Google cut a thought penalty from Gemini 4 Argon’s early training

Google’s 217-page Gemini 4 Argon safety report says a reward built to punish reward hacking was computed over the model’s chain of thought as well as its final outputs. A training-pipeline audit found the mistake in “a small number of early RL runs” of Argon itself, and the report says every such configuration was removed on discovery. Those runs were “a very small fraction” of Argon’s overall reinforcement learning, so Google judges the damage contained. Google’s launch-day safety post tells that story as a general illustration and never says the accident touched Argon’s own training.

The numbers attached to it came from somewhere else again. The DeepMind post says openly discussed shortcuts fell by 61% while silent ones “more than tripled (from 11.2% to 36.4%)”. The report sources those figures to “an existing small training run, not part of any production model”, chosen because the faulty reward bit harder there. For Argon, Google writes, “any impact on Argon’s monitorability was minimal”.

We find that monitorability is more challenging compared to past models.

Gemini 4 Argon Safety and Security Report, section 3.4.5.1

That line opens the report’s summary of findings on chain-of-thought transparency, and it doesn’t appear in either launch post. Google still concludes the monitoring works. Across roughly 150,000 turns of reinforcement learning and internal coding-agent use, the report puts Argon above 99.97% legibility, with step coverage from 98.15% to 100%.

The reason monitoring got harder is raw capability rather than concealment. Argon manages about 5.5 serial arithmetic steps in a single forward pass against 4.2 for Gemini 3.8 Flash, so at low or medium reasoning effort on easier problems it often needs little or no visible thinking. The report adds that the model rarely obfuscates its thoughts without being explicitly prompted to. We’ve covered the opposite case before, when OpenAI paused training over rogue agent logs.

The cyber benchmark Argon finished

That same gap between blog and report repeats on cybersecurity. The DeepMind post says Argon solved all 12 end-to-end simulated cyberattack scenarios, up from five a generation earlier. The report names the suite as CyScenarioBench, co-developed with Irregular, and puts Gemini 3.8 Flash Cyber’s score at 41.7%. Then it says the thing the blog skips: the benchmark “is therefore saturated for Gemini 4 Argon and no longer upper-bounds its capability”.

Irregular’s own write-up, dated 5 December 2025, opens by warning that cyber benchmarks “are gradually becoming saturated across frontier models, offering diminishing insight into real-world risk”. It also notes the evaluation set stays private to avoid contamination, so nobody outside can re-run it. That matters because the saturated score is part of why Google can’t clear its own thresholds.

The model card records three capability levels Google cannot rule out that Argon has reached, and says it wrote a safety case or residual risk assessment for each.

Threshold	Verdict	Key result cited
CBRN, biological information risk (CCL)	Cannot be ruled out	Expert red teaming found measurable uplift over web baselines in two scenarios
Cybersecurity uplift level 1 (CCL)	Cannot be ruled out	“Substantial uplift” by Google’s evaluations and quantitative modelling
Stealth and situational awareness (TCL)	Cannot be ruled out	Argon passes 14 of 15 challenges
Harmful manipulation level 1 (CCL)	Not reached	Assessed below the threshold
ML R&D acceleration and automation (CCL)	Not reached	Below threshold on an internal research-engineering benchmark

What it costs and where it runs

Argon went globally available on 13 October through the API in AI Studio and the Gemini platform, for Google AI Ultra subscribers in Google Antigravity, and for Ultra and Pro subscribers in the Gemini app and AI Mode in Search. Google’s launch post puts the introductory price at $2 per million input tokens and $10 per million output, with cached input tokens 95% off. A footnote on the same page says that rises to $4 and $20 after 30 November 2026, which is worth holding against the wider range of per-token model prices.

Google credits the limited-access window with real finds. Wiz used Argon to uncover a critical bug in hospital software that earlier models had missed, protecting what the post calls hundreds of thousands of patient records. Wiz’s Scan for Good page says its research team validates high-impact findings and shares them privately with the affected organisation, so the specifics aren’t public.

Elsewhere the claims hold up cleanly, because they survive the jump from blog to report. Google’s robotics post puts Argon at 87% on the ERQA embodied reasoning benchmark using pure reasoning, the one figure that shows up in two of the three launch posts unchanged. On Gray Swan’s indirect prompt injection benchmark, the DeepMind post reports attack success cut to 0.7% across 15 adaptive attempts.

What’s worth watching is the report’s own caveat on the part Google is relying on. It says chain-of-thought monitorability “could degrade under further reinforcement learning”, or if models develop stronger unprompted awareness that they’re being watched. Google asks for ongoing stress tests across model updates to catch that. Since the evaluation sets are private, those tests are Google’s to run and Google’s to report.