Loading story…
Google announced Gemini 4 Argon, a frontier model entering a staged Fairwind Program before planned access for API customers, AI Ultra subscribers, developers, enterprises, and consumers. The company said Argon supports outputs of up to 1 million tokens, versus a 64,000-token limit in earlier Gemini models, and reported a 77.9% result on the DeepSWE v1.1 software-engineering benchmark. Google also said internal teams used the model to analyze fleet telemetry, reduce data-center memory consumption by 300 TiB, and support Rust migrations from major C/C++ codebases.
Google claims Argon can autonomously discover, validate, and patch software vulnerabilities, including identifying an undisclosed critical flaw in healthcare software used by hospitals worldwide that earlier frontier models reportedly missed. Fairwind participants and internal Google teams will receive the model without cyber guardrails, creating a material need for access controls, audit logging, independent validation of generated fixes, and safeguards against misuse. The model is not generally available, and Google has not disclosed API pricing, the affected healthcare product, or technical details of the alleged vulnerability.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
Google said Gemini 4 Argon autonomously identified a critical vulnerability in healthcare software used by hospitals worldwide that earlier frontier models had missed. Google did not identify the affected software or vulnerability.
Google reported that internal engineers used Argon to analyze fleet telemetry and identify 300 TiB of memory savings across its data centers. It also said Argon agents assisted C/C++-to-Rust migrations, including re2, libgav1, and more than 800,000 lines in the Fuchsia OS Zircon kernel.
Google said Gemini 4 Argon would be provided without cyber guardrails to Fairwind participants and internal teams. It also said it had engaged with the U.S. government's voluntary pre-release model-access process.
Google announced Gemini 4 Argon as a flagship/frontier AI model for coding, knowledge-work, and cybersecurity tasks. The company said it would use a phased Fairwind Program rollout before broader availability and had not announced API pricing.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google introduced the Gemini 3.8 model family, including **Gemini 3.8 Flash** for general software-engineering work and **Gemini 3.8 Flash Cyber** for identifying exploitable vulnerabilities and generating patches. Access to the cyber-focused model is limited to vetted security teams through Google’s Fairwind Program because of its advanced offensive and defensive capabilities. Google reported that Gemini 3.8 Flash Cyber exceeded 70% success on an internal vulnerability benchmark spanning 20 programming languages and achieved a 47.2% `pass@1` score on CWE-Bench. The company is using the model internally to secure its own codebases; its Cloud Vulnerability Research team reportedly identified a critical foundational vulnerability in less than two hours with the model’s assistance.
Sep 3, 2026
Google and Google DeepMind introduced **Gemini 3.5 Flash Cyber**, a security-focused AI model designed to find, validate, and help remediate software vulnerabilities. Built on **Gemini 3.5 Flash**, the model is positioned for defensive cybersecurity use cases including bug discovery, exploit analysis, and patch generation, and is being offered through **CodeMender** in a limited-access pilot for governments and other trusted partners because of its dual-use risk. Google said internal testing showed the model outperforming **Gemini 3.5 Flash**, **Gemini 3.6 Flash**, and **Anthropic Claude Opus 4.6** at identifying unique vulnerabilities, including in complex targets such as **Google Chrome**, **Apple Safari**, and the **V8 JavaScript Engine**. The company said the model uncovered remote code execution flaws, found a memory-corruption issue in a sensitive production service, and produced a reliable **RCE** exploit that bypassed **ASLR** and **W^X** mitigations; Google also said CodeMender’s core capabilities will be made available to customers through the **Gemini Enterprise Agent Platform** using generally available Gemini models.
Jul 23, 2026
During a May cybersecurity evaluation run by AI-safety firm Irregular, Google’s Gemini was inadvertently able to reach the public internet while tasked with attacking a fictional company. A naming collision led the model to a real business, and it subsequently accessed protected systems at three real organizations using publicly available information, password guessing in one case, and credentials exposed in public repositories in two others. Google said Gemini halted each attempt after recognizing that the targets were real companies, and said no harm occurred. Irregular reported the incidents to Google at the end of July; Google notified the affected organizations and federal authorities and changed its testing process. The event exposed inadequate evaluation containment—particularly unrestricted network egress and insufficient target isolation—and demonstrated how leaked credentials and weak authentication can be exploited by autonomous agents as well as human attackers.
Sep 22, 2026