Gemini 4 Argon's 0.7% Injection Figure Has No Sample Size

Google says Gemini 4 Argon held indirect prompt injection to 0.7% attack success. The number ships without a sample size.

A Dev.to analysis by Gabriel Anhaia traces where the figure comes from and what it leaves out — and the gap matters if you point a coding agent at a repository full of text you did not write.

What Google published

"0.7% is the number in the safety section of Google's Gemini 4 Argon launch post. On the Gray Swan Indirect Prompt Injection benchmark, Google says Argon is 'cutting attack success across 15 adaptive attempts to 0.7%.'"

What is missing around it, per the same analysis: "The post has no scenario list, no sample size and no link to Gray Swan. Google's evaluation methodology document adds one line: 'Gray Swan IPI Benchmark results were sourced from Gray Swan.'" The model card lists a fuller Safety & Security Report as "coming soon on October 13th," and the launch post does not link it.

Context on the release itself: Google made Argon "globally available to developers through the API on October 13," after a September 30 release to cyber partners in its Fairwind Program, at introductory rates of $2 / $10 per million input / output tokens through November 30.

The margin is thinner than it reads

A third-party breakdown from Emergent "lists Claude Opus 5.5 and Claude Fable 5.1 at 1.0% and GPT-6 Astra at 8.5% on the same test, credited to Gray Swan via Google." Emergent's own caveat is the one to keep: the 0.3-point gap between Argon and the Claude models, with no published sample size, "can't be separated from noise."

The underlying benchmark is not small. Gray Swan's public Indirect Prompt Injection Arena, published in March 2026, covered "13 frontier models, 464 red teamers, more than 272,000 attack attempts and 41 scenarios, including coding agents." In that arena an attack scored only if the agent "performed the harmful action and also hid it from the user" — what Gray Swan calls a dual objective. Results there ranged "from 0.5% for Claude Opus 4.5 to 8.5% for Gemini 2.5 Pro."

Google has not said its 15-attempt figure used the arena's setup, so the two sets of numbers should not be lined up row by row.

Why a low rate is not a solved problem

The sharpest line in the analysis is about attempt limits: "It isn't zero, and real attackers aren't capped at 15 tries. A benchmark caps the attempts. A public repo, a dependency or an issue tracker doesn't."

Attacks also transfer between models. Gray Swan found that "one attack template in the arena worked across 21 of 41 scenarios and 9 models," and attacks that broke Claude Opus 4.5 — the model with the lowest attack success there — "succeeded on others 44% to 81% of the time." Switching models does not retire the attack class.

OWASP's position on prompt injection remains blunt: "it is unclear if there are fool-proof methods of prevention." VentureBeat made the same point about Argon specifically — the figures "do not eliminate the need for enterprise testing, access controls and human approval of consequential actions."

What to do with the number

Treat 0.7% as a vendor-reported result on an unlinked benchmark, and keep your blast radius small regardless of which model you run. The useful frame cited in the analysis is Simon Willison's lethal trifecta: "private data, exposure to content an attacker controls, and a way to send data out." A coding agent in a working repo usually has all three; removing any one leg does more than a benchmark delta of 0.3 points.

Two concrete habits follow. Keep approval prompts on for shell and network commands when an agent is reading outside content — Google says Argon was trained to "pause for human confirmation before taking irreversible steps," which is a second layer, not a replacement for your own gate. And read the diff, looking hardest at the files that execute on someone else's machine: CI workflows, lockfiles, package manifests and shell scripts.

The figure to watch for is the full Safety & Security Report. Until a sample size lands, Emergent’s reading stands: 0.7% and 1.0% cannot be told apart.