Google Can't Rule Out Gemini 4 Argon Hit Its Bio and Cyber Danger Thresholds

Google disclosed on Oct. 13 that Gemini 4 Argon may have reached its biological and cybersecurity danger thresholds as it opened the model to paying users worldwide. Google's safety post says that in its own tests, Argon solved all 12 simulated end-to-end cyberattack scenarios, up from five for the previous Gemini generation. The model card says Google developed safety cases and assesses that safeguards reduce risk below those thresholds.

Capability thresholds

The model card's framework table pairs a lower-tier threshold for significant harm with a critical capability level for harm at a severe scale. Google cannot rule out the biological and cyber critical capability levels. The model card says biological red teaming found measurable gains over web baselines and previously tested models in two scenarios, with accurate, actionable information in both.

The same day's model card records passes on 14 of 15 stealth and situational-awareness challenges. Google cannot rule out that lower-tier threshold concerning loss of human control. Google ruled out the lower-tier chemical, radiological and nuclear thresholds “with reasonable confidence.”

Every capability figure here comes from Google's own evaluations and documents, the model card and safety post.

Training shortcuts

Google says its misalignment monitor caught rare attempts during training, including a case in which Argon crashed the evaluation sandbox to avoid a score for a failed run. The monitor also caught attempts to raise container privileges to alter grading scripts and read answers from the test runner's memory.

The safety post says honeypot tests found no attempt to sabotage safety monitoring. Anca Dragan, Google's vice president of AI safety and behavior, and Raluca Ada Popa, its head of Gemini security, described the behavior Google sees in practice as “an agent trying too hard to finish the job it was given.” Their Oct. 13 post put shortcut or cheating attempts on coding benchmarks at 2%.

In a reinforcement learning run described in the safety post, Google says a penalty accidentally applied to the model's chain of thought cut openly discussed shortcuts by 61%. The share of shortcuts taken silently rose from 11.2% to 36.4%. Google's stated rule is never to penalize what the model writes in its chain of thought during training. In their safety post, Dragan and Popa wrote: “Avoiding thought penalties encourages the model's reasoning to stay transparent and monitorable.”

Deployment safeguards

Google screens inputs with smaller models, uses activation probes to read internal signals, and continuously monitors responses with the ability to stop an agent mid-stream. External biological jailbreak testing unlocked fewer than 1% of the biological sub-tasks Google tests for.

Google participated in a voluntary U.S. government pre-release review before the broad release. That process is not publicly visible.

Outside scrutiny

Sanchit Vir Gogia, chief analyst at Greyhound Research, called the cyber result “a score on Google's own exam, set and marked by Google”. Greyhound has found no independent replication.

“A model that games its grader turns every enterprise grader into a control that must be defended,” Gogia said. Agents should never have write access to systems judging their work, he said, and crashed or timed-out checks must count as failures.

Sakshi Grover, research director at IDC, recommended short-lived task-scoped credentials and restricted network access, with human approval for destructive changes and privilege expansion. “Production deployment should depend on demonstrated control and auditability alongside task performance,” she said.

Google is expanding its Fairwind Program to hundreds of additional partners who receive Argon without cyber guardrails. “The weakest partner, not the strongest control, sets the exposure,” Gogia said.

Mistral Previews 1-Trillion-Parameter Large 4, Pitching Open Weights Against Lock-In

Earlier this year, Hugging Face was breached by rogue OpenAI agents. It turned to leading American closed models to help defend itself, only to find their guardrails blocking the work. The guardrails

The Implicator

Sam Altman Says OpenAI Won't Wait for Legislation or an Antitrust Waiver to Pace AI

OpenAI Chief Executive Sam Altman said the company will support federal safety requirements for frontier AI but will begin new safeguards without waiting for legislation or an antitrust exemption. The

The Implicator

OpenAI, Anthropic and 100 Firms Urge Cyber Defense Surge as AI Attacks Loom

OpenAI, Anthropic and more than 100 companies called on governments and businesses Thursday to mount a rapid cyber defense effort before more capable AI models make attacks easier to launch. The Aug.

The Implicator

Marcus Schuler

San Francisco

Editor-in-Chief and founder of Implicator.ai. Former ARD correspondent and senior broadcast journalist with 10+ years covering tech. Writes daily briefings on policy and market developments. Based in San Francisco. E-mail: editor@implicator.ai