Google announced a new frontier model on Tuesday, September 30, and almost nobody can use it. It went to a vetted list of cyber defenders and to Google’s own internal teams, and the company said plainly that those groups get it with the cyber guardrails removed. Everyone else waits, not for better weights, but for guardrails Google is still iterating on.

The day before, OpenAI spent a keynote moving agent execution onto its own infrastructure. Two days later, two research fellows said that running frontier models internally with the safety measures switched off is already ordinary practice.

Three separate stories, and the same object sits at the center of all of them. It is not the model.

The one thing that matters

The weights are finished. The guardrail is the product, and the best configuration of a model is usually not the one on sale.

Issue 005 ended on the claim that refusal rate is a capability number and that no vendor publishes it. That gap closed faster than expected, and not through a benchmark. Google published the number as a product boundary instead: there are two builds of Gemini 4 Argon, one with cyber guardrails and one without, and which one you get depends on who you are.

Once that is on the table, a benchmark score is not even the second most important thing you need to know about a model. The first is which configuration you are allowed to run.

Stories worth your time

Google shipped its frontier model with the cyber guardrails off, to a list it chose

Gemini 4 Argon was announced on September 30 and is, in Google’s words, “rolling out to a set of trusted cyber defenders through our Fairwind Program.” The specification is a real step. Output is capped at one million tokens, “up from the previous 64K tokens,” which changes what a single long-horizon task can emit rather than only what it can read. Introductory pricing is $2 per million input tokens and $10 per million output, with a 95% discount on cached input, moving to $4 and $20 later. Google reports 77.9% on DeepSWE v1.1, 51.3% on AutomationBench, 91.7% on LVBench, and 68% on CWE-bench v1, which it describes as tied for first.

Then there is the sentence that makes this the week’s story: “For trusted defenders and our own internal teams at Google, we’ll be releasing Argon without cyber guardrails so they can leverage its full frontier-level cybersecurity defense capabilities.”

Read the general-availability sentence next to it. Google says it will “continue to gather feedback from early testers as we iterate on guardrails before making Argon available to developers, enterprises, and consumers as soon as possible.” The model is done. What is being built before release is the refusal policy, and the holdup is explicitly that work and not the capability.

The Fairwind Program itself is not new. Google launched it on September 2 as “a limited access program for governments and trusted partners to use our cyber defense tools,” with more than 650 partners, priority for governments, critical infrastructure operators, and core technology platforms, and real conditions attached: participants must limit access to their own security, incident response, or penetration testing staff and deploy protections like multi-factor authentication. What it carried in September was a specialized cyber model, Gemini 3.8 Flash Cyber, paired with the CodeMender harness.

The change this week is that the program now carries the flagship, ahead of the people paying for it, in a build the paying tier will not get.

This continues Issue 002, which reported that the strongest version of each frontier model had moved behind an eligibility check. That framing needs an upgrade. The eligibility check no longer decides only which weights you reach. It decides which refusal policy is wrapped around them, and the vetted build is the one with fewer refusals rather than more capability.

It also answers the open question from Issue 005 more bluntly than a benchmark could. That issue reported six frontier models declining at least 98% of an end-to-end defensive security benchmark, and argued that refusal rate is a policy rather than a limit. Google has now confirmed the policy reading by shipping both settings. The 98% was never the model’s ceiling. It was the configuration everyone outside a trusted list is given.

Google is clear about why the gate exists, and the reason is not frivolous: the guardrails are there “to prevent bad actors from using Argon for cyber or chemical, biological, radiological, and nuclear (CBRN) attacks,” and the model is “designed to refuse harmful requests while preserving legitimate, dual-use scientific research, as per our Frontier Safety Framework.” That is defensible. It is also an admission that the buyable model is a deliberately limited instrument, limited to a threat model you are not shown.

Builder implication: record the configuration you are entitled to, not the model name. If your product depends on work a safety policy may read as dual-use, the question for a vendor is not how capable the model is. It is which build you qualify for, what that build declines, and whether a more capable one exists that you cannot buy.

Two models tied on the index and failed in opposite ways

Artificial Analysis measured Argon within days and put Google back among the top three labs on its Intelligence Index: Gemini 4 Argon at high effort scores 53, level with GPT-6 Astra at max effort, and one point ahead of GPT-6.1 Sol at max. On Terminal-Bench 4 it reports Argon at 57%, behind Claude Sonnet 5.5 at 64%, Claude Opus 5.5 at 60%, and GPT-6 Astra at 59%. Argon spends about 62,000 output tokens per index task against roughly 27,000 for Astra, and lands at $1.99 per task on introductory pricing against $3.26 for Astra.

The composite scores are a near tie. The behavior underneath them is not remotely similar.

On AA-Omniscience, a 6,000-question factual benchmark across business, humanities and social sciences, science and engineering and mathematics, health, law, and software engineering, Argon hallucinates on 15% of questions with 50% accuracy. GPT-6 Astra at max effort hallucinates on 51% with 63% accuracy. GPT-6.1 Sol at max hallucinates on 54%. The resulting composite scores are 42 for Argon, 43 for Astra, and 42 for Sol.

So one model is right more often and confidently wrong more than three times as often, and the index cannot tell you apart from that. Whether those are interchangeable depends entirely on what your product does when the answer is wrong, which is a property of your system and not of the leaderboard.

The reason the underlying numbers are visible at all is worth copying. Artificial Analysis says the Omniscience Index “rewards correct answers, penalizes hallucinations, and has no penalty for refusing to answer,” on a scale from -100 to 100 where zero means a model is right as often as it is wrong. That design is the refusal-bucket idea from Issue 005 implemented as a scoring rule rather than a reporting habit, and it is why a cautious model with middling accuracy can finish level with a confident one.

It is also the correction that issue needed. Issue 005 argued that a number is meaningless without its harness and effort setting. True, and insufficient. Here one third party ran one harness and disclosed the settings, and the headline number still hid the most consequential difference between two models. A composite is a judgment about which failures matter, made by someone who does not know what you are building.

Builder implication: stop shortlisting on a composite. Pull the two components you actually care about, accuracy and confident error, and rank on the one your product cannot absorb. A model that abstains is not a weaker model; it is a different contract, and it may be the cheaper one once you price the cost of a wrong answer reaching a user.

OpenAI moved the agent’s computer onto its own infrastructure

OpenAI’s own DevDay announcement thread on September 29 is a long list, and the infrastructure items matter more than the consumer one. The Agents API is “in public beta, with hosted execution, memory, tools, and multi-agent support.” Computer use “in the Agents API lets agents operate software through its UI.” A Decisions API is in limited preview and “uses Luna to classify inputs, route requests, or choose an action from predefined answers.” Ultrafast is a paid speed tier, with OpenAI reporting up to 8 times faster token generation in Codex and 6 times in the API.

The developer changelog is more specific about what hosted computer use means: agents “complete tasks in an OpenAI-hosted browser, with website access approvals and sign-in handled by your application.” Compare that to the existing computer-use guide, where the division of labor is the opposite: “You provide the environment and execute the model’s requests,” and the guidance tells you to “restrict the environment,” use “an allow list of sites and actions,” “treat screen content as untrusted,” and “confirm consequential actions.” Those instructions assume you own the browser. In the hosted path you own the approvals and the sign-in, and the vendor owns the machine.

GPT-6.1 Sol arrived alongside it at “standard token prices at one-fifth of Astra’s,” which the pricing page confirms exactly: $2 and $10 per million against Astra’s $10 and $50, with cached input at $0.10, half of GPT-6 Sol’s $0.20. It also supports multi-agent delegation in the Responses API, where the model identifies work it can parallelize and hands it to other agents through collaboration tools. OpenAI’s documentation notes that “messages between agents may contain grammar or spacing errors,” which is a quiet admission that agent-to-agent messages are now a real channel with failure modes of their own.

Then Dots, which is where the architecture becomes visible: “persistent agents with connected apps and their own cloud computer,” rolling out from September 29 “to Pro users in markets excluding the European Economic Area, Switzerland, and the UK,” with specialist dots in enterprise preview. Alongside it, Private Intelligence packages zero data retention with Private Safety Processing, with a Private Inference preview using confidential computing due this fall.

Three configuration axes in one keynote, and none of them is the model. Jurisdiction decides whether Dots exists for you at all, and whether Ultrafast is available, since it supports only US data residency while GPT-6.1 Sol supports US and EU. The safety review became a product tier, because Private Safety Processing is a different arrangement of who may read your prompts. And the agent’s machine became the vendor’s machine.

This revises Issue 003 rather than repeating it. That issue concluded that an agent’s output is worth what something outside the agent can reject, and advised buying the checker before the horizon. The advice holds; the location moved. When execution, memory, and the browser are hosted, and the agent is persistent rather than invoked, there is no task boundary where your checker naturally runs and no end state to inspect. Delegation messages fall into the category Issue 004 described for compaction summaries, model output that becomes model input, and they are now a documented feature rather than a side effect.

Builder implication: hosted agent execution is a credential decision, not a convenience. Write down which secrets reach the hosted browser, what your application is approving when it handles sign-in, and where a rejection happens for an agent that never finishes. If you cannot name the moment something outside the agent gets to say no, you have bought the horizon without the checker.

Researchers say the guardrails-off build has been the internal default all along

On October 2, Fortune published interviews with two GovAI research fellows about how labs run their own models. Alan Chan’s summary is direct: “We can’t trust them completely to tell us about the safety of models.” Models used internally, before anyone outside sees them, “haven’t necessarily gone through a bunch of safety testing,” and “internal safeguards have not been deployed.” He names running with “cyber safeguards off” and “not doing enough red teaming” as “potentially a factor in some of the recent incidents,” and says published evaluations “maybe have not been representative of sort of where the model has actually been used.”

Set that beside Google’s sentence from two days earlier about releasing Argon without cyber guardrails to internal teams, and the interview stops being a warning about a hypothetical. It is a description of the thing a vendor had just announced.

The structural version of the argument predates the window. An April 2026 guide, Risk Reporting for Developers’ Internal AI Model Use, notes that frontier companies “first deploy their most advanced models internally, for weeks or months of safety testing, evaluation, and iteration, before a possible public release,” and documents one model that was available internally for at least six weeks before it was publicly announced. It also notes that California’s SB 53, New York’s RAISE Act, and the EU’s General-Purpose AI Code of Practice already require developers to report on internal use and its residual risks.

So the obligation exists and the reports are not something you can read. What you can read is a model card describing a build that, by the vendor’s own account, is not the most capable one running.

Builder implication: the published evaluation describes the configuration you are sold, not the configuration that exists. Treat a model card as a statement about one build among several, and when a vendor’s safety documentation is load-bearing for your own compliance story, ask which build it covers.

The pattern

Issue 005 argued that the decisive variable sits outside the model and is usually unpublished. This week the vendors started selling it.

Count the axes that moved while the weights stayed put. Google shipped one model in two guardrail configurations and allocated them by identity. Artificial Analysis showed two models tied on a composite while failing in opposite directions, because a composite is a weighting of failure types someone else chose. OpenAI made jurisdiction decide product availability, made the safety review a purchasable arrangement, and moved the agent’s execution environment onto its own machines. And researchers described the least-constrained configuration of all, which is the one running inside the lab and now inside a vetted partner program.

A model is not a thing you choose anymore. It is a family of configurations, and what you actually choose is a tuple: weights, guardrail policy, jurisdiction, effort setting, failure profile, execution boundary. Change one and you have a different product with the same name on the invoice.

What the evidence does not support is a story about vendors hiding things. Google published the guardrail split in the announcement rather than a footnote, and gave its reason. Artificial Analysis published the accuracy and hallucination components next to the composite. OpenAI’s changelog and documentation state the residency limits and the delegation caveats. Disclosure is better than it was six months ago. The problem is that it arrives as six facts in six documents, and nothing assembles them into the thing you are buying. That artifact is yours to build, and it is not a benchmark. It is a short record, per model you depend on, of which build you are entitled to and what it refuses.

Builder’s corner

The document to read this week is the one not written about a product: Risk Reporting for Developers’ Internal AI Model Use.

It is addressed to safety teams at frontier labs, which is why it is useful to everyone else: it is a clear statement of what a complete account of a model deployment contains, written by people whose job is to make labs produce one. Its structure is portable. Two threat vectors, autonomous misbehavior and insider threats, and for each the means, the motive, and the opportunity. That last one is what most internal reviews skip, because opportunity is about what a system was permitted to reach rather than what it was capable of doing.

Run the frame over your own most capable deployment, which is almost certainly the one with the fewest controls: the staging environment holding production credentials, the internal agent nobody rate-limited, the evaluation harness with write access. The paper’s observation about labs applies unchanged to the rest of us. The build with the safeguards off is doing the most interesting work and has no document describing it.

There is a practical reason too. SB 53, the RAISE Act, and the EU’s General-Purpose AI Code of Practice already require this reporting from frontier developers, so knowing what those reports should contain tells you what to ask a vendor for, and what its silence is declining to say.

Ideas worth stealing

Record the configuration, not the model name

“We use Gemini 4 Argon” is not a decision record. The decision is weights plus guardrail policy plus jurisdiction plus effort setting plus execution boundary. Write the tuple down where the model choice lives in your repository, because five of those six can change without a model rename, and four of them are set by someone who is not you.

Rank on the failure you cannot absorb

Argon at 15% hallucination with 50% accuracy and Astra at 51% with 63% accuracy finish one point apart on a composite. Those are not close substitutes, and which is better is a fact about your product rather than about the models. Pick the component metric your system has no recovery path for and rank on it alone.

Treat the vendor’s machine as a trust boundary you still own

Hosted execution relocates hardware, not responsibility. When the vendor runs the browser and your application handles sign-in and site approvals, you are still the party granting access to real accounts, with less visibility than before. Enumerate the credentials and the approvals as deliberately as you would for a machine you operated.

Experiments worth running

Re-rank your shortlist on hallucination rate alone

Take the model comparison you used for your last decision and rebuild the ranking using confident-error rate instead of the composite score. If the order changes, you learned that your choice was made by somebody else’s weighting of failure types. If it does not, you have a stronger basis for the same decision and it cost you an afternoon.

Write the internal-use risk report for your least-constrained system

Pick whichever environment has the most capability and the fewest controls, and write a one-page account of it using the paper’s frame: means, motive, and opportunity, for autonomous misbehavior and for insider threat. Do not make it a policy document. The goal is to find out whether anybody can currently describe what that system is permitted to reach, because if nobody can, that is the finding.

What I’m watching

  • Whether Google documents what “cyber guardrails” actually are, and whether the general release reports a measurable difference in refusal behavior against the Fairwind build.
  • Whether any vendor publishes accuracy and confident-error rate as separate numbers on a model card rather than leaving both inside a composite.
  • Whether hosted agent execution arrives with a published credential and prompt-injection model, or whether the security guidance stays in the guide for the self-hosted path that hosted execution replaces.
  • Whether the internal-use risk reports required by SB 53, the RAISE Act, and the EU code become documents anyone outside a regulator can read.
  • Whether a second lab follows Google in naming two guardrail configurations of one model in public, which would make the split a norm rather than one company’s disclosure choice.

Take this with you

One thing to learn: Google’s new frontier model is going to vetted cyber defenders and its own internal teams without cyber guardrails, and general availability is waiting on guardrail work rather than on capability.

One thing to build: a decision record for every model you depend on that names the build you are entitled to, what it refuses, the jurisdiction it runs in, and the failure profile you accepted.

One strategic question:

Does your product fail better with a model that is right more often, or with one that is wrong less often?

Sources

  1. Gemini 4 Argon: our next era of frontier intelligence, Google, September 30, 2026, for the Fairwind rollout, the release without cyber guardrails for trusted defenders and internal teams, the general-availability statement about iterating on guardrails, the CBRN and dual-use safety language, the 1M output token limit up from 64K, introductory and standard pricing, and the DeepSWE v1.1, AutomationBench, LVBench, and CWE-bench v1 figures.
  2. Google’s Fairwind Program: Cyber defense tools for trusted partners, Google, September 2, 2026, for the program description, the 650-plus partner count, the priority categories, the operational standards required of participants, and the earlier Gemini 3.8 Flash Cyber and CodeMender pairing.
  3. Gemini 4 Argon: Google is back as one of the top three labs in intelligence achieved, Artificial Analysis, for the Intelligence Index scores with effort settings, the AA-Omniscience accuracy, hallucination, and composite figures for Argon, GPT-6 Astra, and GPT-6.1 Sol, the Terminal-Bench 4 results, output token use per task, cost per task, and the note that Argon is not publicly available.
  4. AA-Omniscience, Artificial Analysis, for the benchmark’s size and domains and for the Omniscience Index definition, including the absence of a penalty for refusing to answer.
  5. DevDay 2026 announcements and developer resources, OpenAI, September 29, 2026, for the Agents API public beta with hosted execution, memory, tools, and multi-agent support, computer use in the Agents API, the Decisions API limited preview, Ultrafast and its speed claims, Private Intelligence and the Private Inference preview, and the Dots description and market exclusions.
  6. OpenAI changelog, OpenAI, for the September 29, 2026 entries covering the OpenAI-hosted browser with website access approvals and sign-in handled by the application, the GPT-6.1 Sol release and its multi-agent delegation support, and Ultrafast mode.
  7. Using GPT-6, OpenAI, for GPT-6.1 Sol’s context window, maximum output, knowledge cutoff, reasoning effort levels, data residency limits, the Ultrafast residency restriction, and the multi-agent delegation description including the note about errors in messages between agents.
  8. OpenAI API pricing, OpenAI, for GPT-6.1 Sol, GPT-6 Sol, and GPT-6 Astra per-token prices and cached input prices.
  9. Computer use, OpenAI, for the self-hosted division of responsibility and the environment restriction, untrusted-screen-content, and consequential-action guidance.
  10. “We can’t trust them completely”: AI research fellows warn that labs are running models with the safeguards off behind closed doors, Fortune, October 2, 2026, for Alan Chan’s quoted statements about internal safety testing, undeployed internal safeguards, cyber safeguards being off, red teaming, and published evaluations not being representative of actual use.
  11. Risk Reporting for Developers’ Internal AI Model Use, Delaney, Maheshwari, O’Brien, Bearman, and Guest, April 27, 2026, for the weeks-to-months internal deployment pattern, the documented six-week internal availability example, the SB 53, RAISE Act, and EU General-Purpose AI Code of Practice reporting obligations, and the two-threat-vector framework with means, motive, and opportunity.

Evidence note: Google’s benchmark figures for Gemini 4 Argon are the vendor’s own and were produced on harnesses and effort settings the announcement does not fully specify, so they are not comparable to another vendor’s figures for the same benchmark names. Artificial Analysis is a commercial benchmarking firm whose composite indices include private evaluations, so its numbers are not independently reproducible; its Argon scores were produced on a model that it states is not publicly available, which means they could not be verified by a third party at publication. The AA-Omniscience composite’s exact computation is not published in the article cited, so this issue reports the accuracy, hallucination, and composite figures as given rather than deriving any of them. Gemini 4 Argon could not be exercised directly during research, so no claim here rests on observed model behavior. The Fortune interview is the primary record of the GovAI researchers’ statements; specific incident attributions appearing in that article were excluded from this issue because they could not be confirmed against a lab’s own published account, and nothing here should be read as establishing which lab was involved in which incident. The internal-deployment guide is an April 2026 preprint included because the September 30 announcement and the October 2 interview gave its argument a current consequence, not because it falls inside the coverage window. No OpenAI product announced at DevDay was tested; availability, pricing, and capability claims come from OpenAI’s own announcement, changelog, documentation, and pricing pages. The reading of a model as a family of configurations rather than a single product, the argument that a composite score encodes someone else’s weighting of failure types, the credential framing of hosted agent execution, and the proposed decision record and experiments are Gecko Road analysis.