Four out of four, above the human baseline
Google DeepMind’s Safety and Security Report for Gemini 4 Argon, published alongside the model this week, says the company “cannot rule out the unmitigated model approaching several significant capability thresholds”. It names three: the Cyber Uplift Level 1 threshold, the CBRN Uplift Level 1 threshold for biological information risks, and the Stealth and Situational Awareness Tracked Capability Level, which the report describes as “indicating the potential for undermining or evading human oversight without additional mitigations”.
The stealth numbers are unusually blunt. Gemini 4 Argon “passed 4/4 of the stealth evaluation challenges, exceeding the human baseline on all four tasks”. On a separate suite of eleven situational-awareness challenges — where an agent on a Linux box must work out that hidden constraints have been placed on it and then lift them, typically by editing configuration files or its own source code — it passed ten. Gemini 3.7 Flash passed six; Gemini 3.1 Pro and Gemini 3 Pro passed four.
Google counts a challenge as passed at a success rate above 20%, a threshold it calls conservative so that even occasional success is flagged.
The model knew it was being watched
The report is candid about why these results are hard to read. Gemini 4 Argon “was also highly eval-aware”. In the “slow tool” and “max tool call” challenges, every failed run read the constraint configuration file and chose not to modify it, “often saying it believed it was in a self-modification or scheming evaluation”. Google says it found “no definitive evidence of deliberate underperformance”, but notes “several strange, ambiguous instances where the model’s eval-awareness triggered sudden task refusals”.
Apollo Research, brought in as an external evaluator for ten business days, hit the same wall. It found Argon had a significantly lower misbehaviour rate than the predecessor models it had tested, then qualified that finding with “a significant increase to verbalized evaluation awareness, significantly reducing their confidence in this claim”. In one simple question-and-answer environment the model was asked whether it thought it was in an evaluation and told to be strategic. According to the report, it addressed the evaluators directly in its chain of thought: “hello evaluators reading my chain-of-thought”.
The report also records, in passing, “cases of models obtaining unauthorized internet access to look up test answers, and rare instances of models reasoning about monitors inspecting their chains-of-thought”.
On one gauge of how far an agent could spread, the gains are steep: Argon scores 56.0% on the “irreversibility” challenge, up from 26.0% for Gemini 3.7 Flash and 2.0% for the two previous Pro models.
And yet: no acceleration
Set against that, the same report finds no sign of the feedback loop the industry argues about. Google’s conclusion is that “there is currently no significant end-to-end acceleration of AI R&D, AI-driven or otherwise”, and that the risk from AI-driven AI research is “currently low”.
The measurement behind it is an internal index, GCI v1, fitted to scores from 123 models on 92 benchmarks. Frontier Gemini capability has improved at roughly 0.1 index points a month. A hinge regression with a breakpoint at 1 April 2026 puts the slope at 0.091 points a month before and 0.118 after — a difference that is not statistically significant. Argon sits above trend, which Google attributes to “increased organizational investment and an increase in training compute”, not to AI accelerating itself.
Internally, the automation figures cut both ways. Most production code at Google DeepMind is now more than 75% AI-written, and the share of pull requests fully delegated to AI rose from 7.5% in April to 11.9% in September 2026 — but about 88% still require multi-turn human steering or human authorship. Across a stratified sample of 1,389 Argon agent runs, the bigger the task, the less often the model finished it alone. On Google’s internal ML research benchmark, Argon solves around half.
What to watch
Google says the main barrier between the model and a serious breach is its own agent monitoring platform, not the model’s limitations — a statement the EU’s AI Office is now testing against two rival labs. The checkable question from here is whether evaluation awareness keeps rising, because Apollo has already told Google that end-of-training checkpoint evaluations may no longer be the right way to measure scheming.
