Introducing Gemini 3.5 Flash Cyber

Details

Google DeepMind released Gemini 3.5 Flash Cyber, a specialized cybersecurity model built on Gemini 3.5 Flash and fine-tuned specifically for finding, validating, and patching software vulnerabilities. The model is designed to be invoked multiple times within a single scanning session via CodeMender, Google's code security agent — allowing it to cover a much larger execution search space than a single call to a large, expensive model could cover. The core technical rationale: finding deep-seated flaws requires exploring an immense space of code paths. A single expensive call to a massive model creates a bottleneck. Flash Cyber's speed and low cost allow CodeMender to call it repeatedly, with sub-agents producing a consolidated final report. On the CyberGym benchmark — which tests AI agents against hundreds of real-world software vulnerabilities — calling Flash Cyber up to five times per task achieved competitive results against significantly larger models. On V8 JavaScript engine testing, Flash Cyber identified 55 unique confirmed issues, compared to 47 for Gemini 3.5 Flash and 36 for Opus 4.6. Ten vulnerabilities were found exclusively by Flash Cyber. The model is available only through a limited-access pilot for governments and trusted partners, with gradual expansion planned. Google is also opening CodeMender's core capabilities to general customers using standard Gemini models through the Gemini Enterprise Agent Platform.