Gemini 4 Argon is built for agents that run for hours. Test what happens in hour three

The first ten minutes of an agent run are the easy part. The model has a clean context, a clear goal and nothing yet to forget. The hard part comes later: after a few hundred tool calls, a context compaction, a test that fails for an unrelated reason and an instruction from a log file that looks like a command.

That is the territory Google is claiming with Gemini 4 Argon, released on October 13. Google describes it as a frontier reasoning model for “long tasks,” trained to “respect system boundaries, report negative findings honestly, and pause for confirmation before taking irreversible steps.” It is available in Gemini for business, the Gemini API (gemini-4-argon), Google AI Studio and Antigravity. On the same day it reached GitHub Copilot, generally available for Pro+, Max, Business and Enterprise plans, and Databricks added it to Unity Gateway through its Foundation Model APIs.

The number on the box and the number that matters

The model card lists a combined input and output window of up to one million tokens. The same card reports Google’s long-context results on GraphWalks: an F1 of 99.7% up to 128,000 tokens and 84.2% between 256,000 and one million. That is a strong result. It is also a reminder that the window is a capacity, not a promise of the same accuracy at every depth.

For an enterprise agent this matters more than any leaderboard. A long-running task does not fail because the model cannot reason. It fails because the evidence it needs at step 300 was read at step 12, compacted away, and replaced by a summary that dropped the one caveat that mattered. The engineering question is not “how big is the window?” but “what does the agent still know, accurately, when it makes its riskiest decision?”

Google’s own engineering account of an overnight run on its Agent Development Kit, which we cover separately, used a goal mode that pins the objective across context compactions. That is the right instinct: treat what must survive the whole run as state managed outside the model’s memory, not as something the context window will hold for you.

Security claims to verify, not adopt

Google says Argon is its most resilient model against indirect prompt injection and reports a 0.7% attack success rate across 15 adaptive attempts on the Gray Swan benchmark. That is a vendor-reported figure on a benchmark, and it measures the model, not your agent. An agent that reads tickets, emails and web pages with write access to production still needs the boundary to sit outside the model, the point we made in prompt guardrails are not a security boundary. A better model lowers the rate at which the boundary is tested. It does not replace it.

The model card is also candid about cyber capability: Google “cannot rule out” that Argon reaches the cybersecurity critical capability level of its Frontier Safety Framework, applies mitigations that block offensive tasks in the public model, and offers an unmitigated version only to vetted government, critical infrastructure and security partners through its Fairwind Program. If your security team was hoping to use Argon for penetration testing through the ordinary API, plan for refusals.

The price has a deadline

Introductory pricing is $2 per million input tokens and $10 per million output tokens through November 30, 2026. From December 1, standard pricing of $4 and $20 applies. Cached input is priced at 95% off.

Two consequences follow. First, any business case built in the next six weeks should be calculated at the standard price, because that is the price the workload will run at. Second, the cache discount makes long agent runs much cheaper when the stable part of the context (instructions, tool definitions, reference documents) is structured to be reused. Long tasks are where cost per completed task diverges most from price per token: a run that retries, loops or rereads documents can cost several times a clean one.

The model may already be on

The quietest detail of the launch sits in GitHub’s changelog. In Copilot, “new models are automatically enabled unless an administrator has turned off the global default,” and Argon is billed at provider list price under usage-based billing, with a gradual rollout. For many Business and Enterprise organizations, a new frontier model became available to developers without a decision anyone made. That may be fine. It should still be a decision, recorded in the organization’s model policy, the same distinction we drew between defaults and policies in Copilot.

On Databricks, availability through Unity Gateway means existing gateway policies, budgets and logging can apply to the new model without rebuilding the application. That is the advantage of a gateway. It does not settle data processing terms, region or behavior; those still have to be checked per model and per workspace.

What to test before you route work to it

Run Argon on your own long tasks, not on demos, and measure four things:

• Accuracy at depth. Plant facts early in a long run and check whether decisions late in the run still respect them, before and after compaction.
• Honest failure. Google says the model reports when it could not find something or finish a task. Count how often your runs end with an explicit “not done” rather than a confident partial result.
• Pauses that hold. Confirm that irreversible actions stop for approval because your runtime enforces it, then check whether the model also asks on its own.
• Cost per finished task at December prices, including retries.

A frontier model that runs for hours is a real step for enterprise agents. Hour three is where you find out whether it is the right one for your work.