Google launches Gemini 3.5 Flash Cyber, a lightweight model to find and patch vulnerabilities at scale

Google DeepMind has unveiled Gemini 3.5 Flash Cyber, a cybersecurity-specialized model built on the Gemini 3.5 Flash base and tuned specifically to find, validate and patch software vulnerabilities quickly and efficiently. According to the company, this model outperforms the conventional Flash at these tasks and is positioned as a cheaper, more scalable alternative to large cybersecurity models, which tend to rely on costly calls to massive systems.

The announcement builds on Google's earlier efforts in this area, including CodeMender, its code security agent capable of automatically detecting and fixing critical vulnerabilities. The central rationale for the launch is an increasingly evident arms race: AI agents are becoming capable of finding vulnerabilities faster than defensive teams can fix them, and Google argues that confronting that global threat requires an approach that is at once powerful, affordable and scalable.

One of the most striking aspects of the announcement is the deployment strategy. Because it is a "dual-use" technology —that is, one that can be used both to defend systems and, potentially, to attack them—, Google has opted for deliberately restricted access: 3.5 Flash Cyber will be available in a limited pilot program, exclusively for governments and trusted partners, through CodeMender, with a promise to expand over time. In parallel, the company will bring CodeMender's core capabilities to general customers through the Gemini Enterprise Agent Platform.

The article also explains the technical logic behind using a "lightweight" model for this task. Finding bugs deeply buried in code requires exploring an immense execution space, and relying on a single expensive call to a huge model can become a bottleneck. Being cheaper and faster, 3.5 Flash Cyber can be invoked multiple times within CodeMender —up to five times to produce a single final report, as detailed— which allows many more code paths to be analyzed before subagents consolidate the findings into a high-quality report. This architecture, according to Google, makes the model especially suited to frequent scans, time-sensitive release processes or large-scale commit review pipelines.

As for results, Google reports tests across several evaluation benchmarks. On CyberGym, a benchmark that measures AI agents against hundreds of real software vulnerabilities, the agent configured with 3.5 Flash Cyber achieved competitive performance against significantly larger models (although the article itself clarifies that the competitors' results come from vendor self-reported figures, which should be taken with caution). In addition, Google's Big Sleep team built an independent evaluation, without the usual safety safeguards, focused on finding critical, hard-to-detect vulnerabilities in code as complex as that of Chrome and Safari; in that context, 3.5 Flash Cyber clearly outperformed both the conventional Flash and the 3.6 Flash version.

The model was also evaluated in Google Chrome's production commit-scanning pipeline, using publicly undisclosed vulnerabilities to avoid results being contaminated by prior training. There too it showed a significant improvement over the conventional Flash. The article notably points out that more recent versions of competitors' models released after Opus 4.6 refuse to perform these tasks due to their own safety safeguards, which is why they do not appear in that comparison.

One of the most concrete data points in the announcement concerns the V8 JavaScript engine, a highly complex codebase: with a fixed number of invocations, 3.5 Flash Cyber found 55 confirmed unique vulnerabilities, versus 47 for the conventional Flash and 36 for Claude Opus 4.6, including 10 issues that neither of the other two models detected. Google uses this data point to argue that more basic cybersecurity models tend to get stuck finding the same problem repeatedly, whereas a more robust model "casts a wider net" and keeps discovering new code paths and vulnerabilities as the number of invocations is scaled up.

Beyond the benchmarks, the article highlights real-world applications within Google itself: 3.5 Flash Cyber, integrated into CodeMender, is already finding and fixing vulnerabilities in internal codebases such as Chrome, Android, Cloud, Ads and YouTube. As a concrete example, Google Cloud's Vulnerability Research team used it to proactively secure its systems: in just two hours, the model discovered remote code execution vulnerabilities in public APIs and a memory corruption vulnerability in a sensitive production service, additionally generating a 100% reliable remote code execution exploit capable of bypassing standard mitigations such as ASLR (Address Space Layout Randomization) and W^X (Write XOR Execute). Google adds that testers from Wiz and from the Cloud CISO Security Engineering team confirmed the substantial capability improvement over the conventional Flash.

Finally, the article underscores the role of Google's own infrastructure as a competitive advantage: OSV.dev, its open-source vulnerability database with more than 700,000 entries, and more than a decade of OSS-Fuzz results, make it possible to train and evaluate these models with real examples instead of synthetic cases, teaching them to operate industry-standard tools and to analyze millions of lines of code in large-scale projects such as Chromium.

Taken together, the announcement illustrates a tension that runs through the entire sector: the same capability that makes it possible to find and patch vulnerabilities faster than ever is, by definition, the same one that would make it possible to exploit them. Google's response —restricting access to governments and trusted partners while offering a more limited version to the general public via its enterprise platform— is an attempt to balance that duality, although the article itself implicitly acknowledges that this is delicate terrain, explicitly mentioning that other labs are already incorporating safeguards that lead their models to reject tasks of this kind. This launch is likely to intensify the debate over how to govern access to AI agents capable of operating on both sides of offensive and defensive cybersecurity.