The result: Gemini 4 Argon at High effort returned 34/36 correct basic verdicts, with accepted proof in 29/36 (80.6%). That is the highest observed basic proof count in our 22-model DFIR 0.6 collection. On multi-host intrusions, it reached 4/12 with proof, behind GPT-6.1 Sol, GPT-6 Astra and Claude Opus 5.5, each at High effort.

Why it matters: An alarming command can signal an attack or routine administration. The agent must choose searches, inspect records and submit a classification with citations. A correct verdict gets the classification right; a verdict with proof also meets the required supporting-record checks.

Basic investigations: 29 verdicts with accepted proof

Basic investigations · 36 cases/model · DFIR 0.6 · One pass
Model Effort Correct verdict Verdict with proof
Gemini 4 Argon High 94.4%34 / 36 80.6%29 / 36
GPT-6.1 Sol High 72.2%26 / 36 69.4%25 / 36
GPT-6 Astra High 77.8%28 / 36 69.4%25 / 36
Claude Opus 5.5 High 91.7%33 / 36 33.3%12 / 36
Claude Sonnet 5.5 High 91.7%33 / 36 30.6%11 / 36

Gemini’s four-case proof lead over Sol and Astra is an observed count from one pass. High effort does not imply equal internal computation across providers.

Intrusions: the proof lead does not carry over

Multi-host intrusion investigations · 12 cases/model · DFIR 0.6 · One pass
Model Effort Correct verdict Verdict with proof
Gemini 4 Argon High 83.3%10 / 12 33.3%4 / 12
GPT-6.1 Sol High 83.3%10 / 12 41.7%5 / 12
GPT-6 Astra High 66.7%8 / 12 41.7%5 / 12
Claude Opus 5.5 High 100.0%12 / 12 41.7%5 / 12
Claude Sonnet 5.5 High 83.3%10 / 12 33.3%4 / 12

Gemini matched Sonnet’s four accepted-proof verdicts, one fewer than Sol, Astra and Opus. It completed 47/48 workflows overall. One basic response hit the output limit and ended without a valid final submission; that case stays in the denominator. The other four completed 48/48.

Cost:

Full 48-case workload · USD · Standard estimates checked October 15, 2026
Model Effort Measured provider pin Recorded spend Current Standard estimate Workflows completed
Gemini 4 Argon High google-ai-studio $21.69–$23.59 $21.69–$23.59 47 / 48
GPT-6.1 Sol High openai $4.83 $4.83 48 / 48
GPT-6 Astra High openai/flex $15.51–$26.66 $31.01–$53.31 48 / 48
Claude Opus 5.5 High anthropic $54.57–$55.35 $54.57–$55.35 48 / 48
Claude Sonnet 5.5 High anthropic $21.57 $21.57 48 / 48

Gemini recorded $21.69 in settled charges, with a conservative upper bound of $23.59 after three temporary rate-limit responses with unresolved charges. An abandoned Vertex attempt adds $0.08–$0.62 in setup overhead, excluded from the scored workload. Combined accounting, including every retained reservation, is $24.21 against the approved $40 cap.

Gemini used Standard Google AI Studio pricing: $2/M input and $10/M output through November 30. Astra was measured on Flex; its Standard estimate reprices the recorded workload. Estimates preserve caching and retries; price-component ratios were checked against archived rates. Ranges retain unknown charges, rather than express statistical uncertainty.

Gemini took longer on both tiers

Mean provider request time per case · Includes retries
Model Effort Basic cases Intrusion cases
Gemini 4 Argon High 380.2 s 584.4 s
GPT-6.1 Sol High 88.1 s 144.7 s
GPT-6 Astra High 98.9 s 152.1 s
Claude Opus 5.5 High 74.9 s 147.0 s
Claude Sonnet 5.5 High 47.0 s 68.3 s

Gemini averaged about 6m 20s per basic case and 9m 44s per intrusion. Time sums provider requests, including retries, and excludes cooldowns and restart gaps. Astra’s measured Flex time remains Flex time; a Standard price estimate does not predict Standard speed.

Explore scores, cost, speed and tokens

Switch tiers and choose correct verdicts or verdicts with proof. The charts use a frozen 22-model snapshot, initially showing current measured flagships.

Known tokens across 48 cases · Input plus output, including thinking once
Model Effort Input tokens Output tokens Total tokens Requests with usage
Gemini 4 Argon High ≥23,144,581 ≥1,301,359 ≥24,445,940 942 / 945
GPT-6.1 Sol High 7,882,927 242,893 8,125,820 711 / 711
GPT-6 Astra High Unknown Unknown Unknown Journals unavailable
Claude Opus 5.5 High Unknown Unknown Unknown Journals unavailable
Claude Sonnet 5.5 High 9,258,383 305,639 9,564,022 537 / 537

Token coverage: Gemini has usage for 942/945 attempts: 583/586 basic requests and all 359 intrusion requests. Its combined totals are lower bounds (≥). The basic token mean stays unknown and is omitted from that plot; the intrusion mean is available. Missing usage is never zero. Older Astra and Opus request journals are unavailable here. Provider tokenizers differ, so token totals do not measure internal compute.

What this comparison supports

Gemini produced more evidence-backed basic conclusions in this pass, at a higher recorded bill and longer request time than Sol. The basic proof lead did not carry over to intrusions. Judge the task, proof, completion and operating cost together.

The limits: One pass per model, with 36 basic cases in 12 related families and 12 intrusions in four. Related variants are not independent incidents. These preliminary results need replication and do not establish statistical superiority or performance on an unseen investigation. We measured model endpoints in the same harness; consumer ChatGPT, Gemini and Claude apps are outside this comparison.

Technical settings and verification

All five models used High effort, pinned OpenRouter providers and no fallback, with identical case, prompt, tool, evidence and grading bindings. The response limit stayed at 16,384 output tokens and the request timeout at 600 seconds. Google recommends at least 32,768 output tokens for existing applications and longer timeouts; this run retained the shared protocol rather than tuning Gemini separately. A future evaluation can test those settings. Independent replay checked every outcome; 942 successful response receipts settled, and all three 429 receipts were investigated with their reservations retained. The failed basic response exhausted 16,384 tokens, including 15,793 thinking tokens.

Data sources and release details

Original GPT and Opus results · Sonnet 5.5 results · GPT-6.1 Sol results · Gemini 4 Argon results · Scoring and methodology · Main benchmark tables

Prices checked October 15, 2026: Google, OpenAI and Anthropic. The cited October 14 GPT/Claude rate vectors were unchanged.

Release hashes

investigations-v06.json: 5e38e2573494a3ce7136d2c680c7dfd55d10d55834c6c8d5883e189b91abcb33

investigations-v06-sonnet55.json: ba4bc2aab466f11fa90a06f073f57401f7f5c67bdc1cbc575d84bad84d6a3042

investigations-v06-gpt61sol.json: 91d579a0c603731ad72df3e99a76b070d856bedcacbf2f4c95b9c9519e127edf

investigations-v06-gemini4argon.json: baec2bbe8f3e38a53b60539c8824f11878a296ae49af5a4c6f109e3029f420fd

Frozen chart snapshot: 58d460fcb87a0e183a231cc4875928b4e25162c20b76190922663da9a9fb52b4