On July 21, 2026, alongside Gemini 3.6 Flash and 3.5 Flash-Lite, Google announced a third model that is nothing like the other two. Gemini 3.5 Flash Cyber is purpose-trained for cybersecurity, and it is not generally available.
It is a 3.5 Flash derivative fine-tuned to discover, validate, and remediate software vulnerabilities. It got its own separate post on the DeepMind blog, which itself says a lot about how differently Google treats this one.
Why a Small Model?
At first glance it seems backwards. Vulnerability hunting is hard work, so why a Flash-class model instead of the largest one available?
The answer is economics. Scanning for vulnerabilities is not one giant query, it is the same query repeated thousands of times. You have to sweep an enormous codebase and try dozens of execution paths through the same function. A small, cheap model wins here precisely because the same budget buys far more attempts.
The Results Are Serious
On the CyberGym benchmark, configured for multiple invocations, the model holds its own against models many times its size. Here is the field:
- Gemini 3.5 Flash Cyber (inside CodeMender, max 5 model calls): 83.2%
- Mythos Preview (in Anthropic agent): 83.1%
- GPT-5.6 Sol (in OpenAI agent): 83.6%
- Mythos 5 (in Anthropic agent): 83.8%
- GPT-5.5-Cyber (in OpenAI agent): 85.6%
Worth being straight about this: Flash Cyber does not win CyberGym, it sits near the bottom of the pack. But that misses the point. It reaches this score with a far smaller and cheaper model, landing within 1.5 points of flagship competitors. When you have hundreds of thousands of files to scan, that gap changes everything.
On real-world evaluations the picture flips:
- V8 JavaScript engine: Across a fixed number of invocations, Flash Cyber found 55 unique confirmed issues. For comparison: 3.5 Flash found 47, Claude Opus 4.6 found 36. Ten of those were found only by Flash Cyber and missed by every other model.
- Big Sleep evaluation (pass@1): It significantly outperformed both mainline 3.5 Flash and 3.6 Flash on complex, real-world vulnerabilities.
- Chrome production commit scanning pipeline (pass@1): A substantial uplift over 3.5 Flash. Google added a telling footnote here: newer versions of competing models had to be left out because their safety guardrails made them refuse the task.
The most striking example came from Google’s own Cloud team: the model found remote code execution and memory-corruption flaws in production services within two hours, and produced reliable exploits that bypassed ASLR and W^X protections.
This is not a static analyzer flagging maybes. It proves what it finds.
Why Is Access Restricted?
Here is the crux. Vulnerability-discovery technology is inherently dual-use: the same capability serves the defender and the attacker equally well.
So Google kept it off the general API. Access is:
- Limited to governments and trusted partners,
- Available only through CodeMender,
- Part of a limited-access pilot program, expanding over time.
The stated reasoning is to get defenders ahead of attackers without handing the capability directly to malicious users. On the same day, Google also said 3.6 Flash shipped with strengthened Frontier Safety safeguards against cyber offense and CBRN misuse.
What This Means
A few years ago vulnerability hunting rested entirely on human expertise and fuzzing infrastructure. Now a language model surfaces 55 new confirmed issues in V8, one of the most heavily audited codebases on earth.
For defenders that is good news: holes can be closed before attackers find them. But the other side of the equation is obvious, and Google’s decision to restrict access is effectively an admission of it.
We saw the same debate around Anthropic’s security-focused model: What is Claude Mythos? For the other models announced the same day: Gemini 3.6 Flash and 3.5 Flash-Lite
What do you think? Should models like this stay restricted, or be opened up to every security researcher? Let us know in the comments! 👇
Frequently Asked Questions
What is Gemini 3.5 Flash Cyber?
It is a cybersecurity-specific AI model announced by Google DeepMind on July 21, 2026. Built on Gemini 3.5 Flash, it is fine-tuned to discover, validate, and remediate software vulnerabilities.
How do I get access to Gemini 3.5 Flash Cyber?
It is not on the general API. Access is limited to governments and trusted partners, available only through CodeMender, and gated behind a limited-access pilot program that will expand over time.
What is CodeMender?
CodeMender is Google’s code security agent. It runs Gemini 3.5 Flash Cyber internally and can be configured to invoke the model up to five times per analysis. Multiple agents explore different code paths in parallel and their findings merge into one report. CodeMender’s foundational capabilities are also offered to regular enterprise customers through the Gemini Enterprise Agent Platform.
Why is it not publicly available?
Vulnerability-discovery technology is dual-use: the same capability serves defenders and attackers equally. Google says it restricted access to get defenders ahead of attackers without handing the capability directly to malicious users.
Does Gemini 3.5 Flash Cyber actually find real vulnerabilities?
Yes. It found 55 unique confirmed issues in the V8 JavaScript engine (against 47 for 3.5 Flash and 36 for Claude Opus 4.6), ten of which no other model found. Google’s Cloud team reported the model finding remote code execution flaws in production services within two hours, along with working exploits that bypassed ASLR and W^X.
What is CyberGym, and where does the model rank?
CyberGym is a benchmark measuring a model’s ability to find security vulnerabilities. Flash Cyber scored 83.2%. Ahead of it: GPT-5.5-Cyber at 85.6%, Mythos 5 at 83.8%, GPT-5.6 Sol at 83.6%. Behind it: Mythos Preview at 83.1%. So it does not win, but it reaches that score with a far smaller and cheaper model.
How is it different from Claude Mythos?
Both are security-focused models with restricted access. Flash Cyber is deliberately small and cheap: it is built for thousands of repeated scans rather than one powerful call, and it only runs inside the CodeMender agent. For a fuller comparison see What is Claude Mythos.