Gemini 4 Argon Released: 1M Token Output and the Real Capability Limits of AI Agents

Google DeepMind has finally unveiled the new flagship of the Gemini series — Gemini 4 Argon. But unlike previous launches, most people won't have access to it just yet. On September 30, Google announced it would first release the model to a small group of trusted cybersecurity defense teams, with broader access for developers, enterprises, and general users coming later, pending further testing and safety measures.

As analyzed by Bilibili creator Nana, the real story here isn't about how well the model answers a single question — it's about whether it can continuously complete complex, multi-step work. Google has already used it internally to analyze data center performance, migrate hundreds of thousands of lines of code, and optimize video decoders. At the same time, some Google employees have raised questions about its real-world coding performance, and third-party benchmarks have produced intriguingly mixed results. This article breaks down where Argon genuinely excels, and what problems remain unsolved.

1M Token Output: Making Room for Continuous Tasks

The most visible change in Argon is the expansion of single-output limits from 64K tokens to 1 million tokens. It's worth distinguishing two concepts here: the output limit refers to the generation space the model can use within a single continuous task, while the context window refers to how much material the model can read in — these are separate metrics.

Google wants the model to sustain continuous reasoning within a single task trajectory, generating hundreds of thousands of tokens to handle longer, more complex problems. Notably, Artificial Analysis used Gemini API's long-output continuation feature during testing — long responses can be paused and then continued through subsequent calls, ultimately enabling reasoning across up to 1 million output tokens while avoiding request timeouts.

This shows that long tasks require not just model capability, but also API infrastructure that can "catch" continuous generation. What users see as a single piece of work may involve multiple API calls under the hood. A concrete example makes this clearer: migrating a codebase requires understanding the original implementation, modifying code, checking compilation, running tests, and adjusting based on results — each step's new information changes what comes next. A larger output budget means these continuous steps have a better chance of being executed with greater depth.

Tokens are the basic units that large language models use to process text, roughly corresponding to one English word or half to one Chinese character. 64K tokens is roughly equivalent to 40,000–50,000 Chinese characters, while 1 million tokens is comparable to a medium-length novel. Traditional API calls often have strict limits on single-request duration and size, and timeouts or overruns can cause tasks to fail. Google's "long-output continuation" mechanism essentially splits a logically continuous task into multiple physical requests, passing the state and progress from each call to the next — working around hard per-request limits at the application layer. This is especially critical for engineering tasks: code refactoring or system migration isn't a one-shot Q&A, but requires accumulating dozens of intermediate conclusions within the same "thread of reasoning" before producing a final solution.

Internal Case Studies: From Video Decoders to Kernel Migration

Among Google's disclosed internal cases, the LibGav1 open-source video decoder is the most worth examining in depth. The Argon agent worked with an existing Rust port of the library, conducting multiple rounds of performance profiling experiments and studying compiler output to replace approximately 32,000 lines of SIMD code.

SIMD can be understood as letting a processor handle multiple data streams simultaneously with a single instruction — in compute-intensive workloads like video, this directly affects speed. Argon rewrote the relevant code in safe Rust, letting the compiler handle vectorization automatically. The result: the new decoder maintained identical video output while running at 2.7× the speed of the original Rust port, bringing it closer to the performance of the optimized C++ implementation.

The value of this case study is concrete: the model had to simultaneously satisfy safety, performance, and output correctness. Simply translating code into another language is far from enough — it needed to find an implementation that balanced all these requirements through experimentation.

Google is also using Argon for large-scale C/C++-to-Rust migration efforts, ranging from tens of thousands of lines in core libraries to over 800,000 lines in the Zircon kernel of the Fuchsia operating system. Rewrites of these critical systems still go through automated and human auditing, simulation testing, and code review before reaching production. The model drives the work forward; testing and review determine whether the results are usable. The larger the task, the more important this boundary becomes — a local change looking correct and the entire system running reliably are two very different things.

In a data center case, a group of Argon agents analyzed performance telemetry data across an entire server cluster, autonomously identified and applied memory optimizations, and freed over 300 TiB of memory after deployment, with projected total savings of 500 TiB to 1 PiB. In a separate quantum algorithm optimization case, Argon improved a bottleneck subroutine's time-space resource consumption by 40% compared to published baselines — in a matter of minutes.

SIMD (Single Instruction, Multiple Data) is a class of parallel computing instruction sets in modern processors, allowing a CPU or GPU to perform the same operation on multiple data elements simultaneously with a single instruction. In video decoding, for example, a single frame consists of millions of pixels — processing them one by one is extremely inefficient. SIMD lets the processor operate on 8, 16, or even 32 pixel values in a single clock cycle, dramatically improving throughput. Hand-written SIMD code is typically tailored to specific CPU architectures (such as AVX2 on x86 or NEON on ARM), making it non-portable and prone to introducing security vulnerabilities. Argon's approach was to replace hand-written SIMD with high-level code conforming to Rust's safety guarantees, then rely on the compiler's auto-vectorization to generate equivalent low-level instructions — achieving safety while approaching hand-optimized performance. The complexity lies in the fact that compiler auto-vectorization isn't always optimal; the model needed to run multiple experiments to find code patterns that would trigger efficient optimization from the compiler.

Recursive Self-Improvement: Optimism vs. Evidence

These engineering capabilities have sparked discussion around a broader topic — recursive self-improvement (RSI). DeepMind researcher Zirui Wang expressed optimism in a post, joking that the model has now surpassed him and it's time to pursue his barista dreams.

RSI describes a cycle where a model participates in improving models, and the improved model is then better at the next round of improvement — with each iteration raising both capability and the means to continue raising capability. The critical question is whether this cycle can sustain itself.

What Google has demonstrated so far involves agents finding solutions, testing results, and optimizing in specific engineering tasks. But bridging "models helping improve engineering systems" and "models improving the cycle of their own development" still requires more concrete evidence. A researcher's optimism reflects their judgment; the public case studies show engineering progress as disclosed. These two things need to be evaluated separately.

Recursive Self-Improvement (RSI) is one of the central topics in AI safety research, first systematically articulated by AI safety researcher Eliezer Yudkowsky. The theoretical concern is that once an AI system becomes capable enough to participate in improving its own training process, capability gains could form a positive feedback loop, accelerating rapidly on timescales that humans cannot easily intervene in. In practice, AI model training involves many stages — data preparation, architecture design, hyperparameter tuning, infrastructure engineering — each with significant human expert involvement. Even if a model can improve efficiency in certain subtasks, a "fully closed-loop self-improvement cycle" remains far from current reality. Distinguishing between "model-assisted research engineering" (already demonstrated) and "model-driven exponential capability growth" (yet to be verified) is essential for accurately understanding current progress.

Benchmark Splits: #1 in Text, #8 in Web

Argon posts strong scores on several real-task-oriented evaluations: 77.9% on Deep SWE V1, 51.3% on Automation Bench (measuring end-to-end business task execution), 91.7% on LV Bench (long video understanding), and 19.6% on a legal agent evaluation — notably higher than other models in the comparison. These tests aren't asking whether the model can explain concepts; they're asking whether it can drive tasks to completion.

But Argon's strengths are distributed unevenly. It leads on Deep SWE, yet scores only 55% on Frontier SWE V2, behind GPT-6 Astra's 65.5%. On Terminal Bench 4.0 it scores 57.4%, while Claude Opus 5.5 scores 65.

The divergence is more pronounced in third-party evaluations. In Arena results, Argon ranks #1 in Text Arena with 1,525 points, excelling in text categories like code, hard prompts, and instruction following — but ranks only #8 in Code Arena, which measures web development capability. Writing good text and building good web pages require different skill combinations; the latter also involves interface details, layout, and interactivity.

This also makes the internal Google disagreement easier to understand: some employees feel that Gemini 4's real-world coding performance doesn't match its benchmark scores, with frontend design being a particular weakness; other employees familiar with development consider the model frontier-level; Google itself has pushed back, calling claims of poor coding performance inaccurate. For users, the type of tasks they work on is a more useful reference than an overall ranking.

Hallucination Rate and Accuracy: Knowing When You Don't Know

Another notable difference appears in how the model handles questions it doesn't know the answer to. In Artificial Analysis's Intelligence Index, Argon in high-reasoning mode scores 53 — on par with GPT-6 Astra in maximum-reasoning mode. In the AA Omniscience test, Argon's hallucination rate is 15%, the lowest among models scoring 45 or above in the Intelligence Index.

In the same test, however, Argon's accuracy rate is 50%, below Astra's 63%. Artificial Analysis explains this as: Argon tends to say it doesn't know rather than offer an incorrect guess. Together, these two numbers paint a complete picture — its rate of correct answers has its own ceiling, but it's more willing to stop when uncertain.

For knowledge work in fields like law and finance, this behavioral tendency has practical implications: an explicit gap that's left open can be followed up with additional research or handed to a specialist, while a fluently written wrong answer may get carried forward unchecked into subsequent work. What users really need is a clear separation between reliable conclusions and open questions.

The Cost Equation: Low Unit Price ≠ Low Bill

Argon's introductory pricing is $2 per million input tokens and $10 per million output tokens, with cached input prices reduced by 95% (to $0.10 per million tokens). For tasks that repeatedly draw on the same material, the caching discount significantly affects total cost.

But how much a workflow ultimately costs also depends on how much content the model generates. In Artificial Analysis testing, Argon in high-reasoning mode averaged approximately 62,000 output tokens per task, compared to roughly 27,000 for Astra. At introductory pricing, Argon's average cost for this task set was $1.99, about 60% of Astra's cost. Estimated at standard pricing, it would be $3.98 — about 1.2× Astra's cost.

In other words, Argon's current cost advantage is tightly tied to its introductory discount. Longer reasoning trajectories create room for complex tasks, but also consume more tokens. The 1M token limit is the capacity available for a task; 62,000 is the actual average usage. For enterprises considering integrating it into workflows, the comparison needs to weigh task outcomes, usage volume, and pricing together — whether a lower per-call price translates to a lower final bill depends on the specifics of the actual workload.

Opening with Cybersecurity: The Other Side of Continuous Capability

Google's decision to open Argon first in the cybersecurity space illustrates the other side of continuous execution capability clearly. Argon can autonomously find, verify, and fix vulnerabilities. Security firm Wiz has already been using it through the Scan4Good project, providing free high-risk exposure scanning for critical public infrastructure. In one early demonstration, Argon identified a critical vulnerability in a medical software system used by hospitals worldwide — involving exposure of sensitive personal information — that previous frontier models had failed to detect. On the vulnerability fixing benchmark CWE Bench V1, Argon ties for first place with a score of 68%.

The problem is that the same analytical capability could be used to find attack vectors. Google has therefore first made the version without cybersecurity guardrails available to trusted defense teams through Frontier Safety-related programs, while also strengthening anti-abuse measures, prompt injection protections, and runtime monitoring.

Indirect prompt injection refers to a situation where external material the model reads contains malicious instructions designed to redirect the model's behavior — if the model treats these as new commands, it deviates from its original task, and for agents capable of continuous action, this deviation can propagate through the entire workflow. Google has deployed mechanisms to monitor both the reasoning process and actual actions, with the ability to halt execution when necessary. It also emphasizes avoiding direct feedback of monitoring findings into training, to reduce the risk of the model learning to evade detection.

Indirect Prompt Injection is a class of attacks uniquely targeting autonomous AI agents, distinct from directly entering malicious instructions into a chat interface. Instead, the attack payload is hidden within external content the model actively reads — such as web pages, documents, emails, or code comments. When a model crawls a webpage or analyzes a file, if security mechanisms are insufficient, these hidden instructions may be misinterpreted as legitimate commands from the user, causing the model to execute malicious operations such as data exfiltration, privilege escalation, or task hijacking. For models that only handle single-turn Q&A, the risk is limited. But for long-task agents capable of continuously invoking tools, accessing file systems, and making network calls, a single successful injection can propagate across the entire workflow, producing ongoing effects across multiple subsequent steps. This is precisely why Google placed particular emphasis on prompt injection protection before opening access to the high-autonomy version.

Conclusion: Competition Has Shifted to "Sustained Work"

The most substantive part of Argon's launch is how it shifts the competition for flagship models toward the ability to sustain continuous work. Code migration, memory optimization, and security patching give concrete examples of what that looks like; meanwhile, the divergence across benchmarks, internal usage disagreements, and task costs leave the remaining open questions in plain sight.

For ordinary users and enterprises, the evaluation criteria are shifting from "how well does it explain things" to "how far does it get, and where does human handoff still need to happen." Lower prices reduce the barrier to trying it — but reliably completing tasks will determine whether it's worth adopting long-term.