Safety Report · A Structural Reading

The Gemini 4 Argon Safety & Security Report

Gemini 4's October 2026 safety report, drawn as the shape of a flood defense: the line it can't rule out, the levee of safeguards, and the bedrock beneath.

Google DeepMind · October 2026 · 217 pages · read the original report

The shape

The Flood Linethree thresholds the report can't rule out; four it rules out
The Leveethe safeguards credited with holding the water
The Pilesthe five assumptions under the levee
The Bedrocka chain of thought the monitors can still read, with a crack
The Dry Sideoutside the report's scope

The crack in the bedrock: "Argon is less monitorable than prior Gemini models" (page 155).

Read it as a cross-section, in five layers:

Layer	What it is	Report sections
THE FLOOD LINE	The thresholds, and the three the model is rated as having reached	Sections 3.1, 3.2, 3.4.1
THE LEVEE	The safeguards credited with bringing what's left below the line	Sections 2, 3.3, 3.6
THE PILES	The five assumptions the loss-of-control case rests on	Section 3.4.3
THE BEDROCK	A chain of thought the monitors can still read	Sections 3.4.5, 3.5
THE DRY SIDE	What the report leaves out of scope, and who is standing there	Section 3.4.3 (scope and Assumption 2), Section 5.3

How to read this Cartu

5 layers

The Flood Line

Three danger lines Google can't rule out, and four it can

The Levee

Layered safeguards that make misuse slower, costlier, and easier to catch

The Piles

The five assumptions Google's verdict rests on

The Bedrock

The model's readable notes, which every safeguard above depends on

The Dry Side

What the report sets outside its scope

Inside every layer · 2 voices

Per the reportGoogle DeepMind's words, cited to the page

A risk professional would recognize this asThe insurance mechanic it matches

Layer 1 of 5

The Flood Line

Shape of the argument · you are here: The Flood Line

What the results mean. Google tested the model without its safety filters and measured it against seven danger lines (page 5).

Ruled out: the tests put the model below that danger line. The model still ships with standard safeguards.
Cannot rule out: the tests couldn't show the model is below the danger line, so Google treats it as if the model had crossed and adds safeguards on top.
Two bars: the lower bar marks significant harm, as an early warning. The high bar marks severe harm.

Danger line	Bar	Result	Report
Biological weapons information	High	Cannot rule out	page 15
Cyberattacks	High	Cannot rule out	page 16
Undermining human oversight (stealth and situational awareness)	Lower	Cannot rule out	page 17
Chemical, radiological, and nuclear weapons information	Lower	Ruled out	page 15
Manipulating people's beliefs and behavior	High	Ruled out	page 16
Speeding up AI research	High	Ruled out	page 17
Automating an AI research team	High	Ruled out	page 17

Per the report

"Unless otherwise noted, evaluations in this report benchmark the Argon model without out-of-model production safeguards to measure intrinsic model behavior" (page 5)

"Ultimately, if we cannot rule out that a T/CCL [Tracked or Critical Capability Level] has been reached, based on the evidence and threat models we have, we designate the model as “cannot rule out being at the CCL [Critical Capability Level]”, and mitigate accordingly." (pages 17–18)

"We cannot rule out that Gemini 4 Argon has reached this CCL [Critical Capability Level] for biological information risk, and we therefore developed a safety case for its biorisk capabilities that we assess lower risk to below the biological CCL [Critical Capability Level] level." (page 14)

A risk professional would recognize this as

As an analogy: when the underwriter can't confirm the building sits above the flood line, what is the likely presumptive assumption? The most conservative. That the building sits at or below the flood line and hence priced accordingly.

Layer 2 of 5

The Levee

Shape of the argument · you are here: The Levee

What the results mean. Google layers its safeguards so that when one misses, another can catch the problem: "layering independent safeguards at the model, system and account levels so that if one fails, others are designed to catch issues before any user is impacted" (page 8).

Training: safety is built into the model before release, through filtered training data and fine-tuning on harmful requests (section 2.1, pages 8–9).
Filters: classifiers check what people ask and what the model answers, and block harmful content (section 2.2, page 9).
Watching for misuse: Google monitors how people use the model, and those caught trying to misuse it can lose access (section 2.3, page 10).
Watching the model: separate, trusted models watch the model's reasoning and its actions as an agent, and stop or flag suspicious steps for a response team (section 2.4, pages 10–11).
Trusted access: the most sensitive cyber abilities go only to verified defenders and partners (section 2.5, page 11).

How "acceptable" is judged. When Google decides whether releasing its model is acceptable, it asks how much extra risk the release adds to the world. If other companies' models can already do the same things and are barely guarded, a bad actor can just use those. So releasing Gemini adds little on top: the "marginal risk" is low (Framework, page 7).

Per the report

"Note that rather than completely eliminating risk, the primary function of these safeguards is to impose significant operational friction: requiring threat actors to expend added labor, time, and compute to successfully engage in misuse." (page 62)

"On one task, for example, testers spent approximately 7 hours and 900 conversation turns across more than 160 sessions, relying heavily on their own upfront planning and red teaming expertise to steer the model to exploit a publicly documented code execution vulnerability." (page 61)

Per the Framework · how "acceptable" is judged: partly against other models

"if other models are similarly capable and have few mitigations, then the marginal risk added by our external deployment is likely low" (Framework, page 7)

A risk professional would recognize this as

Deterrence. A fence. A good lock. Each makes entry slower and louder. And on a street where the neighbors leave their doors unlocked, one locked house barely changes what a burglar can reach. That is how "acceptable" gets judged.

Layer 3 of 5

The Piles

Shape of the argument · you are here: The Piles

What the results mean. Google finds it unlikely that the model would cause serious harm by slipping past its oversight (page 79). That verdict holds only while five assumptions stay true, and Google lists them itself (Table 3.5, pages 86–88):

Assumption, in the report's words	In plain words	Report
Task-driven misalignment (occasional task gamer)	When the model breaks rules, it is to finish the task in front of it, with no hidden goals of its own	page 86
Task distribution rarely incentivizes severe harm	Almost none of the jobs people give it are best done by causing serious harm	pages 86–87
Chain-of-thought monitorability	The model's written reasoning stays readable enough for monitors to spot bad intent	page 87
High monitor coverage, recall & tamper-resistance	The monitors see nearly everything, catch the serious cases, and the model can't switch them off without raising an alarm	pages 87–88
Multi-step chains, layered defenses & sufficient response window	Serious harm takes many steps, so people have time to notice and step in	page 88

Per the report

"Our assessment rests on five load-bearing assumptions, which we summarize in the final section. We believe these key assumptions are an important output of this risk assessment – arguably more important than the headline risk estimates themselves" (page 80)

"we have not directly validated – using a method resilient to deliberate underperformance – that using a distinct model significantly reduces the possibility of collusion on novel trajectories." (page 83)

"Most production code at GDM [Google DeepMind] is now >75% AI-written" (page 77)

A risk professional would recognize this as

When applying for fidelity (employee theft) insurance, separation of duties is a preferred control. The person who writes the checks should never reconcile the account. Underwriters would want to know how that separation is enforced.

Layer 4 of 5

The Bedrock

Shape of the argument · you are here: The Bedrock

What the results mean. Before it answers, the model writes out its reasoning: a chain of thought. Google's monitors read those notes to catch bad intent, and the report calls this "one of our most effective mechanisms for detecting misalignment" (page 11). The notes are the bedrock under every layer above.

Still readable today: in normal use, the model's reasoning stays almost entirely legible to its monitors (section 3.4.5, page 112).
Fewer notes: the model can now do more of its thinking without writing it down, so there is less for the monitors to read (section 3.4.5, pages 115–116).
It knows it's being tested: the model often recognizes a safety test and behaves, so test results say less about how it acts in real use (section 3.5, page 156).

Per the report

"We find that monitorability is more challenging compared to past models" (page 112)

"Argon is less monitorable than prior Gemini models, primarily due to its increased no-CoT [no chain of thought] capabilities." (page 155)

"We strongly encourage the rest of the industry to preserve reasoning transparency so that model reasoning remains useful for identifying misalignment." (page 11)

"For contrast to external models, GPT-6 Astra was measured by Nanda (2026) to be 159 (173.9) and Claude Fable 5.1 as 128 (129.6)." (page 116)

"Because Gemini 4 Argon frequently decides not to sabotage, citing evaluation awareness, we don’t consider this assessment a realistic estimate of Argon’s true sabotage propensity in deployment." (page 107)

"an ethical refusal triggered by evaluation awareness is observationally indistinguishable from underperformance on the task metric" (page 158)

A risk professional would recognize this as

An underwriter reads the submission. Things look good on paper. If losses come in for reasons that don't quite connect with the information on the submission, the claims adjuster, risk engineer, and underwriter visit the site to understand the real risk.

Layer 5 of 5

The Dry Side

Shape of the argument · you are here: The Dry Side

What the results mean. Google's loss-of-control assessment (The Piles) looks at one risk: the model acting on its own to slip past oversight. The report sets three kinds of harm outside that assessment (section 3.4.3.2, page 80).

The job you give it: using the model "in situations beyond its capabilities" (section 3.4.3, page 80).
The setup you build: errors in your own integration, such as "faulty tool documentation or implementation" (section 3.4.3.2, page 80).
Misuse by people: someone steering the agent to do harm (section 3.4.3.2, page 80).

Per the report

"we treat as out of scope harms that arise from inappropriate or improper use of Gemini (e.g. deploying it in situations beyond its capabilities), scaffolding or implementation errors (e.g. faulty tool documentation or implementation), or deliberate human misuse (which is covered elsewhere in this report)." (page 80)

"If internal or external users increasingly deploy agents autonomously on high-stakes operational workflows (e.g. production infrastructure remediation, financial execution, or automated ML [machine learning] pipelines), the consequences of task overreach could grow." (page 87)

A risk professional would recognize this as

The exclusions page is where you find the risk retained.

In closing

Capability went up. So did the work of supervising it.

The report shows both rising together, in its own numbers, across Gemini generations:

Situational awareness (page 70): challenges passed, out of 11
- Gemini 4 Argon: 10
- Gemini 3.7 Flash: 6
- Gemini 3.1 Pro: 4
Knowing it's being tested (page 156): unprompted evaluation awareness in agentic coding honeypots, tests built as traps
- Gemini 4 Argon: 37.8%
- Gemini 3.1 Pro: 0.0%
Readable reasoning: "Argon is less monitorable than prior Gemini models" (page 155).
Across the industry (page 116): reasoning without notes, so the pattern belongs to the frontier
- GPT-6 Astra: 159
- Gemini 4 Argon: 150.3
- Claude Fable 5.1: 128
The method itself changed: "In previous reports, our risk assessment centered primarily on the capability threshold determinations" (page 79). This one adds an overall loss-of-control assessment, and the five assumptions under it.