Google has introduced Gemini 3.5 Flash Cyber, a lightweight AI model specifically designed to help security teams discover, validate, and patch critical software vulnerabilities at scale.
Announced on July 21, 2026, this model builds on Gemini 3.5 Flash and is optimized for security workflows. It enables agents to inspect large codebases, explore numerous execution paths, and repeatedly test for suspected flaws.
Initially, Google plans to make the model available through a limited-access CodeMender pilot for governments and trusted partners, highlighting the technology’s dual-use potential.
Google Launches Gemini 3.5 Flash Cyber
The release addresses a growing imbalance in software security: AI systems can increasingly identify flaws faster than organizations can investigate and remediate them. Rather than relying on a single costly inference from a large model, CodeMender can invoke Gemini 3.5 Flash Cyber multiple times through sub-agents.
These agents evaluate more code paths, validate potential issues, and consolidate their findings into a final vulnerability report. Google claims that this architecture makes the model suitable for continuous scans, commit-level security checks, and time-sensitive release pipelines.
Google evaluated the model using CyberGym, a benchmark that includes hundreds of real-world software vulnerabilities.
By configuring CodeMender to call Gemini 3.5 Flash Cyber up to five times for a final assessment, the results were reportedly competitive against much larger cybersecurity-focused models. Notably, Google highlighted that competitor figures were self-reported.
The company also tested the model in a Big Sleep evaluation, focusing on hard-to-find vulnerabilities in complex codebases like Chrome and Safari.
According to Google, Gemini 3.5 Flash Cyber significantly outperformed both the mainline Gemini 3.5 Flash and Gemini 3.6 Flash in this environment.
| Feature | Details |
|---|---|
| Model | Gemini 3.5 Flash Cyber |
| Release date | July 21, 2026 |
| Core purpose | Find, validate, and patch software vulnerabilities |
| Foundation model | Gemini 3.5 Flash |
| Deployment | CodeMender limited-access pilot |
| Initial access | Governments and trusted partners |
| Main advantage | Lower-cost, high-frequency agentic vulnerability analysis |
| Target workflows | Codebase scanning, commit scanning, launch checks, vulnerability remediation |
| Broader availability | CodeMender capabilities are also available through Gemini Enterprise Agent Platform using generally available Gemini models |
In Chrome’s production commit-scanning pipeline, which used undisclosed vulnerabilities to minimize benchmark contamination, Google observed a marked performance improvement over the standard 3.5 Flash model.
A V8 JavaScript Engine test further emphasized the model’s focus on vulnerability diversity. Across a fixed number of evaluations, Gemini 3.5 Flash Cyber identified 555 unique confirmed issues, compared to 474 for Gemini 3.5 Flash and 363 for Claude Opus 4.6.
Google indicated that 101 of the discovered issues were missed by both comparison models, suggesting that the cyber-tuned model can avoid repeatedly identifying the same defect class.
Google has already deployed the model internally across various platforms, including Chrome, Android, Cloud, Ads, and YouTube.
Reports from its Cloud Vulnerability Research team indicate they found remote code execution flaws in public APIs and a memory corruption issue in a sensitive production service within just two hours.
Furthermore, the model successfully generated a reliable remote-code-execution exploit that bypassed ASLR and W^X mitigations during testing.
The company attributes part of the model’s security specialization to its access to OSV.dev’s database, which contains more than 700,000 open-source vulnerabilities and over a decade’s worth of OSS-Fuzz findings.
ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.
