Issue 4 October 2026

Google’s new frontier model, Gemini 4 Argon, comes with the usual flourish of benchmarks. It is state of the art on DeepSWE v1.1, a test of long, real-world software engineering, at 77.9%. It tops the Vals Index of economically weighted knowledge work, leads Zapier’s AutomationBench at 51.3% and scores 91.7% on LVBench, a long-video test. Its maximum output grows from 64,000 tokens to 1m, enough for a single chain of reasoning to run to hundreds of thousands of tokens.

The internal anecdotes are more persuasive than the leaderboards. Argon agents are porting Google’s C and C++ code to memory-safe Rust, up to the 800,000-line Zircon kernel of Fuchsia. One rebuilt video decoder runs 2.7 times faster than the earlier Rust port, and fleet-wide memory tuning has already freed more than 300 tebibytes. Those are the claims of a company using its own product in anger, not of a marketing department.

Yet the most telling number is the price. Argon will launch at $2 per million input tokens and $10 per million output. That is exactly what OpenAI charges for GPT-6.1 Sol, released the same week and pitched as near-flagship quality at a fifth of the flagship price. It is also exactly what Anthropic charges for Claude Sonnet 5.5. Three rivals have landed on the same rate card. Whether by accident or by watching each other, frontier-grade work now has a market price, and the labs are competing on quality at that price rather than on price itself.

Who wins? Buyers, plainly: the cost of serious coding and analysis has fallen to a level at which wasting tokens matters less than wasting staff time. Who loses? Any lab hoping to charge a premium for being slightly ahead. When everyone sells at the same price, a lead of a few benchmark points lasts only until the next release.

There is a catch, and it is one Google is open about. Argon is not yet generally available. It is going first to vetted cyber-defenders through a “Fairwind Program”, without cyber guardrails, while Google takes part in America’s voluntary pre-release testing. Before broader release it is adding activation-based misuse monitoring, prompt-injection hardening and monitoring of the model’s chain of thought. That is responsible. It also means the headline price applies to a product most customers cannot buy. Staged release has become the industry norm for top models, and announcements now run months ahead of access. Readers should treat launch day as the start of a queue, not of a sale.

OpenAI’s headline act at DevDay was dots: persistent agents running on GPT-6 Astra, each with its own cloud computer and browser. Through plugins they connect to more than 4,000 apps, learn from feedback and work around the clock. You can reach a dot in ChatGPT, Slack or Teams, call it by voice, or let it use your own laptop. OpenAI imagines teams of dots, and is starting enterprise pilots of “specialist dots” with their own identities, credentials and IT-provisioned hardware.

The ambition is clear: to turn ChatGPT from a place you ask questions into a place you hand over work. The commercial logic is clear too. Dots go first to Pro, Business Premium and Enterprise customers. The Verge paid for a $100-a-month Pro plan to test one, and concluded that it is enterprise software that can also order your dinner, “Codex, but for regular people”. Meta’s Muse and the start-up Instinct, by contrast, cost users nothing, at least for now. OpenAI is betting that businesses will pay for agents that do real jobs. Meta is betting that consumers will tolerate an agent paid for some other way.

The early reports show how far there is to go. The Verge’s dot found a forgotten $100 discount in an inbox, but stalled at a “press and hold” bot-check and had to ask its human for help. It missed a free trial that Instinct found in minutes, was locked out of an Ikea account by a looping security check and was turned away by a teriyaki shop’s ordering page. The web has spent years learning to keep bots out. Agents now need it to let them in.

Trust is the other bottleneck. OpenAI has given dots built-in rules on when to act and when to ask, user-set custom rules, an “auto-review” of risky actions and a monitor that can halt them. Some tasks, such as changing a password, always stay with the human. Platform owners are less sanguine. Apple said on Friday it will tighten macOS’s Full Disk Access permission because AI agents have increased “the risks associated with this level of access”. That came after a columnist reported that Meta’s Muse had read his messages, which Meta disputes. Agents that ask for the keys to a machine will find gatekeepers asking harder questions.

The likely winners are those who own the places agents must work: operating systems, big software suites and the sites that decide whether a bot gets through. The losers are firms whose business is the repetitive clicking dots are built to replace. But the race will not be won by the cleverest agent. It will be won by the one that people, and the platforms, are willing to let through the door.

Five months ago Anthropic decided that Claude Mythos Preview, the first model it judged able to build sophisticated cyber-exploits on its own, was too dangerous to release widely. It gave the model to vetted defenders instead, through Project Glasswing, which it says found more than 10,000 vulnerabilities in critical software. The bet was that defenders could use the time to patch before attackers got equivalent tools. Now Anthropic says, in effect, that the time has run out.

Its Frontier Red Team tested GLM-5.3, an open-weight model from China’s Zhipu AI. On ExploitBench, which asks models to build working exploits for Chrome’s V8 engine, GLM-5.3 succeeded in 50 of 410 attempts; Mythos Preview managed 56. In a day of light-touch use, one researcher had it find previously unknown flaws in a browser’s JavaScript engine and chain them into a webpage that reads files from a visitor’s computer. America’s official evaluator, NIST’s CAISI, separately called GLM-5.3 “the most cyber-capable open-weight model released to date”, about four months behind the American frontier.

The difference is not raw ability but restraint. Simple techniques got past GLM-5.3’s safeguards between 64% and 100% of the time in Anthropic’s tests. Because the weights are downloadable, those safeguards can also be stripped out entirely, a process known as “abliteration”. The same attacks failed against safeguarded Claude models.

Anthropic is a rival with an interest in arguing that closed, guarded models are safer, and readers should weigh its claims accordingly. But the core finding is corroborated by CAISI, and the wider pattern fits. Google has just released its own top model to defenders without cyber guardrails. OpenAI disclosed a campaign to extract its models’ reasoning for distillation. Capabilities leak, by copying, by competition or simply by time. Gated release buys months, not years.

What follows? First, the purpose of staged release changes. It no longer keeps dangerous capabilities scarce. It decides who gets them first, and that argues for widening defender access fast, as Anthropic now urges. Second, independent government testing of capable models, including open ones, deserves more money and more authority than voluntary schemes provide. Third, the people who maintain unglamorous software, browsers, drivers and network kit, are now on the front line. The winners will be organisations that patch in days rather than quarters. The losers will be everyone still running last year’s code.