Google's model card for Gemini 4 Argon, now GA, says bio and cyber critical capability levels "cannot be ruled out"; model completed 12 of 12 simulated cyberattacks

Google made Gemini 4 Argon generally available on October 13. The next day, a model card posted on DeepMind's site said the company cannot rule out that the model has reached the "Critical Capability Level (CCL)" for biology and cyber. In simulated cyberattacks, the model completed 12 of 12 tasks. Google's Frontier Safety Framework is a framework that requires mitigations to be considered before shipping a model that has reached a CCL. In this case, the model shipped with the verdict still pending, and the fact that it was pending was put in writing the day after shipping.

Ship first, measure later. The sequence is not unique to Google. OpenAI shipped GPT-6.1 Sol on September 29 and, in a safety addendum released the same day, rated the model's cyber capability at the top tier, Critical. Meta released Muse Wonder on October 12, and its safety report remains "coming soon." At three frontier companies, the order of shipping and safety verdict has reversed in unison.

What the model card says

The card says two things. The first is a withheld verdict: it "cannot rule out" that the model has reached the CCL for biology and cyber. That means there is no basis for saying the model has not reached the level. It is not an admission that it has. The second is the number, 12 of 12 simulated cyberattacks. That is not a verdict but a measured result.

Google has also published a blog post on safety and security. The self-reported figures Google gave in its general-availability announcement are as previously reported: a 0.7% success rate on Gray Swan's indirect prompt injection, and under 1% of subtasks solved in the biology red team. Those figures show that the mitigations are working. They are a separate matter from the CCL question, which asks how far the model's capability goes with the mitigations removed. The blog lays out the former, and the card withholds a verdict on the latter.

In Google's framework, a CCL is defined as a level at which a model "could cause severe harm to society." If a model that cannot be ruled out as having reached that level is made generally available, the framework's premise is that the company shows, at the time of shipping, which mitigations are holding that possibility down. The card came out the day after shipping.

The reason for the Fairwind restriction did not disappear at GA

Argon was first offered on September 30 through the Fairwind Program, limited to cyber defenders. The reason for restricting access was the model's cyber capability. That restriction was lifted on October 13, and the model expanded to the Gemini API, AI Studio, the Gemini app, and Gemini Enterprise. Meanwhile, Fairwind is expanding to "hundreds" of cyber defense partners and gives them a version with the mitigations removed.

That makes two tiers: a version with mitigations that anyone can use, and a version without mitigations that only vetted defenders can use. What the card wrote on the 14th is that Google itself has not yet determined the foundation of this two-tier structure, namely where the unmitigated capability sits. The rationale for restricting Fairwind did not disappear at GA. The verdict was deferred and remains outstanding.

The contrast with Anthropic is sharp. Anthropic has not released Claude Mythos to the general public, providing it only through the vetted tier of its Cyber Verification Program, which it expanded on October 6. At a New York City Council hearing on October 5, Logan Graham, who leads the Frontier Red Team, testified under oath that Mythos Preview was not released publicly because of its ability to write attack code. An example of a verdict that stopped a release exists within the same month.

The order reversed at three companies

Put them side by side.

OpenAI released GPT-6.1 Sol at DevDay on September 29. The safety addendum released the same day rated cyber as Critical on the grounds that the model "can find and build working zero-day exploit code." On ExploitBench, the rate of successful arbitrary code execution was 21.5%. The top-tier rating did not stop the release.

Meta released Muse Wonder and Wonder Full on October 12. The safety report still says "a full report including additional safety evaluations will be released soon." The model card PDF is image-only and its text cannot be extracted; according to secondary sources, it reportedly does not rule out that Wonder Full could reach the high threshold for CB without mitigations (unconfirmed). The model came out before the report.

Google made Argon generally available on October 13 and wrote in the card on the 14th that it cannot rule out the biology and cyber CCLs.

All three companies are honest in the content of their documents. OpenAI wrote Critical, Google wrote cannot rule out, and Meta does not hide that it has not published. What changed is not the honesty of the documents but the sequence of document and shipment. In the same month, three companies moved from "decide before shipping" to "ship, then write the verdict."

Anthropic is, for now, the only one running the other way: the system card for Opus 5.5, released the same day as the model on September 22, said it did not exceed the RSP thresholds, and Mythos has not been released. But Anthropic too has not disclosed the frequency of the incidents during evaluation that it reported on October 9, and keeping the order is a separate matter from the content being sufficient.

16 models in a month: verdicts cannot keep up

Why did the order reverse? Part of the answer lies in the release interval itself. Vals AI, a third-party evaluator, counted the models this way in an October 14 blog post.

The subject of the Vals blog is that routers directing traffic among multiple models have become a new building block. That number was placed as its premise. A pace of 16 in one month is less than two days per model. The external evaluation a safety verdict requires took 10 business days via API in the previously reported METR example. If the gap between releases is shorter than the time an evaluation takes, the verdict can only come after shipping.

The timing of Argon's general availability also appears to have been set by the commercial calendar, not the safety calendar. The day after Meta released Muse Wonder at $4 and $20, Google released at the same list price, with a half-price introductory rate through November 30. The self-reported first place on the Vals Index is in the same announcement. Price and ranking lined up on release day; the safety verdict was pushed to the next day.

The day after a letter from 406 scientists

The day the order reversed was also the day of another document. On October 13, 406 scientists from 34 countries published "An Open Letter on AI and Cybersecurity from the Scientific Community," calling for anyone developing or testing models with cyber capabilities to air-gap them (disconnect them from the network) by default. Google made Argon generally available the same day, and wrote that it cannot rule out the cyber CCL the day after. The letter names no one, but the order it asks for and the order that actually happened were exact opposites.

Around the same time, Google also laid out a path to using Argon in robotics on its developer blog. The self-reported ERQA score is 87%. With the verdict on the model's capability still pending, its uses are spreading into the physical world.

What to watch next

First, whether Google updates the card and moves beyond "cannot rule out" on the biology and cyber CCLs. If it does, whether it writes that the level was reached or was not reached changes how the October 13 general availability is judged. Second, whether verdicts from external evaluators are added to the card. Third, when Meta's safety report comes out and how it handles Wonder Full's CB threshold. Fourth, whether OpenAI, Anthropic, and Meta respond to the introductory price. If they do, the next release interval will shrink further.

There has not been a single comment from Hassabis, from the September 30 Fairwind release through this general availability. That the head of DeepMind has said nothing about the decision to ship with the verdict pending is also part of the reversal.