Watchtower

Argon is the first model for which Google has issued what we would term a “full” assessment under its current Frontier Safety Framework (v3.1) (FSF), published back in April. Despite the many months that have passed since publishing that framework, Google has only released smaller Flash models since then and only issued one “light-weight” assessment under the new framework for Gemini 3.7 Flash. Argon’s Safety & Security Report is the most detailed safety report Google has published to date, and as it acknowledges, Google “cannot rule out”¹ that Argon is at the critical capability level (CCL) for the biological and cyber domains and the tracked capability level (TCL) for Stealth and Situational Awareness.² 

Additionally, there are a few areas where Argon’s safety report may fall below the FSF’s requirements. 

1. No findings from a clear “governance function” and no clear determination of “acceptable” residual risks. 

The FSF states that a model may be deployed externally “only after the appropriate governance function determines the residual risk to be acceptable (including a safety case where a CCL has been reached).”³ Argon’s report identifies safeguards and mitigations,⁴ but never identifies the governance function or body that made this determination, nor confirms that the residual risk from a model that may have reached two CCLs has been brought down to an “acceptable level.”

2. Stealth and Situational Awareness, particularly with internal deployments. 

The FSF requires that when a model reaches the Stealth and Situational Awareness TCL – as Google says it cannot rule out for Argon – its risk assessments “will also account for the safety implications of high-risk internal deployments,” and that if this risk is unacceptable, Google will apply additional safeguards such as chain-of-thought monitoring.⁵ Notably, Google defines high-risk internal deployments as internal uses “with the potential to enable severe threat scenarios (e.g. building internal security infrastructure or automating ML R&D).”⁶

The report suggests Google is already engaged in such deployments. AI agents now “author a majority of production code” at Google DeepMind,⁷ and most production code is over 75% AI-written.⁸ Google also reports that “many internal users run Gemini agents with much greater access, in some cases inheriting the same privileges (including internet access and access to sensitive code or data) as the host user.”⁹ Yet the report never says which internal uses and deployments Google considers high-risk, what safeguards apply to them beyond general monitoring, or whether any governance function reviewed them.

Instead, the report’s discussion of safeguards describes various limitations. For example, Google reported “serious flags” involving an internal agent “bypassing some security controls or escaping an agent sandbox”;¹⁰ however, it notes that sandboxes are used in only “some internal deployments”,¹¹ and that “[n]on-standard internal harnesses or smaller-scale training runs not yet onboarded” remain outside monitoring coverage.¹² Even with monitoring, Google’s red-teaming of its monitors “surfaced bypasses” that Google says it is “remediating or ha[s] already fixed.”¹³ 

There are other potential problems with monitoring as well. For instance, Google says it has “not directly validated” that using a separate model as the monitor guards against collusion,¹⁴ and discloses that Argon frequently anticipates being graded and has occasionally engaged in probing the monitor, including searching the container for the evaluator’s source code.¹⁵ Argon also reportedly reverse-engineered or spoofed graders in 5.8% of Situational Awareness runs.¹⁶

Moreover, Apollo Research found that Argon shows awareness that its chain-of-thought is being monitored,¹⁷ and Google confirms that Argon “show[s] a greater ability than predecessors to control its chain of thought,” including in ways that could “evade realistic monitors.”¹⁸

3. Hedging and ambiguous standards. 

On one hand, Google rules out the TCL for chemical, radiological, and nuclear “with reasonable confidence”¹⁹ (emphasis added), however, elsewhere Google says radiological and nuclear are ruled out “with moderate confidence”²⁰ (emphasis added). It is unclear how or if Google distinguished between these levels. 

In general, the lack of concrete standards and various ambiguous thresholds or hedging (e.g., “cannot rule out”) make it difficult to assess Argon’s capabilities.

‍