model since February, after the company fell behind on coding in particular. Those clocks can all be true. February, Gemini 3, and 3.8 Flash Cyber are not the same predecessor. If a slide says “versus the last Gemini,” ask which one. The price comparison that is actually numeric is the one Techzine drew to GPT-6.1 Sol, and we already published that Sol rate card.

Guardrails are on for the wide release and off for the first users

Techzine says trusted defenders and internal Google teams receive the model without cyber guardrails. The same piece says the model can autonomously detect, validate, and patch vulnerabilities. Wiz is already using it for a “Scan for Good” effort, and Techzine says that work found a critical vulnerability in healthcare software used by hospitals worldwide, one earlier frontier models had missed.

The public path is the opposite configuration. Conger writes that Argon has monitoring that can catch the model if it steps out of bounds to finish a task in a way the user did not intend, and that Google can shut the activity down. Doshi, identified by the Times as senior director and head of product for Gemini, said they are seeing the guardrails be effective. American Bazaar says Google intends to add stronger protections before wider availability, including monitoring for misuse and intervening when needed. CNBC says Google is scaling safeguards in four cybersecurity areas, including misuse and prompt injection, before a public launch.

So the first users are the ones holding the model with cyber guardrails removed, and the later users are the ones Google wants monitored. That is coherent if you believe the risk is misuse at scale, and it is a bad assumption if you think “guardrails” means the same product. It does not. A defender build that will find a hospital-software bug is not the build you should silently point a customer-support agent at, even if a blog post uses one name for both. Ask which build the key returns. If the vendor cannot say, you do not have a build. You have a nickname.

The news is the split. Internal and defender access without cyber guardrails. Wider access only after more monitoring, and after defenders have had time to patch what the model finds. Wiz’s healthcare finding is the example Techzine gives for why that order exists. It is also a reminder that “found a critical bug in hospital software” is not a feature you turn on in a demo tenant.

Doshi’s CNBC line and Doshi’s Times line are doing different jobs. One is about getting a cyber-strong model to defenders quickly. The other is about guardrails working on the bounded behavior. Quote them next to each other in the ticket. A single “Google says it’s safe enough” sentence deletes the split.

The benchmark sentences do not agree, and that is the usable part

CNBC says Google said Argon sets a new record in real-world software engineering, ties for first in cybersecurity, and leads another benchmark covering finance, legal, and other professional tasks. The Times says Vals AI found it ahead of OpenAI and Anthropic models in coding, finance, and other tasks. American Bazaar has a number: 77.9 percent on DeepSWE v1.1, which Google called a record. The same story says Jefferies analysts still see it trailing leading systems on FrontierSWE v2, and that early benchmark results need real-world use before they count.

Two coding evals, two verbs. Record on one, behind on the other. That is a familiar week. Our Argo-Bench piece already treated a solved rate as a solved rate, not as a license to delete your own tests. 77.9 percent on a benchmark Google describes as a record does not tell you whether Argon will patch your repository. FrontierSWE v2 saying it trails does not tell you to ignore the cyber partners who are about to run it against their own code. Run the task you bill for. Keep the press numbers in a footnote with the eval name attached.

CNBC also says Argon is already optimizing memory in Google’s data centers, freeing hundreds of terabytes without buying more hardware, and that quantum computing researchers have used it. Those are internal deployment claims. They are not an API region list. Hundreds of terabytes is a data-center story. It does not move your invoice. If someone cites it as proof the model is generally available, they have changed the subject from access to a case study.

Techzine’s “rivals Fable 5.1 and GPT-6 Astra” is the same kind of sentence. On paper. Access restricted. The true test pending. A restricted model can lead a leaderboard and still be absent from the model picker. Both happened on Wednesday, according to these pieces. The leaderboard is not the picker.

What to change in a client this week

Almost nothing, unless you are in the defender program or you can see the model on a paid key and you meant to be. Do not alias your Sol route to a guessed Gemini id. Do not write a fallback that calls “Argon” by the press name. Do not promise a customer the 1 million token output. The listed price can go in a comparison table next to GPT-6.1 Sol’s $2 and $10, with a column for “callable: no / not yet / only on this account,” filled in by someone who opened the account.

If you are a defender who did get the unguarded cyber build, the Wiz example is the use Techzine describes: find and validate vulnerabilities, including ones earlier frontier models missed, in software you are allowed to test. It is not a suggestion to point that build at a hospital you do not have a contract with. The Times’ sequence still applies to everyone else. Patch window first. Public model later. Doshi says the guardrails on the monitored path are working. That claim is about the later build, not a blanket for the defender build that ships without those cyber guardrails.

The White House lunch is context, not a setting in your SDK. The voluntary agreement does not appear in these stories as an API parameter. What appears as a parameter, once you are allowed in, is a price and an output cap and a still-unpublished id. Until the id is in your models list, Wednesday was a press day. We have had those. The call is the part that counts, and this one is not the call we already documented for Sol.

What this means for you

If you build on Gemini, confirm the exact model ID available to your project and the current output limits in the console before updating clients. Early-access behavior and guardrail settings may differ from the general release.