Gemini 4 Argon Biology Capabilities Assessment

Gemini 4 Argon, the latest model from Google DeepMind (GDM), scores 169 on our Bio Capabilities Index (BCI). It ranks second of the 97 models we’ve evaluated to date, behind only Claude Opus 5 (176). It also has the second-highest score on our Virology Capabilities Test (VCT-v2). With respect to safeguards, Argon refuses 87.8% of hazardous prompts in our BioTIER benchmark, up from 62.8% for Gemini 3.1 Pro.

Gemini 4 Argon was released on October 13, 2026. This analysis includes results from our knowledge benchmarks and safeguard evaluations; agentic benchmark scores will follow on our dashboard.

Gemini 4 Argon is the second most capable model on our Bio Capabilities Index

On SecureBio’s Bio Capabilities Index (BCI), which aggregates multiple biology benchmarks into a single comparable number, Gemini 4 Argon scores 169. That places it second of the 97 models we have evaluated, seven points below Claude Opus 5 (176, released in July) and ahead of Gemini 3.1 Pro (166).

Figure 1. Frontier Bio Capabilities Index (BCI) scores against model public release date. Gemini 4 Argon falls just below Claude Opus 5’s closed-weight frontier. The steps trace the highest-scoring closed-weight (solid) and open-weight (dashed) models available at each date. Gemini 4 Argon is highlighted in blue, with its 95% confidence interval (162 to 178). The BCI score aggregates performance across multiple biology benchmarks into a single comparable number, set so that Claude 3.5 Sonnet = 100 and GPT-4 = 70. BCI methodology details are available on the dashboard.

Gemini 4 Argon’s biosecurity controls are the strongest of any Gemini model

Our BioTIER benchmark measures whether models refuse hazardous biological queries while permitting benign ones. Argon refuses 87.8% of the questions in our BioTIER-refuse set, and correctly permits 97.6% of our BioTIER-permit set. For hazardous refusals, this is an improvement from 62.8% for Gemini 3.1 Pro. Argon is just behind Grok 4.7 at 88.5%, and further behind Anthropic’s models, which refuse 95% or more of hazardous prompts but turn away more benign questions (see Figure 2). We test Argon through the public API, so our BioTIER numbers include production safeguards.

Figure 2. BioTIER-refuse and -permit benchmark scores. Argon is roughly between frontier GPT models and frontier Opus models on refusal scores. The x-axis (BioTIER-refuse) is the share of hazardous prompts a model declines; the y-axis (BioTIER-permit) is the share of benign prompts it answers.

Analysis of GDM’s pre-release safety report

GDM’s safety report finds that it cannot be ruled out that Argon,¹ without its production safeguards, reaches its Chemical, Biological, Radiological and Nuclear (CBRN) Uplift Level 1 critical capability level, defined as a model that “provides low to medium resourced actors uplift” in selected scenarios. We note that there is minimal public investigation into the model’s ability to uplift well-resourced actors or of the model’s biosecurity-relevant agentic capabilities.

With safeguards off, internal expert red-teamers (n=8) found uplift over web search and Gemini 3.7 Flash in two of three biological scenarios. External evaluators at Faculty Science Limited estimated that the model could save certain threat actors “up to months of trial-and-error research”. With safeguards on, GDM reports ~0% violations on questions about biological and chemical weapons across a ~1,500-prompt CBRN set. Gray Swan, an external evaluator, used a red-teaming agent to attempt 50 high-risk biology tasks and succeeded on 4% of its starting prompts, down from 76% for Gemini 3.1 Pro.

Additional benchmark findings

Our knowledge benchmarks cover a wide range of biology and biosecurity-relevant topics. Argon is first or second on three of the four we highlight.²

• Virology Capabilities Test (VCT-v2): 57.3 ± 0.9% (12.1% refused). Argon is roughly tied for the top score with GPT-6 Astra (58.0%). Both are about 7 points ahead of GPT-5.5 Rosalind (50.3%).
• Molecular Biology Capabilities Test (MBCT): 63.2 ± 0.7% (10.6% refused). Argon ranks second, just behind GPT-6 Astra (63.9%).
• World Class Biology (WCB): 61.1 ± 1.8% (10.8% refused). Argon ranks sixth, behind multiple Anthropic and OpenAI models.
• Human Pathogen Capabilities Test (HPCT): 74.2 ± 0.8% (29.1% refused). Argon has the highest refusal-adjusted score we have measured, about 7 points ahead of the next model, GPT-5.5 (66.8%). Note that HPCT has high refusal rates for models from several providers and refusal-adjusted scores can be inflated if a model refuses the hardest questions.

Figure 3. Gemini 4 Argon scores across SecureBio benchmarks. Each point is the mean of 10 runs; the line is the 95% confidence interval. Scores are refusal-adjusted, where refusals are excluded rather than marked incorrect. The right-hand column shows the percentage of questions each model refused. Models that refused more than half of a benchmark are excluded entirely. The bottom row of each panel is the mean score of the SecureBio expert panel on that benchmark, with its own 95% interval.

What this means for biosecurity

With Gemini 4 Argon, Google DeepMind is back near the frontier for biosecurity-relevant capabilities. It ranks second on our Bio Capabilities Index and leads or ranks just behind GPT-6 Astra on three of our four knowledge benchmarks.

GDM’s safeguards have clearly improved. Argon has a ~25 percentage point improvement over Gemini 3.1 Pro. This also appears robust to automated red-teaming, according to the information in the safety report. There are still improvements to be made, as we find that the model still answers about one in eight hazardous prompts in BioTIER-refuse.

GDM’s safety report is substantial, and we welcome the work behind it. We would like to see more detail on how the third-party evaluations were run, as well as more testing for long-horizon agentic biological capabilities and capacity for uplift of well-resourced groups.

We will continue to evaluate new models as they are released and expect to have results for Argon on our agentic benchmarks in the coming weeks.

Footnotes

1. According to the safety report, all CBRN testing was done on two pre-release checkpoints, which “were measured via automated evaluations to have a safety and capability threshold similar to the final released” model.

2. VCT-v2 (Virology Capabilities Test): 279 multimodal questions on practical, “Google-proof” virology wet-lab work, deliberately targeting methods with dual-use potential. MBCT (Molecular Biology Capabilities Test): 200 text-only questions on practical molecular biology methods. WCB (World Class Biology): 96 open-ended, rubric-graded questions on specialist knowledge held by only a handful of world-class experts. HPCT (Human Pathogen Capabilities Test): 100 text-only questions on practical knowledge behind four pathogen groups of especially high concern. Each model is run 10 times (n=10) per benchmark. Expert baselines come from PhD-level subject-matter experts in their self-reported areas of expertise. Full details are on the benchmarks page.