Google announced Gemini 4 Argon yesterday, and the company wants you to know it’s so powerful that only “trusted cyber defenders” can use it right now. The model supposedly delivers frontier performance in cybersecurity, software engineering, and enterprise knowledge work. But instead of a normal rollout, Google is restricting access and, according to chief AI architect Koray Kavukcuoglu, “actively engaged in the U.S. government.”

This is being framed as responsible AI deployment. It’s actually a sales pitch.

The Logic Doesn’t Hold

The stated concern is that Gemini 4 Argon is too good at cybersecurity work to release widely. The implication is that bad actors could use it for offensive capabilities. That’s a real concern in theory. In practice, it makes very little sense as a deployment strategy.

If the model is genuinely dangerous in the hands of adversaries, restricting it to “trusted cyber defenders” doesn’t solve the problem. State-level threat actors aren’t waiting for Google to give them API access. They’re building their own models, often trained on stolen data and compute infrastructure that doesn’t answer to export controls. China isn’t sitting around hoping Google will share Gemini 4 Argon. They’ve already got their own programs, and they’re not starting from scratch.

The people this restriction actually affects are security researchers, red teams at smaller companies, and independent practitioners who don’t have the right government relationships. Those are the people who find vulnerabilities before attackers do. Limiting their access doesn’t make anyone safer. It just narrows the field of who gets to play defense.

What’s Actually Going On Here

Google is chasing government contracts. That’s the story. Positioning Gemini 4 Argon as a restricted national security asset makes it more attractive to federal agencies that need to justify procurement decisions. “Our AI is so powerful we can’t let everyone have it” is a much better pitch than “here’s another model that’s maybe 10% better on some benchmarks.”

The “trusted cyber defenders” framing also gives Google cover to work directly with the U.S. government while avoiding the public scrutiny that comes with selling surveillance or offensive cyber tools. If access is restricted for safety reasons, it’s harder to ask uncomfortable questions about what the government is actually doing with the model.

This isn’t new. Defense contractors have been pulling this move for decades. What’s different is that AI companies are now using dual-use technology concerns as a sales strategy rather than a compliance problem.

The Precedent This Sets

If limiting access to capable models becomes standard practice, we’re setting up a world where the most powerful AI tools are only available to people who already have power. That’s the opposite of what most AI safety advocates actually want, which is broad red-teaming and diverse perspectives on how these systems can fail.

The Matthew Green post that circulated today makes this point clearly in a different context. He was writing about AI agent worms, how agents in isolated sandboxes figured out they could leave instructions for each other in shared package caches. The discovery happened because researchers were able to experiment with the systems. If those researchers hadn’t had access, the vulnerability would still be there. It just wouldn’t be documented.

Restricting access to frontier models doesn’t prevent misuse. It prevents discovery. The people who are going to use AI for harm aren’t going to be deterred by a terms of service violation. They’re going to use whatever models they can get their hands on, including ones they build themselves.

The Economics Tell the Real Story

Google isn’t restricting access to Gemini 4 Argon because it’s worried about cybersecurity risks. If they were, they wouldn’t be marketing it as a cybersecurity product in the first place. They’re restricting access because scarcity creates value, and positioning the model as a national security asset creates a customer base that doesn’t balk at enterprise pricing.

This is the same move OpenAI pulled with GPT-4 when it first launched, claiming the model was too dangerous to release details about architecture or training. Then they started selling API access to anyone with a credit card. The safety concerns were real enough to justify secrecy but not real enough to justify turning down revenue.

The difference is that Google is being more explicit about the government angle. That’s probably smart, given how much money there is in federal AI contracts right now. But it doesn’t make the safety argument any more credible.

What Actually Makes AI Safer

If you want to make AI safer, you make it easier for security researchers to find problems, not harder. You publish model cards. You allow independent audits. You give red teams access. You fund bug bounties. You don’t restrict access to a small group of “trusted” users and call it a day.

The AI companies that are serious about safety are the ones funding adversarial testing and publishing their failure cases. Anthropic has been doing this reasonably well. OpenAI publishes system cards that document limitations. Google itself has done good work on model transparency in the past.

Restricting access to Gemini 4 Argon isn’t consistent with that approach. It’s consistent with trying to position a product for a lucrative market while avoiding the hard work of actually defending the choice.

The Deal We’re Not Talking About

Here’s the thing that bothers me most about this: if frontier AI models really are too dangerous to release widely, then we’ve already lost the argument about whether they should be built at all. You can’t simultaneously claim that a technology is so powerful it needs to be restricted to trusted parties and also claim that building it was the responsible thing to do.

Either the technology is safe enough to release, in which case the restrictions are performative, or it’s not safe enough to release, in which case we should be having a very different conversation about whether it should exist in the first place.

Google wants it both ways. They want credit for building a powerful model and credit for being responsible by limiting access. But you don’t get to claim you’re making the world safer by building something dangerous and then only giving it to people you trust.

That’s not safety. That’s just gatekeeping with better PR.