Security teams have long dreamed of a tool that finds a vulnerability and then actually fixes it, instead of filing a 40-page PDF and walking away. Google says it has built one. Naturally, the first people allowed to use it are the ones whose job is stress-testing that kind of claim.
Find It, Prove It, Patch It
Google announced Gemini 4 Argon on October 1, 2026, and trained it specifically for defensive cybersecurity. Per Help Net Security, Argon can "locate critical software vulnerabilities, validate them, and patch them without human help." Google's showcase example is a critical flaw exposing sensitive personal information in healthcare software used by hospitals worldwide, which earlier frontier models had missed. Google didn't name the software or say whether it has been patched.
The numbers: 68% on CWE-bench v1 (tied for first), 77.9% on DeepSWE v1.1, and an output limit raised from 64,000 to 1 million tokens across 20 programming languages. Trusted cyber defenders get it first through Google's Fairwind Program, including a version without cyber guardrails. Paid API customers and Google AI Ultra subscribers come next, at introductory pricing of $2 per million input tokens and $10 per million output tokens, which doubles after the intro period.
The Arms Race Just Got an Autopilot
Defenders getting a head start is the right call, because the same skill that patches a bug can also find one to exploit. Google says internal and external red teams are testing its guardrails against cyber and CBRN misuse. Still, once models can find vulnerabilities on their own, the time between "unknown bug" and "known bug" gets a lot shorter for both sides.
What gets missed is that finding bugs was never the bottleneck. Shipping fixes was. An AI that can produce a patch is great, but someone still has to review it, test it against your actual codebase, and deploy it without breaking checkout. Teams with solid CI, tests and update discipline will benefit hugely. Teams without them will have a smart tool and a growing pile of patches nobody reviews.
Argon could be one of the best things to happen to defenders this year, but only if your pipeline can keep up with it.
If AI-assisted vulnerability hunting is about to speed up how fast flaws surface, your dependency hygiene needs to be ready for it, and our free developer security checklist for supply-chain defense is a good place to start.
Source: Help Net Security